Privacy Policy

Last revised: October 29, 2026

This Privacy Policy describes how Myrax Core GmbH ("we", "us", "our") collects, uses and discloses information about you for the website peerdesk.app and its subdomains (the "Website"), PeerDesk's AI-powered business agents, and any services, content, tools, features and functionality offered on or through our Website (collectively, the "Services").

Please read this Privacy Policy carefully. It explains what we do with personal data and on what basis. If you do not agree with it, please do not use the Services.

1. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time, updating the "Last revised" date above. If we make material changes, we will use reasonable efforts to notify you. Your continued use of the Services after changes constitutes acceptance.

2. Information We Collect

Information You Provide Directly

• Account information: name, email address, and login credentials when you create an account.
• Profile information: language preferences, timezone, and other settings you configure.
• Agent configuration: business details, branding assets (logos, colors), custom rules, and services you configure for your AI agents.
• Communications: messages you send through the platform, including chat messages with AI agents and peer-to-peer communications.
• Payment information: if applicable, collected through third-party payment processors.

Information Collected Through Your Use of the Services

• Usage data: how you interact with the Services, including pages visited, features used, and actions taken.
• Device information: IP address, browser type, operating system, and device identifiers.
• Location information: approximate location based on IP address (city-level), used for analytics and visitor mapping.
• AI interaction data: prompts sent to AI agents, responses generated, tool calls made, and actions taken by agents on your behalf.

Information from Third-Party Services

If you connect third-party services (such as Google Calendar, email providers, or NullLink identity vault), we may receive information from those services as necessary to provide the Services.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Services
• Process your requests and operate AI agents on your behalf
• Translate messages between languages for multilingual communication
• Send you notifications about appointments, tasks, and agent activity
• Analyze usage patterns and improve our AI models and platform
• Ensure the safety and security of the Services
• Comply with legal obligations

4. Peer-to-Peer Communications

PeerDesk uses WebRTC technology for peer-to-peer (P2P) communications. This means:

• Direct communication: Chat messages and calls between users are transmitted directly between participants' devices.
• No server storage of P2P content: We do not store the content of your P2P messages or calls on our servers.
• Signaling data: We process connection metadata (such as room codes and peer identifiers) necessary to establish P2P connections.
• Auto-translation: If you enable multilingual translation, message text is sent to our translation service (powered by OpenAI) for processing. Translations are not stored beyond the active session.

5. AI Agent Interactions

When you interact with AI agents:

• Your messages are processed by AI language models (such as OpenAI GPT) to generate responses and take actions.
• We may log interaction data (prompts, responses, tool calls) for debugging and service improvement purposes.
• AI agents may access connected third-party services (calendars, email) on your behalf based on the permissions you grant.
• AI-generated outputs may be inaccurate. You should review important actions and not rely on agents for professional advice.

6. Credentials You Save and Zero-Knowledge Vault (NullLink)

You can save credentials (passwords, API keys, tokens, identity documents and attributes) in your vault and allow agents you choose to use them. The vault uses zero-knowledge encryption:

• Your credentials are encrypted in your browser, with a key derived from your passphrase, before they are stored.
• We cannot read your encrypted credential data and we cannot recover it. If you lose your passphrase, the content is lost.
• When you allow an agent or connection to use a credential (for example to post to your blog or read your calendar), the credential is made available to that agent only for the purpose you authorised. Sealed copies used by our services are encrypted at rest and can be deleted by you at any time.
• You choose what you save and connect, and you are responsible for having the right to use it. We do not use your credentials for any other purpose.

One optional exception: if you link a Swiss e-ID in NullLink, our server sees the attributes you approve once, while the link is made, and then hands them to your browser to be encrypted into your vault. Details are in the NullLink privacy policy at nulllink.ch.

7. Cookies and Tracking Technologies

We use minimal cookies and local storage for:

• Authentication: Session tokens to keep you logged in.
• Preferences: Language settings, theme preferences, and UI state.
• Analytics: Basic visitor analytics (page views, referrers, approximate location).

We do not use third-party advertising cookies or trackers.

