Legal
Privacy policy
Dezga is business software: a company opens a workspace and keeps its clients, leads, tasks, documents, messages and files in it. This policy says what data that involves, what we do with it, who else touches it, and how it is deleted. It is written to be read, not skimmed.
Who we are
Dezga ("Dezga", "we", "us") is made and operated by Analog, Erbil, Kurdistan Region of Iraq. The product runs at dezga.app and at each customer's own workspace address (for example company.dezga.app). Questions about this policy go to privacy@dezga.app.
Two roles
For the companies that use Dezga (our customers), we are a processor: the company decides what goes into its workspace, who on its staff may see it, and when it is deleted. Each workspace has its own database; one customer's data is never visible to another.
For the people who sign in (a customer's staff) and for visitors of dezga.app, we are the controller of the small amount of data needed to run an account and a website.
If you are a client, a contact or a lead of one of our customers and your details are in their workspace, the customer is the controller of that data. Contact them first; we help them answer you.
The data
Account data
Name, email address, role, language, an optional photo, and the sign-in session. Passwords are stored only as hashes.
Workspace data
Whatever the company keeps in Dezga: clients, their contact people (name, role, phone, email, WhatsApp number, notes, decision role), leads (a business or person the company may approach: name, contact details, website, city, category, where the lead came from, a score with its reasons, a short audit of the business's online presence), deals, tasks and cases, proposals, estimates, invoices, payments, expenses, contracts, calendar events, meeting notes, chat messages, files, and the log of calls, messages and meetings the staff record.
Data from connected services
Only when the company connects a service and only what that service provides for the purpose below — see Connected services.
Technical data
Server logs (IP address, time, the page or endpoint, the browser), error reports, and an audit log of who changed what inside a workspace. The audit log is part of the customer's workspace.
Website data
dezga.app keeps no analytics trackers. The sign-in launcher remembers the workspaces you opened in your own browser (local storage), and the "find my workspaces" form takes an email address only to send that list.
Connected services
A company can connect outside services to its workspace. Each connection is made by an administrator of that workspace, can be removed at any time, and gives Dezga access only to the data listed here.
- Meta (Facebook and Instagram). Pages and Instagram accounts the company manages, to schedule and publish the posts its staff approve, read the results of those posts and of the ads it runs, and receive the leads from its own Lead Ads forms. See Data from Meta platforms.
- WhatsApp Business (Meta Cloud API). Messages sent to the company's WhatsApp Business number, their delivery status, and the messages the company's staff approve and send from Dezga. Templates are the company's own, approved by Meta.
- Google Maps Platform. When a staff member searches for businesses of a category in a city, Dezga reads the public listing (name, address, phone, website, rating, review count). Nothing is saved until the staff member chooses to keep a listing as a lead. Google's PageSpeed Insights may be asked to measure a public website's speed.
- LinkedIn. Company Pages the company manages, to publish approved posts.
- Google Drive. Files a staff member chooses to import into a task or a Studio item.
- Calendar and email. A mailbox the company connects so that messages from its clients become tasks; the company's own SMTP account for notifications.
Data from Meta platforms
This section exists because Meta asks apps to say exactly what they do with Meta data. It applies to Facebook Pages, Instagram, Lead Ads and WhatsApp Business.
- What we receive. For Lead Ads: the answers a person typed into the company's lead form (typically full name, email, phone, company, city and any custom question), the form, ad, ad set and campaign names, and the time. For Pages and Instagram: the page's posts, their reach and engagement, and the ad spend and results of the company's campaigns. For WhatsApp: the message text or media, the sender's number and profile name, and delivery receipts.
- What we do with it. We show it to the company's staff inside their workspace so they can call the person back, log the conversation, publish what they approved, and read how their posts and ads performed. A lead from a Lead Ads form appears in the workspace's Leads inbox and nowhere else.
- What we never do. We do not sell Meta data, share it with other customers or third parties, use it to build profiles, use it for our own advertising, or combine it across workspaces. Nothing is sent to an AI model unless a staff member asks for it on a specific record, and then only the fields on that record.
- Where it lives. In the customer's own workspace database and, for media, in the customer's file storage, for as long as the customer keeps the record.
- How it is deleted. By the customer (delete the lead, contact or message in Dezga; the Trash holds it for 90 days, then it is purged) or on request to us — see Deleting your data. Disconnecting a Page or the WhatsApp number stops all further data from arriving.
How we use data
- To run the workspace: show records to the people allowed to see them, send the notifications they asked for, keep the audit log and backups.
- To run the assistant when a staff member asks: the fields of the record they are working on are sent to the model provider to write a draft, a summary or an audit. Drafts are shown to a person before anything is sent or stored as final. The provider does not train on this data.
- To keep the service secure and working: logs, error reports, abuse prevention.
- To answer support requests and send service notices about the account.
We do not use workspace data for advertising and we do not sell it.
Who else handles it
We use these providers to run the service; each receives only what its job needs and is bound by its own data-processing terms.
- Vercel — hosting of the application.
- A managed PostgreSQL host — each workspace's database.
- Amazon Web Services (S3) — file storage and backups.
- Anthropic — the assistant's model, only for requests a staff member triggers.
- Pusher — live updates between open browsers.
- LiveKit — calls and meetings started from Dezga.
- Postmark — service email from dezga.app.
- Meta, Google, LinkedIn — only when the company connects them, as described above.
Retention
- Workspace data is kept for as long as the company keeps it. A deleted client, lead, deal, task, invoice or user goes to the workspace's Trash; most records are purged 90 days later, finance records when an administrator empties them.
- Account data is kept while the account exists and removed when an administrator purges the user.
- Backups of a workspace are kept according to the company's own backup settings and are deleted with the workspace.
- Server logs are kept for a short operational period and then discarded.
- When a company closes its workspace, its database and files are deleted after a hand-over period of up to 30 days.
Deleting your data
These are the data-deletion instructions for Dezga, including data that came from Meta platforms.
- If you use Dezga at your company: delete the record in the app (a lead, a contact, a message, a file). It moves to Trash and is purged after 90 days; an administrator can purge it at once from Settings → Trash. To remove every piece of data from a connected service, disconnect it under Settings → Integrations, then delete the records it created.
- If your details are in a customer's workspace (you filled in their form, messaged their number, or are a contact of theirs): ask that company; they control the workspace. If you cannot reach them, write to privacy@dezga.app with the company's name and the details you want removed, and we will act within 30 days.
- If you want your account or your whole workspace deleted: an administrator writes to privacy@dezga.app from the workspace's own domain. We confirm, close the workspace, and delete its database, files and backups after the hand-over period.
Each deletion request is answered with a confirmation and a date by which the data is gone.
Security
Data travels encrypted (TLS) and is stored on encrypted disks. Every workspace has its own database and file bucket. Access inside a workspace follows roles and per-person permissions; every change is written to an audit log the administrators can read. Tokens for connected services are stored encrypted or as hashes and are never shown again after they are entered. Staff of Dezga reach a customer's data only to support that customer, on request, and that access is logged.
Your rights
Wherever you are, you can ask what data we hold about you, have it corrected or deleted, receive a copy of it, or object to a use of it. Write to privacy@dezga.app; we answer within 30 days. If you are in a jurisdiction with a data-protection authority, you may also complain to it.
Dezga is for businesses and is not offered to children; we do not knowingly collect data from anyone under 16.
Changes
When this policy changes in a way that matters, the date at the top moves and workspace administrators are told inside the app. Earlier versions are available on request.
Contact
Dezga, operated by Analog, Erbil, Kurdistan Region of Iraq.
privacy@dezga.app