Privacy Policy

1. Who we are

Iterrate Technologies, LLC operates StateDesk. This policy covers our website, app and support. Questions? Email support@statedesk.me.

We control information used for accounts, billing, security and support. Your company generally controls its workspace content; we process it on the company’s behalf. Each remains responsible for its own privacy duties.

2. Information we handle

• Accounts: names, emails, sign-in records, company, roles, assignments and invitation status. Your team may provide invite details before you register.
• Policy records: the Terms and Privacy Policy version you accepted or acknowledged, your account, whether you acted for a company, and the server-recorded time.
• Workspace: property names, addresses, photos, descriptions, solutions, progress, comments, authors and timestamps.
• Photos: original files, filenames, type, size, validation data and embedded metadata, which may include location. Do not assume StateDesk removes that metadata or blurs private details.
• Billing: customer IDs, subscription and payment status, amounts, currency, dates and invoice references. Stripe handles payment details; StateDesk does not receive full card numbers or security codes through checkout.
• Support and security: messages, contact details, IP addresses, device/browser information, request and sign-in logs, email delivery records and anti-abuse signals.

3. Why we use information

We use information to run accounts and property updates, send service emails, manage billing, provide support, recover the service, prevent abuse, document agreements and meet legal duties.

Where required, we rely on an individual’s contract, legitimate interests balanced against individual rights, legal obligations, or consent. Companies must have a lawful basis for workspace data; their contract alone does not cover every employee or resident.

We do not sell workspace content, use it for targeted advertising or train general-purpose AI models on it. Marketing use needs separate permission.

4. Who can see updates

CEOs can see their company’s properties. Managers and maintenance members see their assigned properties, including authors and team details. Managers can manage maintenance access only within their assigned property.

Companies must keep assignments current. Removing access does not erase past contributions. Photos use private storage and expiring links; an issued link may work until expiry, and downloaded copies cannot be recalled.

5. Service providers

Providers help with hosting, account access, data and photo storage, email delivery, security, payments and support. They receive information needed for their work. The Service Providers page explains these categories; contact support@statedesk.me for provider identities and processing details.

Cloudflare Turnstile uses IP addresses and browser signals to prevent bots and abuse. Cloudflare also uses those signals to improve bot detection.

• Service Providers
• Turnstile privacy addendum

6. Other disclosures

We may share relevant information with confidential advisers, for binding legal duties, claims or lawful responses to safety and security threats, or at your direction. We assess requests and limit disclosure to what is needed.

A business sale may involve a transfer with safeguards and required notices. Shared ownership alone does not give other Iterrate products access to your workspace.

7. Where information is processed

Information may be processed in Singapore, the United States and other countries where we or our providers operate. We do not promise storage or processing in a single country.

Required transfer safeguards must be in place. Contact us before uploading data with location restrictions.

8. Cookies and drafts

Cookies and browser storage support sign-in, preferences and draft recovery, including local photo previews. A local draft is not a saved company record. Clearing site data can sign you out and erase drafts, not server records. Sign out on shared devices.

The app has no advertising pixels or session replay. Sign-in, anti-bot and payment services process technical signals. New nonessential tracking will require assessment and consent where required.

9. Retention and deletion

We keep data while needed for the service, lawful company instructions, support, security, billing, tax or legal claims. When no longer needed, we delete or irreversibly de-identify it.

Closing a problem, retiring a member or cancelling billing does not delete records. Authorized administrators can request return, deletion or closure through support. We verify authority and explain timing, legal exceptions and available formats; this is not a one-click export or deletion service.

Restricted recovery copies may remain after live deletion. We reapply deletion instructions after restoration. We cannot erase copies others already hold lawfully.

10. Security and incidents

We use access controls, private photo storage, encrypted connections and protected server credentials. Keep your devices and login details secure. No service is risk-free.

We investigate incidents, contain harm and notify affected customers, individuals or regulators as required by law and its deadlines.

11. Your rights

Depending on applicable law, you may request information, access, a copy, correction, deletion, restriction or portability; object to processing; withdraw consent; or complain to a regulator. Legal conditions apply. Withdrawal does not undo earlier lawful processing, and we do not penalize rights requests.

Email support@statedesk.me with "Privacy request" and a short description. Do not send passwords or active links. We verify identity proportionately, assist with company-controlled requests and respond within legal deadlines, explaining any lawful extension or refusal.

You may complain to the relevant privacy regulator under applicable law. You do not need our permission to do so.

12. Children and sensitive information

Accounts are for adults aged 18 or over. Do not intentionally upload children’s data; contact us if it was added by mistake.

Photograph the condition, not the person. Avoid faces, IDs, access codes, medical and payment details. Discuss safeguards before any essential sensitive-data use; StateDesk is not a specialized system for regulated sensitive records.

13. Policy changes

Each version shows its date. We will notify you of material changes where required and seek consent when needed. Updates do not authorize incompatible new uses of earlier data.