Privacy Policy

Mewdesk is a live chat service operated by Mewdesk in the Philippines (“we”, “us”). This policy covers two groups of people:

• Customers and their team: the admins and agents who sign up for a workspace, add websites and answer chats. For this data we are the controller.
• Visitors: people who open the chat widget on a customer’s website. The customer decides to collect that data and is its controller; we process it on their behalf under our Data Processing Agreement. If you chatted with a company through Mewdesk and want your data corrected or deleted, contact that company first. We will help them do it.

We follow the Data Privacy Act of 2012 (Republic Act 10173) and its implementing rules, and apply the same standards to everyone regardless of location.

We keep to what the product needs to work. Nothing is bought from or shared with data brokers, and there are no advertising trackers.

• One session cookie (mewdesk_session) keeps you signed in to the dashboard for up to 7 days. It is essential, HTTP-only and not used for tracking.
• Theme preference (light or dark) is stored in your browser’s local storage so the page does not flash on load.
• The chat widget stores a random token in the visitor’s browser local storage so the same visitor can continue their conversation later. It identifies the conversation, not the person, and is never sent to any third party.

We set no analytics, advertising or cross-site cookies, so there is no cookie banner to click through.

• To provide the service: deliver messages between visitors and agents, keep chat history, show analytics to the workspace that owns the data.
• To bill you through Paddle and to turn on the plan you paid for.
• To send the emails the product needs: email verification, offline messages left by visitors, and usage alerts to admins.
• To keep the service safe: rate limiting, detecting abuse, investigating failed payments and disputed account changes using the activity log.
• To answer support requests.
• To meet legal obligations, such as keeping tax records of payments.

We process customer data to perform the contract you accepted in the Terms of Service, to comply with law (tax and accounting), and for our legitimate interest in keeping the service secure. Visitor data is processed on the customer’s instructions; the customer is responsible for having a lawful basis and for telling visitors about the chat in their own privacy notice.

We share personal data only with providers that run part of the service for us, under contracts that limit what they may do with it:

We will also disclose data if the law requires it, for example a valid order from a court or the National Privacy Commission, and we will tell you when we are allowed to. We never sell personal data.

Our servers and some providers are outside the Philippines. Where data leaves the country we rely on the provider’s contractual commitments and, for providers in Europe or the United Kingdom, their standard contractual clauses. The list above shows where each provider operates.

• Chat history: kept until the customer deletes the conversation, the website or the workspace. It is not deleted when a trial or subscription ends.
• Account data: for as long as the workspace exists. Deleting a website deletes its visitors, conversations and attachments; deleting a workspace deletes everything under it.
• Activity log: 180 days, then deleted automatically.
• Billing records: as long as tax and accounting law requires, typically ten years in the Philippines.
• Server logs: a few days, as set by our hosting provider.

All traffic is encrypted in transit. Passwords are hashed with bcrypt. The checkout belongs to Paddle, so card and PayPal details never pass through our servers, and every payment notification is checked against a signature before it changes a plan. Access to customer data inside the company is limited to the people who need it to run the service and support you.

Under the Data Privacy Act you may:

• be informed about how your data is processed (this policy);
• access a copy of the data we hold about you;
• have inaccurate data corrected: admins and agents can edit their own name in Settings;
• have your data erased or blocked, where we have no legal duty to keep it;
• object to processing, and withdraw consent where processing is based on it;
• receive your data in a portable format;
• complain to the National Privacy Commission if you believe we have not respected these rights.

To exercise any of these, email support@mewdesk.com. We answer within 30 days. If you are a visitor who chatted with a company through Mewdesk, write to that company first; they can delete the conversation from their dashboard.

The dashboard is for businesses and may only be used by adults. The chat widget may appear on any customer website; customers are responsible for not using it to collect data from children where that would be unlawful.

When we change this policy we update the date at the top. For changes that reduce your rights or add new uses of data we will email workspace admins before the change takes effect.