Privacy notice

Version beta-2026-10-14 · effective from 14 October 2026

This notice explains how iDev S.r.l. processes the personal data of visitors to the walkiedesk.app website, of people who create and use a Walkie Desk account, and of people sitting at PCs on which Walkie Desk is installed, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Walkie Desk is in beta: when the service changes significantly we will publish a new version of this notice (see “Changes”). This English version is a translation: in case of differences, the Italian version prevails.

1. Data controller

iDev S.r.l., registered office at Via Luigi Goia 102, 27036 Mortara (PV), Italy, VAT no. and tax code 02656830185. Contact: info@walkiedesk.app, certified email (PEC) idevsrl@pec.it. Further company details are in the legal notice.

2. What we cannot see: the content of sessions

During a remote control session, video, keyboard, mouse and clipboard travel end-to-end encrypted between the controlled PC and the browser of the person connecting. iDev cannot read them: neither the coordination servers nor the relay server know the keys. We do not record or keep screen images, keystrokes, copied text, or file or window names.

3. What data we process

a) Visiting the website and using the user area

The web server records in a technical log the IP address, date and time, the page or resource requested, the result of the request and the user agent (your browser and operating system type).

b) Account

First and last name (the display name), email address and its verification, the password (stored only as an Argon2id cryptographic hash, never in clear text), the authenticator app secret (encrypted), recovery codes (stored only as hashes), the public keys of any security keys or passkeys you register, the public keys of your trusted browsers and their signed chain, your role in the team, the trial or licence status, and the version and date on which you accepted this notice and the terms of use.

c) Sign-ins and security

User area sign-in sessions (start date, last use, browser), failed sign-in attempts and security events such as sign-ins, password or second-factor changes, account recovery, pairing and revocation of PCs. These events are recorded with the IP address they come from.

d) PCs running Walkie Desk

For each PC on which Walkie Desk is installed: an identifier, the computer name, the Windows and program versions, the PC’s public key, the date of the last connection and the accounts and users allowed to connect.

e) Device fingerprint for the free trial

To grant only one free trial per device, the PC sends a stable identifier of its hardware: the endorsement key of the TPM chip or, if missing, the SMBIOS identifier of the motherboard (if neither is available, the program’s key). On the server we keep only a fingerprint computed with a secret server key (HMAC), never the original value. For the same purpose we keep the HMAC fingerprint of the email address of deleted accounts that had used the trial.

f) Remote sessions and connection statistics

For each session: who connected, to which PC, start and end date and time, duration, session mode, whether the connection was direct or went through our relay server, the outcome and technical quality data (bandwidth, bytes transferred, latency, packet loss, frames per second, resolution, video encoding) with the technical events of the session (reconnections, monitor or quality changes). For these statistics we do not store IP addresses or network candidates, only the type of connection.

g) Relay server (TURN)

When the two devices cannot connect directly, the encrypted traffic goes through our relay server, which records in its logs the public IP addresses of the devices, the technical session identifier and the amount of data transferred.

h) Data shown and kept on the controlled PC

During a session, whoever is sitting at the controlled PC sees who is connected: the technician’s name and, if the name is not available, their email address, partly hidden. The program keeps on the PC, in its list of authorised users, the name and email of the technicians the PC has been paired with, for as long as the pairing remains active, and keeps a technical log of connections on the PC. This data stays on the PC, under the control of whoever administers it. When support with QuickSupport becomes available in the free plan for personal use, the person being assisted will be shown the technician’s name and full email address.

i) Abuse reports

Anyone reporting abuse (for example a scam attempt) gives us a description and, if they wish, an email address so we can contact them. The report is linked to the data of the reported session, PC and technician.

j) Communications

Emails you send us (for example to info@walkiedesk.app), problem reports and, during the beta, answers to optional questionnaires. We send you service emails from noreply@walkiedesk.app: address verification, account recovery, security alerts and messages about the service and your licence.

