Privacy Notice

1. Scope & Our Role

1.1 Who we are

This Privacy Notice is issued by FazDesk Inc., a Delaware corporation (37859 North Winter Wheat Way, San Tan Valley, AZ 85140, United States) (“FazDesk Inc.”). FazDesk provides the FazDesk platform, an endpoint management software-as-a-service product that enables IT teams and managed service providers (“MSPs”) to inventory, monitor, patch, script, and remotely support computers and other endpoints (“Devices”) that they own or are authorized to manage. FazDesk Inc. provides the Service together with its affiliates, which operate hosting zones and provide support under FazDesk Inc.’s instructions. In this Notice, “FazDesk,” “we,” “us,” and “our” refer to FazDesk Inc. and, where they act on its behalf, its affiliates.

1.2 What this Notice covers

This Notice explains how FazDesk collects, uses, discloses, and safeguards personal data across three surfaces we refer to collectively as the “Service”:

the marketing website at fazdesk.com (the “Website”);
the web-based administrative application at fazdesk.net used to manage Devices (the “Console”); and
the software agent installed on Devices (the “Agent”).

This Notice should be read together with the FazDesk Terms of Use, which governs use of the Service, and, for Customers, any separate order form or master subscription agreement and FazDesk’s Data Processing Addendum at fazdesk.com/dpa (“DPA”) that apply to their account. Where this Notice and a signed agreement conflict as to the handling of a specific category of data, the signed agreement controls.

1.3 Two audiences, two roles — please read this carefully

FazDesk’s role under privacy law depends on whose data is at issue. We deliberately keep these two relationships separate throughout this Notice:

(a) Customers and their administrators/users (“Customers”). A “Customer” is the organization (and its authorized administrators and users) that purchases or registers for FazDesk and controls one or more Console accounts. For data about the Customer itself — account and billing data, Console user identities, subscription and support records, and Website interactions — FazDesk acts as the data controller (or, under U.S. state privacy laws, a “business”). We decide why and how that data is processed, and this Notice describes that processing directly.

(b) End Users of managed Devices (“End Users”). An “End User” is an individual whose device, activity, or files are visible through the Service because a Customer has deployed the Agent to a computer they use — for example, an employee whose laptop is enrolled in a Customer’s IT fleet. Data collected from or about Devices — inventory, telemetry, logs, and remote session activity — is collected and processed by FazDesk on behalf of, and strictly under the instructions of, the Customer that deployed the Agent. For that data, the Customer is the data controller (or “business”), and FazDesk acts only as a data processor (or “service provider”/“processor”), as those terms are defined under applicable law (including U.S. state privacy laws and the EU/UK GDPR).

(c) Customers purchasing through an authorized reseller or a FazDesk affiliate. If you purchase your Subscription through an authorized reseller or from a FazDesk affiliate, that reseller or affiliate is an independent controller of the contract, invoicing, and payment data it collects from you under its own agreement and privacy notice. FazDesk Inc. remains the controller of your Console account data and the processor of Device data as described above, and we share with the reseller or affiliate only the account and Subscription information needed to provision, support, invoice, and renew your Subscription.

What this means in practice: if you are an End User and you have questions about data collected from your device, or you want to exercise a privacy right (such as access or deletion), you should generally contact your employer or organization (the Customer) first, since they control the account, decide what the Agent monitors, and can configure or remove the Agent from your device. FazDesk will support Customers in responding to such requests as described in Section 7. FazDesk does not have an independent relationship with, and generally cannot verify the identity of, individual End Users.

2. Information We Collect

We collect the categories of information described below. Each category notes whether it is primarily Customer-related (FazDesk as controller) or Device/End-User-related (Customer as controller, FazDesk as processor).

(a) Account & billing data — Customer data; FazDesk is controller

When a Customer signs up for and administers FazDesk, we collect: names, work email addresses, and phone numbers of administrators and authorized users; company name and business address; login credentials and authentication data (e.g., passwords in hashed form, SSO identifiers, multi-factor authentication status); role and permission assignments within the Console; and billing information such as billing contact details, billing address, plan/subscription tier, and transaction history. Payment card and bank details are collected and processed by our payment processor on our behalf; FazDesk does not store full payment card numbers.

(b) Device, hardware, OS & software inventory — Device data; Customer is controller

Once a Customer deploys the Agent to a Device, the Agent reports inventory data used to populate the Console, including: device name and asset identifiers; hardware details (manufacturer, model, serial number, CPU, memory, storage, peripherals); operating system name, version, and patch level; an inventory of installed software and versions; the account names of users currently or recently signed in to the Device; and running processes and services where a Customer user views them. This data describes the machine and its configuration; it is used for IT asset management, patch/vulnerability visibility, and software license tracking.

