Privacy Notice

Last updated: 24 October 2026

We want you to understand what information DeskJoey handles, why we need it and who to contact.

1. Identity and contact

DeskJoey (formerly QuoteBrook) is operated by Ashley Paul Hurlow, trading as DeskJoey. Correspondence address: 157 Heol Gwyrosydd, Swansea, Wales, United Kingdom. Email for privacy questions and requests: support@deskjoey.com.

We act as controller for DeskJoey account information and for our own security/support operations. For booking information submitted to a service business through that business's DeskJoey page, the service business usually decides why it is collected and is the controller; DeskJoey generally provides processing services on its behalf. For questions about how a particular business uses your booking details, contact that business first.

2. What information is involved

• Business and staff accounts: business names, contact emails, account credentials stored as password hashes, staff roles and permissions, services, prices, working hours, calendar settings and business branding.
• Customer enquiries and bookings: names, email addresses, telephone numbers, work addresses/postcodes, requested services, appointment times, prices, notes and booking updates.
• Security and operations: login sessions, access/rate-limit information, relevant technical records, email-delivery and system error information.
• Optional integrations: calendar identifiers, authorisation tokens and event or private busy-time information where a business chooses to connect Google Calendar; push-notification subscription data where enabled by the user.
• Business jobs and invoices: job stages, customer billing details, itemised invoices, payment status and references entered by business owners. DeskJoey does not collect their customers' payments through these invoice tools.
• Optional AI and WhatsApp: questions sent to an enabled business's AI receptionist, short conversational context stored in a temporary session, and WhatsApp provider message identifiers/delivery status. The WhatsApp pilot does not store customers' message bodies in the DeskJoey database.
• Optional business billing: subscription/package selections, discount redemptions, billing provider customer and subscription IDs, and billing status. Payment card information is handled by the external payment provider, not entered into DeskJoey.

3. Purposes and lawful bases

Where DeskJoey is the controller, we use account information to register business users, authenticate them, supply the requested software and provide support, usually to perform our contract or take requested pre-contract steps. We use limited technical and security information to prevent abuse, protect accounts and operate the service under our legitimate interests; where necessary we may process records to comply with a legal obligation. We do not sell personal data or use a business's customer-booking information for DeskJoey advertising.

Businesses using DeskJoey determine the appropriate lawful basis for their own customer-booking information. We process that information on their documented instructions under our Data Processing Agreement.

4. Who information is shared with

Booking information is shared with the business receiving the enquiry and, subject to that business's permissions, its authorised staff. We use Hostinger for website/database hosting and Resend for transactional email. A business can optionally connect Google Calendar, in which case relevant event and availability information is exchanged with Google. Website pages may request fonts from Google Fonts. Information may also be disclosed where required by law or necessary to protect rights and security.

4A. DeskJoey Assistant and human support

On the DeskJoey homepage and business-owner app, users may choose to ask DeskJoey Assistant for help. This is separate from the customer booking pages and does not automatically access booking or customer records. We process questions and responses to provide guidance and troubleshoot the platform. The assistant removes common email addresses, phone numbers and credentials where detected, but please do not enter sensitive details. If AI answering is enabled, limited question text and relevant DeskJoey help guidance are sent to OpenAI through its API to generate a response. The assistant can also answer using built-in guidance without an AI provider. It may adapt its wording to the style you use, but it remains an AI assistant. You can rate whether a response was helpful.

Assistant chat transcripts are retained in DeskJoey for up to 30 days, after which they are deleted through our retention process. A user may submit a separate human-support request with their name, email, subject and problem description. Recent chat text is attached to that request only if the user expressly selects that option. A support request may generate an acknowledgement email and a notification to our support team. We can reply directly by email from our private dashboard. Resolved support requests and replies are automatically deleted 180 days after their last update, unless they need to be retained for a legal obligation or dispute. You can clear your conversation at any time; saved chat excerpts attached to tickets are also cleared when you do so. Optional voice input uses the browser's speech recognition feature where available, which may process microphone audio through your browser or device provider; DeskJoey does not intentionally store audio recordings. Optional read-aloud replies use browser speech synthesis. Both require a user action or choice, and no voice feature is enabled by default. Feedback ratings are associated with responses and deleted with their chat history. The assistant does not send marketing messages or enrol users in marketing subscriptions. Contact support@deskjoey.com for an access or deletion request.

4B. Optional business AI receptionist, WhatsApp and billing pilot

A business may later activate a separate AI receptionist on its public booking page. Visitors' typed questions and a small amount of chat history are sent to OpenAI to generate a reply based only on the business's published service details, prices and opening hours. DeskJoey stores that visitor chat context temporarily within the visitor's session rather than as a permanent customer record. The AI cannot inspect private bookings or confirm appointments. Visitors should not include sensitive or personal details in a question.

Where an individual sends a WhatsApp message to a business participating in the optional pilot, Twilio carries the message and the text can be sent to OpenAI to draft a reply. DeskJoey records message IDs and delivery outcomes for duplicate prevention, quotas and troubleshooting; it does not store the WhatsApp message body in its database. Normal WhatsApp and Twilio retention rules also apply. These optional services are inactive unless separately configured.

For DeskJoey's own optional software subscriptions, Stripe may be used to display a hosted checkout, manage payment methods and send signed subscription status notifications. The current integration is a test-mode pilot; we do not activate recurring charges for a business without its explicit opt-in. Discount code usage and entitlement periods are recorded to honour the business's chosen terms.

5. International processing and transfers

Some providers may process or access data outside the UK. Where a restricted transfer occurs, it must be supported by an appropriate lawful route such as UK adequacy regulations or approved safeguards. Details of the relevant provider arrangements and safeguards can be requested at support@deskjoey.com. We review provider arrangements as part of operating this service.

6. How long information is kept

We use the following retention criteria rather than a fixed period for every record:

• Business account, staff and booking records are generally required while the business uses DeskJoey and while they are needed to provide services or manage outstanding requests.
• After closure, we assess whether information is needed for a legal obligation, dispute, security investigation or a requested return of data, and otherwise arrange deletion or anonymisation. Export and deletion requests are handled by support.
• Verification/reset tokens have expiry times and are no longer valid after use or expiry. Technical and notification records are kept only for legitimate security, delivery troubleshooting and operational purposes.
• Backup copies may persist until the relevant backup retention cycle expires. We handle these using the hosting and recovery procedures available to us.

We do not currently provide automatic self-service deletion from the account dashboard. Contact support for a specific access, export, correction or deletion request; not every record can be deleted immediately where the law requires retention.

7. Security

DeskJoey uses HTTPS, hashed passwords, session controls, permission checks and other security protections. No online service can guarantee absolute security. If you suspect unauthorised account access, contact us promptly.

8. Cookies and device storage

We use essential session cookies for sign-in and security. The installable web app can also use local browser storage or caching to provide app functions, and optional push features depend on browser permissions. The application code reviewed for this release does not include behavioural advertising cookies. If non-essential analytics or marketing technologies are introduced, we will update this notice and provide required choices before using them.

9. Your rights

Depending on circumstances and lawful basis, you may have rights to access, correct, erase or restrict personal information, object to certain uses, and obtain portable information. To exercise rights concerning DeskJoey accounts, email us. For a service booking, contact the relevant service business first; we will assist it where required.

You may complain to the Information Commissioner's Office (ICO). You may also contact us first if you would like us to investigate a concern.

10. Changes

We will update this notice as the service changes and indicate the new date above. We will explain materially different uses of information before beginning them where required.

Questions? Contact support@deskjoey.com.