4. Why we process data and on what legal basis

• Providing the service (account, sign-in, pairing PCs, remote sessions, relay, service emails, support): performance of the contract, i.e. the terms of use you accept (Art. 6(1)(b) GDPR). Without this data the service cannot work.
• Security of the service and abuse prevention (logs, security events, blocking repeated attempts, abuse reports, checking compliance with the terms of use): legitimate interest of iDev and of users in a secure service and in preventing unauthorised access and scams (Art. 6(1)(f)).
• A single free trial per device (HMAC fingerprint of the device and of the email): legitimate interest in preventing the free trial from being repeated indefinitely (Art. 6(1)(f)).
• Showing who is connected on the controlled PC: performance of the contract and legitimate interest of the person at the PC in knowing who is controlling it (Art. 6(1)(b) and (f)).
• Improving the service during the beta (connection statistics, problem reports, optional questionnaires): legitimate interest in fixing defects and checking compatibility and quality (Art. 6(1)(f)). Answering questionnaires is optional.
• Legal obligations and requests from authorities (Art. 6(1)(c)) and protection of iDev’s rights in case of disputes (Art. 6(1)(f)).

We do not use your data for advertising, profiling or marketing, and we do not sell it. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR): the automatic per-device trial check only prevents a second free trial on the same PC, and you can ask for it to be reviewed by writing to info@walkiedesk.app.

5. How long we keep data

• Web server and service logs: 14 days.
• Relay server logs: 30 days.
• Account data and paired PCs: as long as the account exists; after the account is closed, deleted within 90 days.
• Session history and statistics and security events: 12 months; the IP address of security events is deleted after 90 days. After an account is deleted, security events remain for the same period only in pseudonymised form, without name or email.
• Expired sign-in sessions, verification links and used or expired pairing codes: deleted after 30 days.
• HMAC fingerprints of the device and of the email for the free trial: 24 months from the last trial in which they appear.
• Abuse reports: 24 months from the closing of the report.
• Emails and requests you send us: for as long as needed to handle them and to protect iDev’s rights.
• Backups: deleted data remains in backup copies until they expire, at most 30 days.
• Longer only if required by law or needed to defend a right in court, for the time strictly necessary.

6. Who receives the data

Data is processed by authorised and instructed iDev staff, only as needed. The following process it on our behalf as data processors under Art. 28 GDPR:

• Aruba S.p.A. (Italy): service servers and relay server in a data centre in Italy, service email, backups in object storage in Italy;
• Scaleway SAS (France): second backup copy in a data centre in the European Union (Paris).

Within your account, the owner and the administrators of the team can see the account’s users, PCs and sessions. Whoever is sitting at the controlled PC sees who is connected (point 3 h). We disclose data to authorities only when required by law or to report a crime, for example reported unauthorised access or a scam. We do not publish the data.

7. Transfers outside the European Union

None: servers, backups and providers are located in the European Union.

8. If you use Walkie Desk to connect to other people’s PCs

If you connect to PCs of customers, colleagues or family members, the personal data you see or process on those PCs during sessions is your responsibility: iDev does not access it (point 2). You must be authorised to connect and inform the people concerned, as required by the terms of use.

9. Security

We protect data with encrypted connections, end-to-end encryption of sessions, a mandatory second factor for every account, device keys that sign the parameters of every session, server access restricted to authorised staff and backups in two different data centres.

10. Your rights

You can at any time request access to your data, rectification, erasure, restriction of processing and portability of the data you provided, and you can object to processing based on legitimate interest. Write to info@walkiedesk.app or to the certified email idevsrl@pec.it: we reply within one month and may ask you to confirm your identity, for example from your account’s email address. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the supervisory authority of the country where you live or work.

11. Do you have to provide the data?

Name, email, password and second factor are needed to create and protect the account: without them we cannot provide the service. Technical data about PCs and sessions is needed for the service to work. Answers to questionnaires and the email in abuse reports are optional.

