Privacy Policy

Version 1.0.1 · Effective 20 October 2026

The short version (not binding — the sections below are)

• Musing Corporation runs VPCdesk. We decide how your account, billing and support data is used. What you put on your Desks is yours to decide; we only process it to run the service for you.
• We collect what we need to run the service, bill you, support you, keep it safe and market it.
• We do not sell your personal data for money and do not train AI models on your content.
• We use cookies and advertising partners to market VPCdesk, and you can opt out (section 6). We never use what is on your Desks for advertising.
• What you share with other people, they can see.
• We keep your data while your Account exists, and delete it when you ask, except what the law or abuse prevention requires us to keep.
• You can access, correct, export or delete your data. Contact us (section 13).

1. Who we are

1.1 VPCdesk is run by Musing Corporation ("we", "us"). Our contact details are in section 13. This policy covers our websites, the Console and the Services described in our Terms of Service (/terms). Words with capitals (Account, Desk, User, Agent, Customer Content, Residential IP, Services) mean what the Terms say.

1.2 Controller and processor. We are the controller of data about you as a customer, User, visitor or person who contacts us. For Customer Content — what you, your Users and your Agents put on or send through your Desks, including personal data about others — you are the controller and we are your processor, under our Data Processing Agreement. Where we look at Customer Content for our own reasons — security, investigating abuse, or meeting our own legal duties — we act as controller for that purpose. If you use something a customer runs on a Desk, or a Desk someone shared with you, that customer is responsible for your data; we will pass your request to them where we can.

2. What we collect

• Account data: your email address, name, phone number if you give one, the names you give your Account, teams and Desks, pictures you upload, the people you invite and their roles, and the keys you create (we store only a fingerprint of secret keys).
• Sign-in data: sign-in links or codes, or the name, email, picture and ID that a sign-in provider you choose (such as GitHub or Google) sends us. We never receive that account's password or other contents. Our use of data received from Google follows Google's API Services User Data Policy, including its Limited Use requirements.
• Acceptance records: which version of our terms you accepted, when, and from which IP address and browser.
• Billing data: plan, amounts, invoices, refunds and disputes, card country, billing address, tax ID if you give one, and fraud signals from our payment processor. Your full card number never reaches us. If you join our partner programme: payout and tax details and your referrals.
• Usage data: your Desks' sizes, settings and operations, traffic counts, the Residential IPs assigned to them, an audit log of actions in your Account, and technical and security logs (such as IP addresses and requests to our systems). We may keep records linking a shared internet address and time to the Desk that used it, so we can trace reported abuse.
• Sharing data: who you shared a Desk with, with what access, and Desk transfers between Accounts.
• Support data: what you send us by chat or email, our replies and notes.
• Abuse and security records: reports about suspected abuse, our investigations and decisions.
• Marketing and website data: how you found us (for example a referral link, promo code, ad click or campaign), whether a visit led to a sign-up or purchase, and cookies, pixels and similar technologies, including those of our analytics and advertising partners (section 6).

From others: people who invite you or share a Desk with you, your sign-in provider, our payment processor, sanctions and fraud screening, advertising and analytics partners, and people who report abuse.

What you must give us: an email address, and payment details for a paid Plan. Everything else is optional or created as you use the Services.

3. Why we use it

We may use automated checks to spot payment fraud and abuse, which can hold a billing action or a Desk until a person reviews it. You can ask for a person to review any such decision.

4. Who can see your data

4.1 People you share with. When you invite someone, share a Desk, send a link or transfer a Desk, they see what you give them access to. After a transfer, the receiving Account owns the Desk and everything on it. The Account's owners can see the Account's people, Desks, billing and audit log.

4.2 Our staff see your Account details as needed to run the Services, bill you and give support. Our staff do not go into your Desks as a matter of routine. They enter a Desk or look at the data on it only when there is a strong reason that makes it necessary — to keep the Services running or secure, to give support you asked for, to investigate abuse or a breach, or to comply with the law — and only as authorised under an access policy approved by the company's leadership, which allows urgent entries to keep the Services running or secure. Every entry is recorded and reviewed. They may use tools, including AI tools, to help. Everyone with this access is bound by a written, legally binding confidentiality agreement. They look only at what they need for that purpose, never use it for anything else, and keep it confidential.

4.3 Our providers. We use other companies for: hosting and bare-metal servers; backups and object storage; network edge and security; payments; email delivery; support tools; AI providers we use ourselves; the Residential IP network; and analytics and advertising. They may use the data only to provide their service to us, except where they act under their own privacy policies, such as our payment processor for fraud prevention and the Residential IP network provider for the traffic it carries. Customers under our Data Processing Agreement can ask us for the list of providers that handle Customer Content.

4.4 Residential IP. You can turn it on or off for each Desk in its settings. While it is on, its network provider may see which sites your Desks' browsers visit and when, and the content of pages loaded without encryption. It sees our address, not your name.

4.5 AI. AI agents on your Desks use your own model accounts; those providers are your suppliers, not ours. We may use AI to help run the Services and answer support. We do not train AI models on Customer Content, and do not let our providers do so for us.

4.6 Legal requests. We disclose data when the law requires it, to protect someone's life or safety, to prevent fraud or abuse, or to enforce our Terms. We report child sexual abuse material to the authorities as the law requires.

4.7 Business transfers. If our business is sold or merged, your data may pass to the new owner, who must respect this policy until it tells you otherwise.

4.8 We do not sell your personal data for money. Some US state laws treat sharing data with advertising partners as a "sale" or "sharing"; section 6.4 explains this and how to opt out.

