Privacy Policy

HelloServiceDesk ("we", "our", "us") is a virtual service marketplace platform operated from Kathmandu, Nepal. We connect clients with verified professional service providers across Healthcare, Technology, Finance & Taxation, Legal Compliance, Mental Health, and Education.

This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the rights you have over your data. It applies to all users of helloservicedesk.com and any related applications or services we operate.

If you do not agree with this policy, please do not use our platform. Continued use of the platform constitutes your acceptance of the terms described here.

2.1 Information you provide directly

• Full name and email address (required for account registration)
• Phone number (for account verification and booking communications)
• Profile photo (optional, uploaded by the user)
• Payment information — we do not store card numbers; payments are processed through Khalti and eSewa, which have their own privacy policies
• Identity documents for service providers — national ID, professional certificates, and any documents submitted during the onboarding process
• Messages, notes, and communications sent through the platform including support tickets and booking notes

2.2 Information collected automatically

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time spent, and interactions with the platform
• Login timestamps and session information
• Cookies and similar tracking technologies (see Section 8)

2.3 Video call data

Sessions conducted through our integrated video consultation feature may be recorded for quality assurance purposes. You will always be notified before any recording begins. Recordings are stored securely and are only accessible to the relevant parties and authorised HelloServiceDesk staff.

We use the information we collect for the following purposes:

• Creating and managing your account and profile
• Processing bookings, payments, and service transactions
• Verifying the identity and qualifications of service providers during onboarding
• Sending booking confirmations, reminders, OTP codes, and service updates via email
• Providing customer and technical support through our support ticket system
• Facilitating video consultations between clients and providers
• Improving platform functionality, safety, and user experience
• Detecting and preventing fraud, abuse, and unauthorised access
• Complying with applicable laws and regulations in Nepal and other jurisdictions
• Sending service newsletters and platform updates — you may unsubscribe at any time

We do not sell your personal data to third parties for advertising or marketing purposes.

We share your information only in the following limited circumstances:

4.1 With service providers on the platform

When you book a session, the relevant service provider receives your name, contact details, and booking information necessary to deliver the service. Providers are bound by our Terms of Service and are not permitted to use this information for any other purpose.

4.2 With payment processors

Khalti and eSewa receive the transaction amount and your identifier to process payments. We do not share your full financial details beyond what is required for the transaction.

4.3 With technology partners

We use Google Meet for video consultations. Session links are generated and shared with relevant parties only. Google's privacy policy governs data processed through their services.

4.4 Legal obligations

We may disclose your information if required by Nepalese law, court order, or other legal process, or where we believe disclosure is necessary to protect the rights, safety, or property of HelloServiceDesk, our users, or the public.

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods are:

• Account data — retained for the duration of your account plus 2 years after deletion request
• Booking and transaction records — retained for 7 years to comply with financial record-keeping requirements
• Support ticket communications — retained for 3 years
• Provider identity documents — retained for the duration of the provider relationship plus 1 year
• Video call recordings — retained for 30 days unless required longer for dispute resolution
• Login and security logs — retained for 1 year

When data is no longer required, it is securely deleted or anonymised so it can no longer be linked to you.

We implement industry-standard technical and organisational measures to protect your personal information:

• All data transmitted between your device and our platform is encrypted using HTTPS/TLS
• Passwords are hashed using bcrypt — plain text passwords are never stored
• Two-factor authentication (email OTP) is required on every login
• Account lockout activates after 5 consecutive failed login attempts
• Role-based access controls ensure staff can only access data relevant to their function
• Security headers protect against clickjacking, XSS, and MIME-type attacks
• Provider identity documents are stored in a restricted-access storage environment

While we take reasonable precautions, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security but we commit to notifying you promptly in the event of a breach affecting your data.

Depending on your location, you may have the following rights regarding your personal data:

7.1 Rights for all users

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your account and associated personal data
• Portability — receive your data in a commonly used, machine-readable format
• Objection — object to certain processing of your data

7.2 Additional rights for EU/UK users (GDPR)

• Right to restrict processing of your personal data
• Right not to be subject to solely automated decision-making
• Right to lodge a complaint with your local data protection authority

7.3 Additional rights for US users (CCPA)

• Right to know what personal information is collected and how it is used
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising your privacy rights

To exercise any of these rights, contact us at privacy@helloservicedesk.com. We will respond within 30 days.

We use cookies and similar technologies to operate the platform and improve your experience:

• Session cookies — essential for keeping you logged in and maintaining your session securely
• CSRF token cookies — required to protect forms from cross-site request forgery attacks
• Preference cookies — remember your language and display settings
• Analytics — we may use anonymised analytics to understand how the platform is used and improve its performance

You can control cookies through your browser settings. Disabling essential cookies will prevent the platform from functioning correctly. We do not use third-party advertising cookies.

HelloServiceDesk is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account on our platform, please contact us at privacy@helloservicedesk.com and we will promptly delete the account and associated data.

HelloServiceDesk is operated from Kathmandu, Nepal. If you are accessing the platform from outside Nepal — including from the European Union, United Kingdom, or United States — your information will be transferred to and processed in Nepal.

For users in the EU and UK, we rely on your consent and legitimate interests as the legal basis for processing your personal data. For users in the US, we comply with applicable state privacy laws including the California Consumer Privacy Act (CCPA).

By using our platform, you consent to the transfer and processing of your information in Nepal in accordance with this Privacy Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Send a notification email to all registered users
• Display a prominent notice on the platform for at least 14 days

Your continued use of the platform after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how your information is handled, please contact us:

• Email: privacy@helloservicedesk.com
• Support: Contact form
• Address: HelloServiceDesk, Kathmandu, Nepal