(c) Network configuration — Device data; Customer is controller

The Agent reports network-related configuration of the Device, such as internal and external IP addresses, MAC addresses, network adapter details, hostname, and domain/workgroup membership. This helps Customers understand connectivity, segment devices, and troubleshoot network issues.

(d) Telemetry & availability data — Device data; Customer is controller

The Agent periodically reports operational telemetry, including online/offline (heartbeat) status, performance metrics (CPU, memory, and disk utilization, uptime), and alert or threshold events configured by the Customer (e.g., disk space warnings, service failures). This data drives monitoring dashboards and alerting.

(e) Remote session data (screen, terminal, file transfer) — Device data; Customer is controller

FazDesk provides high-impact remote access features — remote desktop (screen), remote terminal/shell, and remote file transfer/access — that operate only when an authorized Customer user actively initiates a session against a Device; the Agent does not stream screen content, accept terminal commands, or transfer files on its own or on any passive/background basis. During an active session: (i) screen data is relayed to display the Device’s screen to the initiating user; (ii) terminal/shell sessions relay commands entered by that user and the resulting output; and (iii) file transfer sessions move files the user selects, to or from the Device, as directed by that user. This content is transient and as-directed: FazDesk relays it to enable the session and does not review, use, or persistently store the substantive content of screen, terminal, or file-transfer sessions beyond what is technically necessary to establish and operate the session, except that session metadata (such as which user initiated a session, the target device, session type, and start/end time) may be logged for security and audit purposes as described in Section 2(i).

(f) Scripts, automation & software deployment — Device data; Customer is controller

Scripts, commands, and software deployment tasks that Customer users run on Devices through the Service, together with their output and status, are stored as Customer Data for the retention period in Section 4.2.

(g) End-User messaging — Device data; Customer is controller

Messages that Customer users send to End Users through the Service’s messaging or broadcast features are relayed to the Device.

(h) Shared files — Device data; Customer is controller

Files that Customer users upload to the Service’s file-sharing feature are stored as Customer Data until the Customer deletes them or the Subscription ends.

(i) Technical logs — mixed; primarily Device data (Customer is controller), with some Console/Website logs (FazDesk is controller)

We generate and retain technical logs to operate, secure, and troubleshoot the Service, including Agent connection and error logs, Console authentication and access logs (who logged in, from where, and what administrative actions were taken), API request logs, and system/security event logs (e.g., failed login attempts, permission changes, and remote session initiation records as noted above).

(j) Third-party integration data — Device data; Customer is controller

Where a Customer connects a third-party service (for example an endpoint security platform), we receive the data the Customer instructs us to retrieve (such as device identifiers, host records, and status) and store the API credentials the Customer provides in encrypted form.

(k) Support & business communications — FazDesk is controller

We keep the content of emails, tickets, and calls with our support, sales, and account teams, and any diagnostic information a Customer shares with us, to respond and to maintain a record of the relationship.

(l) Marketing — FazDesk is controller

If you request product information or subscribe to updates, we use your business contact details to send them. Every marketing email includes an unsubscribe link, and we honor opt-outs promptly.

(m) Website data — FazDesk is controller

The Website is a static site served through Cloudflare. It does not use cookies, analytics, or advertising technologies, and it does not currently offer web forms. Cloudflare, our hosting provider, processes technical data such as IP addresses and browser information to deliver the Website and protect it against attacks. If you contact us by email or phone, we use the information you provide to respond to you (Section 2(k)). We do not collect information about your activities over time and across third-party websites, and therefore do not respond differently to browser “Do Not Track” or Global Privacy Control signals; no third parties collect such information through the Website.

FazDesk is a business-to-business product. The Website and Service are not directed to, and we do not knowingly collect personal data from, children under the age of 16.

3. How We Use Information

We use the categories of information above for the following purposes:

To provide and operate the Service — provisioning Console accounts, enrolling and communicating with Agents, building inventory and monitoring dashboards, running the scripts and deployments Customers request, and delivering alerts.
To enable Customer-initiated remote access — establishing and relaying remote desktop, terminal, and file transfer sessions strictly when and as an authorized Customer user initiates them, and logging session metadata for security and accountability.
For security, abuse prevention & integrity — detecting and responding to unauthorized access, malware, credential compromise, or misuse of the Service; verifying Agent authenticity; and protecting the Service, our Customers, and their Devices.
For support & troubleshooting — responding to support requests, diagnosing issues, and, where a Customer grants access, assisting with configuration or problems on the Customer’s account or Devices.
For billing — invoicing, processing payments and renewals, and maintaining subscription records.
For business communications & marketing — responding to inquiries and, where you have asked for them, sending product information and updates.
For limited service improvement — understanding aggregate feature usage and performance trends to improve reliability, usability, and functionality; we do not use the content of remote sessions (screen, terminal, file transfer) for this purpose.
For legal compliance — meeting record-keeping, tax, and regulatory obligations; responding to lawful requests from courts or authorities; and enforcing our Terms of Use.