5. International transfers

We and our providers may process data in any country, where data protection law may differ from yours (see Terms section 5.5). Where the GDPR or UK GDPR requires a safeguard, we use the European Commission's Standard Contractual Clauses (with the UK addendum), or a provider's certification under the EU-US Data Privacy Framework. You can ask us for a copy.

6. Cookies, advertising and your choices

6.1 What we use. We use cookies, pixels and similar technologies:

• to make the site work — keeping you signed in, security, and remembering your choices. These are always on;
• for analytics — to understand how people use our site and improve it;
• for advertising — to measure how our ads perform, learn which ads and campaigns bring visitors and customers, and show our ads to people who visited our site or may be interested in VPCdesk on other sites and apps ("interest-based advertising" or "retargeting").

6.2 What our advertising and analytics partners receive. Online identifiers such as cookie and device IDs, IP address, approximate location, browser and device type, the pages you view, the ads you click, and whether a visit led to a sign-up or purchase. We may also give a partner a scrambled (hashed) form of your email address to measure our ads or to reach you, or people like you, with them; where the law requires your consent for this, we ask first. Partners such as search, social and display ad networks use this data under their own privacy policies and may combine it with other data they hold about you.

6.3 What we never do. We never use Customer Content, or anything you or your Agents do inside your Desks, for advertising. We do not knowingly target ads at anyone under 18, and we do not use sensitive data (such as health or religion) to target ads.

6.4 "Sale" and "sharing" under US state laws. We do not sell personal data for money. But laws in California, Colorado, Connecticut, Texas, Virginia and other states may treat sharing online identifiers with advertising partners as a "sale", "sharing" or "targeted advertising". You have the right to opt out of it, as described below.

6.5 Your choices and opt-out.

• Cookie settings. Use "Cookie settings" at the bottom of our site to turn analytics and advertising cookies on or off at any time. In the EU, EEA, UK and other places where the law requires consent, they stay off until you agree.
• Global Privacy Control. If your browser sends the Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale, sharing and targeted advertising for that browser.
• Ask us. Email the support contact (section 13) with the subject "Opt-Out Request", and we will stop using your data for targeted advertising, including hashed-email matching.
• Industry opt-out pages. You can opt out of interest-based ads from many companies at once at optout.networkadvertising.org, optout.aboutads.info and, in Europe, youronlinechoices.eu. The ad platforms you use also have their own ad settings.
• Your browser. You can block or delete cookies in your browser settings. The site will not work without the ones that keep you signed in.
• Marketing email. Use the unsubscribe link in any marketing email (section 7).

Opting out does not mean you will see no ads, only that they will not be based on your data from us. Browsers' older "Do Not Track" setting has no common standard, so we rely on GPC instead.

7. Emails

We send emails needed to run your Account. We may also send marketing about VPCdesk. Every marketing email has an unsubscribe link, and you can opt out at any time.

8. How long we keep it

8.1 While your Account exists we keep your data, unless you delete it sooner.

8.2 When you delete your Account (or ask us to), it can be undone for 7 days, then we delete your Account, Desks, backups and the other data in this policy, except:

• billing and tax records, for as long as the law requires, no longer linked to your Account;
• records of what you accepted, for up to three years;
• our abuse decisions, and abuse reports others made, without your contact details;
• if we closed the Account for abuse, a scrambled (hashed) form of the email address, to stop it signing up again;
• anything under a legal hold or needed for a legal claim;
• logs that contain only internal identifiers; and
• backup copies, which are deleted within 30 days.

People's own logins stay unless they belong to no other Account. A person can delete their own login from the Console.

8.3 If your paid Plan ends, your Account moves to the Free Plan and may be deleted after 12 months, with at least 30 days' notice (Terms section 12).

8.4 Other data (logs, support from people without an Account, abuse records, marketing data) is kept as long as needed for its purpose, then deleted or anonymised.

9. Security

We protect your data with measures that fit the risk. Backups are encrypted before they leave our servers, and we hold the keys. No system is perfectly secure. You are responsible for securing your Desks and credentials. If a breach affects your personal data, we will tell you without undue delay, and the authorities where the law requires. A breach affecting Customer Content is reported to our customer under the Data Processing Agreement, so that the customer can tell the people concerned.

10. Your rights

10.1 Everyone. Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, send it to you or another provider in a usable format, and have a person review an automated decision. Where we rely on consent, you can withdraw it at any time. You can copy anything off your Desks yourself at any time.

10.2 How. Contact us (section 13). We may need to confirm your identity. We reply within one month, or tell you why we need up to two more. Requests are free unless clearly unfounded or excessive. Requests about Customer Content go to the customer who controls it.

10.3 Complaints. In the EU, EEA, UK or Switzerland you may complain to your data protection authority. Please let us try to fix it first.

10.4 US residents. Depending on your state, you may have rights to know, access, correct, delete and port your data, and to opt out of targeted advertising, sale or profiling. Section 6.5 explains how to opt out, including through Global Privacy Control. We will not treat you differently for using your rights. If we decline a request, you may appeal by replying.

11. Children

The Services are for people 18 and older. If we learn we hold data about a child, we delete it.

12. Changes

We may update this policy. We will post the new version with its date, keep earlier versions available, and tell you before a significant change applies. Where the law requires your consent to a change, we will ask.

13. Contact

Use the contact details at the end of our Terms of Service (/terms section 23): our postal address, the support and privacy contact, and our representatives in the EU and UK.