12. Minors

Walkie Desk is not intended for people under 18: you must be an adult to create an account.

13. Cookies

The website and the user area use only technical cookies and local storage, needed for them to work: no profiling, analytics or third-party services. Details are in the cookie policy.

14. Changes

Each version of this notice has an identifier and a date. If we change it significantly we publish a new version on this page and, if you have an account, we show it to you at your next sign-in, before you continue.

15. Private beta: invitations and sign-ups

Version of this section: beta-2026-10-12. It applies to anyone who receives a personal invitation from us to the Walkie Desk private beta and to anyone who signed up for the beta with the form that was on the home page until 12 October 2026. After you sign up, your account data is processed under the privacy notice of the service that you accept when you create the account.

Controller. iDev S.r.l., with the details given above and in the legal notice. Contact: info@walkiedesk.app.

Personal invitations

Purposes. Sending you a personal invitation to the Walkie Desk private beta and letting you create your beta account with the invitation link.

Legal basis. The legitimate interest of the controller (Art. 6(1)(f) GDPR) in offering the beta to people chosen by iDev, for example customers and partners, with a single, targeted contact. You can object at any time (see below).

What data. Email address, language of the invitation, an internal note with the reason for the invitation, and the dates of sending and expiry. With the invitation we do not store your IP address or your browser type (only the web server technical logs described above remain, for 14 days).

How long. The link is valid for 14 days (or until the expiry stated in the email, if we send you a new link). If you do not create an account, the invitation and your address are deleted 30 days after the expiry or after we cancel the invitation. If you create an account, the address of the invitation is deleted immediately (your account keeps its own) and we keep only the invitation dates and the link to your account until 6 months after the end of the beta, to grant you the terms offered to beta participants.

Who receives the data. No one, except Aruba S.p.A., provider of the server and of the email service, which processes the data on our behalf as data processor under Art. 28 GDPR, and except where required by law. The server is located in Italy.

Your rights. You can request access to your data, its rectification, erasure and restriction of processing, and you can object to the processing (for example, ask us to delete the invitation and not to write to you again) by writing to info@walkiedesk.app or by replying to the invitation email. You have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

Obligation to provide data. None: if you do not want to take part in the beta, ignore the invitation email.

Sign-ups from the home page form (closed)

Until 12 October 2026 you could sign up for the beta with a form on the home page, which is no longer there: we do not accept new sign-ups. For those who signed up, these rules apply.

Purposes. Sending you the invitation to the Walkie Desk beta and the launch announcement. Only if you ticked the optional box, also Walkie Desk news.

Legal basis. Your consent (Art. 6(1)(a) GDPR), given with the boxes of the form and confirmed with the link we emailed you. Consent to news was separate and optional.

What data. Email address, user type (technician, company or individual), language of the page and, for each consent, the version of this notice and the date. With the sign-up we did not store your IP address or your browser type.

How long. If you did not confirm your sign-up, the address is deleted within 7 days of sending the form. After confirmation we keep the data until 6 months after the launch of Walkie Desk, or until you cancel your sign-up, if earlier. If you also asked for news, after those 6 months we keep only your email, language and consent to news, until you cancel your sign-up. When you cancel your sign-up we delete all the data.

Who receives the data. As for invitations: no one, except Aruba S.p.A. (data processor, Art. 28 GDPR) and except where required by law.

Your rights and withdrawal. You can request access to your data, its rectification, erasure, restriction and portability, and object to the processing, by writing to info@walkiedesk.app. You can withdraw your consent at any time with the link in every email we send or by writing to the same address; withdrawal does not affect the lawfulness of processing carried out before it. You have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

16. Support with QuickSupport

Version of this section: qs-2026-10-14. It applies to people who run QuickSupport, the program downloaded from walkiedesk.app/help to receive support without installing anything and without an account. For the technician who connects, the other sections of this notice apply; controller, recipients, transfers and rights are those stated above (sections 1, 6, 7 and 10).