We do not use Customer Data or Device data to train artificial-intelligence or machine-learning models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Lawful bases (high level). Where lawful-basis frameworks such as the GDPR apply, we generally rely on: performance of a contract (to provide the Service Customers subscribed to); our legitimate interests (in securing, operating, and improving the Service, and preventing abuse), balanced against individual rights; compliance with a legal obligation; and, where required, consent. Where a data protection law requires consent unless an exception applies, we rely on consent or on the exceptions that law provides, such as performing our contract with the Customer or complying with legal obligations; Device data is processed on the Customer’s instructions under our processing contract with the Customer.

For End User data specifically, because the Customer is the controller, the Customer determines the purpose and lawful basis for monitoring and managing its Devices (for example, as part of its own employment, IT security, or asset management practices). FazDesk processes that data only pursuant to the Customer’s instructions, the Terms of Use, and the DPA — not for FazDesk’s own independent purposes.

4. Data Storage & Retention

4.1 Your data stays in your country

FazDesk hosts each Customer’s Console and Device data in a hosting zone located in the Customer’s own country. When we onboard a Customer in a country where we do not yet operate a zone, we set one up in that country before the Customer’s data is collected. The hosting location of each account is identified in the Order or available on request. Data handled by our payment processor and business email provider is described in Sections 5.1 and 8.2.

4.2 Retention

We retain personal data only for as long as reasonably necessary for the purposes described in Section 3, using these criteria:

Customer Data and Device data (Sections 2(b)–2(j)) is kept while the Customer’s Subscription is active, unless the Customer deletes it earlier. Customers can remove devices and delete files and other Customer Data through the Console. Third-party integration credentials are kept until the Customer removes the integration.
Remote session content (screen, terminal, file transfer) is not stored; it is relayed only to operate the session (Section 2(e)).
Logs (Section 2(i)) are kept for as long as needed for security, troubleshooting, and audit purposes.
Account and billing data (Section 2(a)) is kept for the life of the account and afterward for as long as tax, accounting, and other legal obligations require.
Support, sales, and marketing communications (Sections 2(k), 2(l)) are kept for as long as needed to manage the relationship; marketing contact details are kept until you unsubscribe.
Website (Section 2(m)): we set no cookies and run no analytics; Cloudflare processes request data under its own retention for delivery and security.
After a Subscription ends, the Customer has thirty (30) days to export its data (Terms of Use Section 8.5), after which we delete Customer Data within ninety (90) days. Copies in backups are deleted as backups expire in our ordinary backup cycle.

Upon expiration of the applicable retention period, or upon a valid deletion request or account termination (subject to legal holds, backups, and legitimate business needs such as fraud prevention and dispute resolution), we will delete or de-identify the relevant data in accordance with our data retention and deletion procedures.

5.1 Subprocessors

FazDesk uses third-party service providers (“subprocessors”) and its affiliates to help deliver the Service, in categories such as hosting of the in-country zones described in Section 4.1, payment processing, business email, and website hosting and security. Each subprocessor is bound by contractual obligations to protect personal data consistent with this Notice and, for Customer and End User data, our DPA. Customers can obtain our current list of subprocessors and their locations on request at contact@fazdesk.com. We notify Customers by email at least thirty (30) days before a new subprocessor begins processing Customer Data, as described in our DPA.

5.2 We do not sell personal data

FazDesk does not sell personal data, and does not share personal data for cross-context behavioral advertising, as those terms are defined under U.S. state privacy laws.

Other than with subprocessors as described above, we share personal data only:

To provide the Service — e.g., between a Customer’s Console and its own Agents/Devices, or with subprocessors as necessary to operate the Service;
With authorized resellers and FazDesk affiliates — as described in Section 1.3(c);
With professional advisors — lawyers, accountants, auditors, and insurers, under confidentiality obligations;
To comply with law or legal process — e.g., in response to a valid subpoena, court order, or other lawful government request, or where we believe disclosure is necessary to comply with applicable law;
To protect rights, safety, and security — e.g., to investigate or prevent fraud, abuse, security incidents, or violations of our Terms of Use, or to protect the rights, property, or safety of FazDesk, our Customers, End Users, or the public; and
In connection with a business transfer — e.g., a merger, acquisition, financing, or sale of assets, in which case we will provide notice (such as via the Website or email) before personal data becomes subject to a different privacy notice.