8. Roles, Disclosure and Subprocessors

Who is responsible for what

• We are the controller for the data of our own users and account holders, visitor analytics and security logs.
• Operators are the controller for the personal data of their own customers, members and visitors that they collect through their pages and agents (bookings, orders, enquiries, messages). For this data we act as processor and process it only on the Operator's instructions, to provide the Services. We keep it confidential, secure it as set out in section 9, only use subprocessors that are bound to equivalent duties, help the Operator to answer data-subject requests, tell the Operator without undue delay about a data breach, and delete or return the data at the end of the service. The Operator is responsible for the legal basis, for informing its customers, and for the content of the data. Our Data Processing Agreement applies.
• If you are the customer of an Operator, please direct requests about your data to that Operator first; we will help it respond.

Payments

We do not process payments between Operators and their customers, and we do not receive or store card numbers for such payments. Payments to an Operator go directly to the Operator through the provider the Operator uses. We only process the payment data that is needed to bill our own paid plans, through our payment provider.

Recipients and subprocessors

We share data only as needed with:

• Hosting: our infrastructure provider (servers in Frankfurt, Germany).
• AI providers: OpenAI (language models and translation) and fal.ai (image generation), United States. We send only what is needed for the request you make. We use business API terms under which the data is not used to train their models, as far as the provider offers them.
• Payment provider: Stripe, for our paid plans.
• Location lookup: an IP-address lookup service (ip-api.com) to place visitors on a city-level map. Only the IP address is sent.
• Services you connect (for example Google Calendar, email, social networks, blogs): data is sent to them to perform what you asked.
• Authorities and advisers: when required by law or court order, to protect our rights, or to professional advisers bound by confidentiality.

We do not sell personal data.

9. Data Security

We implement reasonable security measures to protect your information, including:

• HTTPS encryption for all data in transit
• WebRTC encryption for P2P communications
• Zero-knowledge encryption for NullLink identity vault
• Role-based access controls for administrative functions

However, no system is perfectly secure. We cannot guarantee absolute security of your information.

10. Data Retention

We keep data for as long as your account is active or as needed to provide the Services, and afterwards only as long as the law requires or a legitimate interest (such as proving a transaction or defending a claim) justifies. Accounting records are kept for 10 years as Swiss law requires. Visitor analytics keep the most recent 1,000 page visits, with the last part of the IP address removed, and daily totals for 90 days. Server logs are kept only as long as needed for security. When you close your account we delete your data after the export period (see our Terms), apart from backups, which are overwritten on a rolling basis. You can ask us to delete your account and data at any time.

11. Your Rights

Under the Swiss Federal Act on Data Protection and, where it applies, the EU GDPR, you have the right to:

• obtain information about the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted, or its processing restricted, where the law provides;
• object to processing based on our legitimate interests, and withdraw consent you have given at any time;
• receive your data in a portable format;
• ask for a human review of a decision that is taken solely by automated means and significantly affects you.

To exercise these rights, contact us at nulllink@myraxcore.com. We answer within 30 days. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or with your local supervisory authority.

11a. Why We Process Data (Legal Bases)

We process data to perform our contract with you (providing the Services), on the basis of your consent (for example optional cookies or connecting a third-party account), to meet legal duties (accounting, responding to authorities), and on the basis of our legitimate interests (security, fraud prevention, improving the Services, defending claims), which we balance against your interests.

12. Children's Privacy

The Services are not intended for children under 18 years of age. We do not knowingly collect information from children. If we discover we have collected information from a child, we will take steps to delete it.

13. International Data Transfers

Our servers are in Germany. Some providers listed in section 8 process data in the United States or other countries without an adequate level of data protection by default. In these cases we rely on the Swiss-U.S. and EU-U.S. Data Privacy Frameworks where the provider is certified, or on the standard contractual clauses recognised by the FDPIC and the European Commission, together with additional measures where needed. You can ask us for a copy of the safeguards. Transfers to the connected services you choose are made at your request.

14. Contact Us and Controller

If you have questions about this Privacy Policy, please contact us at:

Myrax Core GmbH (controller)
Hartenfelsstrasse 17, 6030 Ebikon, Switzerland
UID: CHE-282.944.227
Managing director: Manoj Bhatia
Email: nulllink@myraxcore.com
Website: peerdesk.app