Privacy Policy
Last updated: October 20, 2026
This policy explains how DeskOnTime processes personal data when you use the web platform (https://desk.deskontime.com) and the DeskOnTime app for iPhone and Android (together, "the service").
In short: we only use data to provide the service. We don't sell data, we don't show ads, and the app has no third-party trackers or analytics.
1. Who is responsible for the data
DeskOnTime is offered to notary offices, law firms and other organizations ("the organization"). The organization decides which cases, people and documents it records and who has access: it is the controller of that data. DeskOnTime acts as a processor: it stores and processes the data on behalf of the organization and following its instructions.
For the data of your own user account (name, email, preferences), DeskOnTime is the controller. You can write to us at soporte@deskontime.com.
2. What data we process
| Category | Data | Purpose |
|---|---|---|
| Account | Name, email, organization and role, work groups, language, time zone and notification preferences. Your password is kept in protected form by our identity provider; nobody at DeskOnTime can see it. | Create your account, sign you in, show you what your role allows. |
| Case content | What the organization records: case details, related people (names, ID number, nationality, address, marital status, date of birth, phone, email, ownership share), documents, photos, notes, events and change history. | Manage the organization's cases. |
| Phone | Push notification identifier, operating system (iOS or Android) and app version. | Send you notifications (for example, a case assigned to you) and stop sending them when you sign out. |
| Technical logs | Date and time, operation performed, errors and the IP address of requests. | Security, abuse prevention and troubleshooting. |
Camera, photos and Face ID
- The app uses the camera or your photo library only when you choose to take or attach a photo to a case. Only the photo you pick is uploaded.
- Face ID, Touch ID or fingerprint are checked by your phone. DeskOnTime never receives or stores biometric data. If you turn on quick sign-in, your password is stored encrypted in your phone's keychain and never leaves it.
3. Who we share it with
We don't sell or transfer personal data. We only share it with providers that help us run the service, under contract and with appropriate security measures:
- Amazon Web Services (hosting, database, files, email and notification delivery). Data is hosted on servers located in the United States.
- Apple and Google, only to deliver push notifications to your phone (the notification title and text).
- Artificial intelligence provider (OpenAI), only when someone in your organization uses the AI tools (for example, creating a case from a document). Only the text or document needed for that task is sent.
- Services the organization connects, if it enables them: the notary system for background searches, its WhatsApp provider to show conversations in the case, and queries to the SUNARP public registries.
- Authorities, when required by law.
Because data is hosted outside Peru, there is a cross-border transfer of personal data, carried out with providers that offer adequate levels of protection.
4. How long we keep it
- Case data is kept while the organization keeps its account, because it is part of its professional records. A document removed from a case is no longer shown, but the organization keeps its file.
- Sessions expire after 30 days without use; phones registered for notifications after 90 days; notifications after 180 days; invitations after 7 days.
- When a user account is deleted, its account data, sessions and registered phones are deleted. See Delete account.
5. How we protect it
- Encrypted connections (HTTPS) and data encrypted at rest.
- Each organization only sees its own data, and each person only what their role allows. Permissions are checked on the server on every operation.
- Credentials the organization sets up for external services are stored encrypted.
6. Your rights
Under Peru's Personal Data Protection Law (Law No. 29733) and its regulations, you can exercise your rights of access, rectification, deletion and objection by writing to soporte@deskontime.com. If your data was recorded by an organization (for example, as a person in a case), we will help you direct your request to that organization, which is the controller. If you are not satisfied with the answer, you can contact Peru's National Authority for Personal Data Protection.
7. Children
The service is for professional use and is not intended for anyone under 18.
8. Changes
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will also announce it in the service.