What data. While QuickSupport is open, our server receives and keeps: a technical identifier and the 9-digit ID shown by QuickSupport, the public key of a cryptographic key created at every start (the private key stays only in the program’s memory and disappears when it closes), the computer name, the Windows and QuickSupport versions, and the date of the last connection. The 6-character password never reaches the server: it is only used to securely connect your computer to the technician’s browser. The server and the relay server see the computer’s IP address and record it in their technical logs (sections 3 a and 3 g). For every support session we record, as for other sessions (section 3 f), who connected, when, the duration, whether you allowed or denied it, and the technical quality data.

On the computer. QuickSupport is not installed: it works in a temporary folder with its own technical log (without passwords or keys) and deletes it when you close it. The downloaded file and the traces Windows keeps of every program it runs remain; if Windows asks for network access, the choice you make in that window remains. Before every session QuickSupport shows you who wants to connect, and the session starts only if you press Allow.

Why and on what legal basis. Connecting your computer to the technician you chose (Art. 6(1)(b) and (f) GDPR: the service the technician uses and your interest in receiving support); security and fraud prevention, including abuse reports (Art. 6(1)(f)).

How long. If there was no session, QuickSupport data on the server is deleted 24 hours after the program is closed. If there was a session, it stays linked to the session history for 12 months (section 5). Server logs: 14 days; relay server logs: 30 days.

Your rights. You can exercise them by writing to info@walkiedesk.app, stating if possible the ID shown by QuickSupport and the date of the session, and you can lodge a complaint with the Italian Data Protection Authority (section 10).

17. Reports from the website: vulnerabilities, abuse and other issues

Version of this section: reports-2026-10-14. It applies to people who send a report with the form at walkiedesk.app/en/report (a security vulnerability, abuse of the service such as an attempted scam, or anything else) and to people who send us a report by email. Controller, recipients, transfers and rights are those stated above (sections 1, 6, 7 and 10).

What data. The type of report, the text you write, the optional reference you give (for example the program version or the ID of a device or a session), the language of the form, the date and the version of this section you accepted. Your email address is required for vulnerabilities, because we need it to reply and to coordinate the fix, and optional for abuse and other reports. We do not store your IP address with the report: we only keep it in the server’s memory, for a few hours, to limit automated submissions (the web server’s technical logs described in section 3 remain, for 14 days). Please do not include other people’s personal data in the text beyond what is needed to understand the report.

Why. Handling reported vulnerabilities (checking them, fixing them and, if needed, informing users), as required of software manufacturers by EU product cybersecurity law (Cyber Resilience Act, Regulation (EU) 2024/2847); preventing and fighting abuse of the service; answering other reports. If you leave your email, we send you a confirmation with the report’s code and we use it only for this report, never for other communications.

Legal basis. The legitimate interest of iDev and of users in a secure service and in preventing abuse and scams (Art. 6(1)(f) GDPR) and, for vulnerabilities, the legal obligations on the security of products with digital elements, where applicable (Art. 6(1)(c) GDPR).

How long. All reports (vulnerabilities, abuse and other reports) are kept until they are closed and then for 24 months from closing, after which they are deleted automatically. The emails we exchange with you stay in our mailbox for the same time.

Who receives the data. Reports reach only the iDev staff who handle them. As for other data, Aruba S.p.A. processes the data on our behalf as provider of the server and of email (Art. 28 GDPR). A vulnerability may be reported to the competent authorities where the law requires it, without your data unless you ask us to include it; abuse may be reported to the authorities to report a crime.

Do you have to provide the data? The text of the report is needed to send it; the email is needed only for vulnerabilities. Without the box about the processing of your data the form cannot be sent: alternatively, you can write to info@walkiedesk.app.

Your rights. You can request access to the data of your report, its rectification or erasure, or object to the processing, by writing to info@walkiedesk.app and quoting the report’s code (for example WD-R-7K3M9QXA); you can lodge a complaint with the Italian Data Protection Authority (section 10).