6. Security

We maintain a program of technical and organizational measures designed to protect the confidentiality, integrity, and availability of personal data, including:

Encryption — encryption of data in transit (TLS) between the Agent, the Console, and our infrastructure.
Access controls & least privilege — role-based access controls within the Console, and internal access to Customer and Device data limited to personnel who need it to provide support or operate the Service.
Authenticated, user-initiated remote sessions — remote desktop, terminal, and file transfer sessions require an authenticated Console user with appropriate permissions to actively initiate the session against an enrolled, authorized Device; there is no ambient or passive remote access.
End-User-facing controls — where available, Customers can enable on-screen session notifications, consent prompts before a remote session starts, and a remote-desktop privacy screen, and can restrict who may initiate remote sessions.
Logging & audit trails — authentication events, administrative actions, and remote session metadata are logged to support security monitoring and incident investigation (see Section 2(i)).

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We will notify affected Customers of security incidents involving their data as described in Section 5.6 of the Terms of Use and as required by applicable law.

Customer responsibilities. Security is a shared responsibility. Customers are responsible for safeguarding their own Console credentials and enabling available authentication protections (e.g., strong passwords, multi-factor authentication); configuring which Console users may access which Devices and remote-access features (least-privilege permissioning); promptly deprovisioning users who no longer need access (e.g., departed staff); keeping the Agent updated to the latest supported version; and ensuring they have the right to deploy the Agent to, and monitor, any Device before doing so.

7. Your Rights & How to Contact Us

7.1 Privacy rights

Depending on your jurisdiction (for example, the EEA, UK, Switzerland, or certain U.S. states such as California, Colorado, Connecticut, Virginia, and Utah), you may have rights to: access the personal data we hold about you; correct or update inaccurate data; request deletion/erasure; restrict or object to certain processing; receive a portable copy of your data; withdraw consent where processing is based on consent; and lodge a complaint with your local data protection or privacy supervisory authority.

Data protection laws in other countries may give you similar rights, as well as rights to be informed about processing, to complain to the competent authority, and to claim compensation. We honor the rights that the law of your country gives you.

We respond to rights requests within the time required by applicable law (for example, one month under the GDPR, extendable where permitted, and 45 days under applicable U.S. state laws).

7.2 How rights requests work for our two audiences

Customers (administrators and users of a Console account) may exercise applicable rights over their account and billing data directly by contacting us using the details below, or, for most account data, through Console self-service settings where available.
End Users of managed Devices should generally direct privacy requests to their organization (the Customer that deployed the Agent to their device) first, since the Customer controls the account, determines what is monitored, and can access, export, or delete data, or remove the Agent, directly. If a Customer needs FazDesk’s assistance to fulfill a valid End User request (e.g., to locate or delete specific data within our systems), we will provide reasonable assistance consistent with our DPA and applicable law. If an End User contacts FazDesk directly, we will generally refer the request to the relevant Customer unless we are legally required to respond directly.

We will verify requests before acting on them and may decline or limit requests as permitted by law (for example, where fulfilling a request would reveal another individual’s personal data or is not required by applicable law).

7.3 Contact us

For questions about this Notice or to exercise applicable privacy rights:

FazDesk Inc.
37859 North Winter Wheat Way, San Tan Valley, AZ 85140, United States
Email: contact@fazdesk.com (privacy requests) · support@fazdesk.com (security reports)
Phone: +1 778 637 2333

8. International / Cross-Border Transfers

8.1 Stored in your country

Console and Device data is stored in the hosting zone in the Customer’s own country (Section 4.1) and does not need to leave that country for routine processing.

8.2 When transfers occur

Personal data can still cross borders when: (a) FazDesk Inc. (United States) or our affiliates access data for platform operation, security, and support — our engineering and support personnel may be located outside your country; or (b) we use subprocessors located outside the Customer’s country (Section 5.1), such as our payment processor and business email provider in the United States. Where such transfers involve personal data protected by the EU or UK GDPR or Swiss law, we rely on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), the UK International Data Transfer Addendum, and the Swiss amendments, supported by transfer impact assessments. Where the law of the country where personal data originates restricts cross-border transfers, we comply with the conditions that law sets, including any required assessments or filings.

9. Changes & Effective Date

We may update this Notice from time to time to reflect changes in our Service, legal requirements, or data practices. We notify material changes by posting the revised Notice with a new effective date and, for Customers, by email or Console notice at least thirty (30) days before they take effect, except where a change is required by law; where required by law, we will seek consent. We encourage Customers to review this Notice periodically and to share material updates with their End Users as appropriate.

This Notice is effective as of: October 13, 2026.