Privacy Policy

1. Introduction

Disqua ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share information about you when you use the Disqua platform ("Service"). We comply with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

The Service is operated by Baby Data s.r.o., which is the data controller for the personal data described in this policy (account, billing, technical and website data):

Baby Data s.r.o.
Roháčova 188/37, 130 00 Praha 3 — Žižkov, Czech Republic
Company ID (IČO): 06956042 · VAT ID (DIČ): CZ06956042
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 291953
Email: privacy@disqua.com (data protection) · hello@disqua.com (general)

Content that customers and their users submit to a workspace (messages, files, tickets, contacts) is processed by us on behalf of the customer that owns the workspace. For that content the customer is the controller and we act as a processor under our Data Processing Agreement.

2. Data We Collect

Account data

When you register, we collect your email address, display name, and password (stored as a bcrypt hash). You may optionally provide a profile photo.

Usage data

We collect data about how you use the Service, including messages sent, files uploaded, channels joined, and features used. This data is used to provide and improve the Service.

Communication data

Messages and files you send through Disqua are stored on our EU-based servers. Workspace administrators may have access to workspace content depending on their plan and settings.

Technical data

We automatically collect IP addresses, browser type, device information, and access logs for security and operational purposes.

Billing data

If you subscribe to a paid plan, payment is processed by Stripe. We store your plan status and invoice history but do not store full payment card details.

3. Legal Basis for Processing

• Contract performance: Processing necessary to provide the Service you subscribed to.
• Legitimate interests: Security monitoring, fraud prevention, error tracking, cookieless website analytics.
• Legal obligation: Compliance with applicable laws and regulations.
• Consent: Marketing emails (you can withdraw consent at any time).

4. Data Storage and Security

All data is stored on servers located within the European Union (see Section 5 for providers that may process data elsewhere). We encrypt connections in transit (TLS 1.2 or higher), store sensitive credentials such as connected mailbox passwords, OAuth tokens and two-factor secrets encrypted (AES-256-GCM), keep user passwords only as bcrypt hashes, restrict access by role, and review our code and infrastructure for security issues.

Your data is never sold to third parties. We do not use your content for advertising purposes.

5. Data Sharing

We share data only with service providers that process it on our behalf, and only to the extent needed for their purpose:

• Hosting and database infrastructure — servers, file storage and database in the European Union
• Email delivery (SMTP relay) — transactional and notification emails
• Stripe — payment processing; payment card details are entered on Stripe-hosted pages and are not stored by us
• OpenAnalyticsAPI — cookieless page-view analytics with anonymised IP addresses
• OpenErrorAPI — technical error reports
• OpenPushAPI — delivery of push notifications
• Anthropic, OpenAI — only when you use AI features (OpenAI also for speech-to-text transcription)
• DeepL — only when you request a machine translation
• Law enforcement — when legally required, with appropriate legal process

The full list, including the purpose and location of each provider, is published on our Sub-processors page. Some providers (Stripe, Anthropic, OpenAI) may process data outside the European Economic Area; such transfers are made on the basis of an adequacy decision or of standard contractual clauses, where required.

6. Data Retention

Account data is retained while your account is active. Deleted messages are permanently removed within 30 days. After account deletion, we retain billing records for 7 years as required by law, and anonymised analytics data indefinitely.

7. Your Rights (GDPR)

You have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure — Request deletion of your data ("right to be forgotten")
• Portability — Export your data in a machine-readable format
• Restriction — Request restriction of processing in certain cases
• Objection — Object to processing based on legitimate interests
• Withdraw consent — Where processing is based on consent

To exercise any of these rights, contact privacy@disqua.com. We will respond within 30 days. You may also lodge a complaint with your national data protection authority.

8. Cookies

We use a small number of first-party cookies for session management, authentication and preferences. Our website analytics is cookieless. We do not use advertising cookies or third-party tracking cookies. You can review our full Cookie Policy.

9. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes at least 14 days in advance via email or in-app notification. The current version is always available at this URL.

11. Contact

For privacy questions or to exercise your rights: privacy@disqua.com
For general inquiries: hello@disqua.com
Postal address: Baby Data s.r.o., Roháčova 188/37, 130 00 Praha 3 — Žižkov, Czech Republic