Privacy
Last updated 10 November 2026
DeskTours lets coworking and flexible-office operators show their spaces as 3D tours and 360° photos, with live availability, and receive enquiries from people interested in them. This page explains what personal data that involves, why, how long it is kept, and the rights you have under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
Who is responsible
DeskTours is made by DeskOS. Who decides what happens to your data depends on the role you're in:
- People with a DeskTours account (operators and their teams): DeskTours is the Data Fiduciary for your account data.
- Visitors who send an enquiry from a tour: the operator whose tour you used is the Data Fiduciary for your enquiry. DeskTours stores and delivers it for them as their Data Processor. Their name is on the tour.
- Visitors who just look at a tour: we don't ask who you are and don't track you.
What we collect, and why
| Data | Why | How long |
|---|---|---|
| Account: name, email address, sign-in method (email code, Google or DeskOS), organisations and roles | To let you sign in, work with your team and keep the account secure | Until you delete the account |
| Devices you're signed in on (browser or app name, when last used) | So you can see and end sessions, and to spot misuse | Up to 30 days after a session ends |
| What your organisation adds: floor plans, 360° photos and videos, tour details, brand, the list of spaces, seats and prices | To build and publish your tours | Until you delete them; deleted tours and organisations can be restored for 30 days, then they're erased |
| Enquiries from visitors: name, the phone number or email they chose to give, their message, which tour and seat | So the operator can reply to that enquiry | As long as the operator chose: 3, 6, 12 (the default) or 24 months, then deleted automatically |
| With an enquiry: a scrambled (hashed) form of the network address and the browser name | Only to stop spam and abuse | 30 days |
| A request from our website (pricing, a demo, contact): your name, the phone number or email you gave, and what you chose to tell us (company, city, number of centres, whether you use DeskOS, your message), with the same scrambled network details | So the DeskTours team can reply to you | 24 months, then deleted automatically; the network details after 30 days |
| A record of important actions (who invited whom, who published a tour) | Security, and for organisations to see what changed | As long as the organisation exists |
We don't sell personal data, don't use it for advertising, and don't build profiles of visitors. Tours have no advertising or tracking cookies.
People in 360° photos
Operators photograph their own spaces. Faces in 360° photos are blurred automatically before a photo is shown to anyone. Operators are asked to tell the people in a space before it is photographed, and to remove photos on request.
Cookies
We use only the cookies the service needs to work: one that keeps you signed in, and short-lived ones during sign-in. Nothing for advertising or analytics across sites, so there's nothing to accept or refuse.
Who else sees it
- The operator receives the enquiries sent from their tours.
- DeskOS, if the operator connects their DeskOS workspace: availability comes from DeskOS, and enquiries are passed to it as leads.
- The DeskTours team helps operators with their tours when the operator allows it (it can be turned off in Settings → Privacy). The team works on tours only, never sees visitors’ enquiries, and everything it does is recorded in the operator’s activity log.
- Service providers that run parts of DeskTours for us (hosting and storage, sending email, Google if you sign in with it), only to provide the service and under agreements that protect your data.
- Maps: the address and neighbourhood around a tour come from OpenStreetMap. “Directions” opens your own maps app with the address; nothing about you is sent to it by us.
- The law: when we're legally required to, and only what's required.
Your rights
Under the DPDP Act you can:
- Get a summary and a copy of your data. Signed in: Account → “Download my data”.
- Correct or update it. Your name and email are in Account; operators can correct their tours and lists themselves.
- Have it erased. Delete your account in Account. If you sent an enquiry, ask the operator (they can erase everything from your email or phone in one step), or write to us and we'll pass it on.
- Withdraw consent you gave, at any time, as easily as you gave it; this doesn't undo what was done before.
- Nominate someone to use these rights for you if you can't.
- Complain to us first (below); if you're not satisfied, to the Data Protection Board of India.
Children
DeskTours is for businesses and the people who work with them. It isn't meant for anyone under 18, and we don't knowingly collect children's data.
Keeping it safe
Connections are encrypted, sign-in codes and session keys are stored only as hashes, access inside an organisation follows the roles its owners set, and we keep a record of sensitive actions. If a breach affects your data, we'll tell you and the Data Protection Board as the law requires.
Questions and complaints
Write to our grievance contact at privacy@desktours.in. We'll acknowledge within 7 days and resolve within 30.
Changes
If we change this page in a way that matters, we'll say so in DeskTours and by email to account holders before it takes effect.