Data Protection

We built HopToDesk to be trusted with production systems, which means being clear about what we process, why, where, and the rights you have over it. This page describes our data-protection practices in plain terms. It should be read together with our Privacy Policy and our Data Processing Agreement.

What we process

  • Account information you give us, such as your email address and name.
  • Connection metadata we need to route and secure a session, such as device identifiers, timestamps, and network information. This is not the contents of your session.
  • Billing information for paid plans, handled by our payment processor.
  • We do not have access to the content of your remote sessions. Connections are end-to-end encrypted between your devices, so we cannot read what happens inside a session.
  • We do not knowingly collect personal information from children under 13.

Why we process it

We process personal data to provide the service you asked for (performance of a contract), to keep the service secure and working well (our legitimate interests), and, where the law requires it, with your consent. You can withdraw consent or object at any time.

Your rights

If you are in the EU, the UK, or a region with similar law, you have the following rights over your personal data:

  • Access. Get a copy of the personal data we hold about you.
  • Rectification. Correct data that is inaccurate or incomplete.
  • Erasure. Ask us to delete your personal data.
  • Portability. Receive your data in a portable format.
  • Objection. Object to processing based on legitimate interests.
  • Restriction. Ask us to limit how we use your data.

To exercise any of these rights, contact us through our contact form and we will respond.

Where your data is processed

You choose your account's data region when you sign up: the United States or the European Union. Dashboard data for an EU-region account (account, device, ticket and configuration data, including file storage and encrypted backups) is stored only on infrastructure under EU jurisdiction, and EU-region accounts sign in at eu.dashboard.hoptodesk.com. An account in the European Union data region can also select the EU only network in its dashboard settings, which limits its devices that run the current Windows, macOS or Linux app to signal and relay servers in the European Union.

Beyond that stored data, some processing spans both regions through the providers we use to run the service: checkout payments, sales inquiries, and the optional AI Assistant involve US providers, and our support staff may access data from the United States when helping you. For transfers out of the EU or UK, we rely on Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework.

Our sub-processors

We use a small set of trusted providers to run the service, in these categories: cloud hosting and infrastructure, transactional email, payment processing, and, only when you enable the optional AI Assistant, an AI provider. The complete list of our sub-processors, naming each provider with its location and transfer safeguards, is published on our Trust and Security page and forms part of our Data Processing Agreement.

We give customers at least 30 days' notice before adding or replacing a sub-processor, and honour reasonable objections.

How long we keep it

We keep personal data only as long as we need it to provide the service and meet our legal obligations. When you close your account or ask us to delete your data, we remove it from our active systems promptly and fully purge it, including from short-term point-in-time backups, within 30 days.

Data Processing Agreement

Our Data Processing Agreement (GDPR Article 28), covering these processing terms, the Standard Contractual Clauses, and our sub-processors, is published at hoptodesk.com/dpa. It is incorporated into our Terms of Service and applies to every business or public-sector customer on any plan, with no separate signature required.

Contact

For any data-protection question, or to exercise a right, use our contact form. For the full picture of how the platform is secured, see our Trust and Security page.