Privacy Policy

Last updated: 2 October 2026

This policy explains what personal information ShuffleDesk collects, why, who can see it, and the rights you have over it. We've tried to keep it plain.

1. Who we are

ShuffleDesk is a product of Rezero Consulting Ltd, trading as Rezero Software ("we", "us", "our"). We're registered in England and Wales with company number 11240887. Our registered office is Ground Floor, Dearing House, 1 Young Street, Sheffield, S1 4UP, United Kingdom. We're registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZB957156 (Rezero Consulting Ltd, which also covers ShuffleDesk).

You can contact us about privacy at hello@shuffledesk.io, or by post at the address above.

2. Our role: your employer and us

ShuffleDesk is used by organisations for their own people. When your employer (or another organisation) sets up ShuffleDesk and invites you, that organisation is the controller of the information about you in its workspace, and we process it on its behalf under our Data Processing Agreement. If you have questions about how your organisation uses ShuffleDesk, you can ask them as well as us.

We are the controller for information about people who visit our website, sign up to start a trial, pay for a plan, or are invited through our "Bring ShuffleDesk to your team" form, and for the information we need to run, secure and improve the service.

3. What we collect

  • Account details: your name, work email address, password (stored only as a secure hash), language, time zone and country. We work out your likely time zone and country from your IP address when you sign in, and you can change them in your profile.
  • Profile details you choose to add: a profile photo, your industry and your interests. These help colleagues know who they're talking to, and help us pair people.
  • Workspace details: which organisation's workspace you belong to, your role (admin or member), and invitations sent or received, including the email addresses of people invited.
  • Shuffle activity: which sessions you joined and when, who you were paired with, when each chat started and ended, and how it ended (for example, if someone left early).
  • Feedback and reports: the optional quick rating ("Good", "OK" or "Not great") you can give after a chat, and any report you make about someone's behaviour.
  • Check-in answers: if your organisation turns on check-ins, your answers to short statements such as "I feel connected to my colleagues at work". Answering is optional.
  • Billing details: for the person who pays, the billing contact, company name, billing address and any VAT number. Card payments are handled by Stripe. We never see or store full card numbers.
  • "Bring ShuffleDesk to your team" invitations: if someone tells us about you through our website, we receive your first name and work email, their name and any message they add. We also record the sender's IP address and browser, and whether the invitation link was opened.
  • Technical information: IP address, browser and device type, and server logs, which we use to keep the service running and secure.
  • Cookies: see our Cookie Policy. Analytics cookies are only set if you agree to them.

What we don't collect

We never record, store or listen to your video or audio. Chats connect directly between the two browsers wherever your network allows, and are encrypted in transit using the standard encryption built into WebRTC. Our servers only pass along the short technical messages needed to set up the connection.

Because chats connect directly between browsers, each person's device can see the other person's IP address while they're talking, as with any direct video call. We don't currently use a relay server, so your video and audio don't pass through ours.

4. How we use it, and our legal basis

Under UK and EU data protection law, we need a legal reason ("lawful basis") for each use of your information.

  • To provide ShuffleDesk: running sessions, pairing people, sending calendar invites and reminders, and showing reports to your organisation's admins. Basis: performance of our contract with your organisation, and on its instructions where it is the controller.
  • To pair people well: favouring colleagues who haven't met yet, and shared interests or languages. Basis: legitimate interests (making the service work as intended).
  • To take payment and keep financial records. Basis: contract, and our legal obligations under UK tax law.
  • To keep ShuffleDesk safe: preventing spam and fraud, investigating reports, and protecting our systems. Basis: legitimate interests.
  • To send you one invitation when a colleague asks us to through "Bring ShuffleDesk to your team". We won't email you again unless you sign up. Basis: legitimate interests.
  • To tell admins about product news and changes. You can unsubscribe at any time. Basis: legitimate interests.
  • To count visits and page views across our website and ShuffleDesk with Umami, which doesn't use cookies or store your IP address. Basis: legitimate interests (understanding how ShuffleDesk is used so we can improve it).
  • To understand how our website is used through Google Analytics. Basis: your consent, which you can withdraw at any time using "Cookie settings" in the site footer.

We don't use your information for automated decisions that have legal or similarly significant effects on you, and we don't sell it.

5. What your organisation can see

Admins in your organisation's workspace can see:

  • your name, email, profile details and role;
  • totals, such as how many people joined each session and how many colleague connections the organisation has made;
  • each session's average chat rating and how many safety reports were made (but not who gave which rating, or who reported whom).

Admins cannot see:

  • which sessions you joined, or who you met in them;
  • anything that was said in a chat (it's never recorded);
  • your own ratings or comments about a chat, or the details of any report you make (these are reviewed by our team);
  • your individual check-in answers. Check-in results only ever show as team averages, and only once at least three people have answered.

6. Who we share it with

We share personal information only with the service providers below, who act on our instructions, and when the law requires it. We don't sell personal information or share it for advertising.

  • Amazon Web Services: hosting, database and file storage, in the UK (London).
  • Stripe: payments, invoices and tax calculation for paying organisations.
  • Google: Google Analytics (only with your consent); Google's STUN servers, which see your IP address briefly while a video chat connection is set up; Google Fonts, which supplies our typefaces and so receives your IP address when a page loads; and "Sign in with Google", if you choose it.
  • Microsoft: "Sign in with Microsoft", if you choose it. It confirms your identity and shares your name and email address with us.
  • Slack: if your organisation connects ShuffleDesk to Slack, Slack receives the Shuffle reminders we post to the channel your admin chooses.
  • Cloudflare: Turnstile, which checks our public forms aren't being used by bots.
  • Umami: cookie-free analytics. It receives the pages you visit, your browser, device type and approximate country, and your IP address, which it doesn't store.
  • Sentry: error monitoring. If something goes wrong, it receives technical details of the error, which may include information about your account or what you were doing at the time.

Our emails are sent through NotifiedBy, an email service run by Rezero and hosted in Amazon Web Services' London region. We may also share information with our professional advisers, with authorities when the law requires it, or with a buyer if our business or ShuffleDesk is sold (in which case this policy would continue to apply).

7. International transfers

We store ShuffleDesk data in the UK. Some of our providers (such as Stripe, Google, Microsoft, Slack, Cloudflare, Sentry and Umami) may process information in other countries, including the United States. When that happens, we rely on the protections UK law requires, such as the UK International Data Transfer Addendum, standard contractual clauses, or the UK Extension to the EU–US Data Privacy Framework.

8. How long we keep it

  • Workspace and account data: for as long as your organisation uses ShuffleDesk. If an organisation closes its account, we delete or anonymise its workspace data within 90 days.
  • If you leave a workspace: your organisation can remove you. Your pairing history (which sessions you joined and who you were paired with) is kept and still counts towards that workspace's totals, but admins never see it against your name. If we delete your account at your request, your pairing history is deleted with it, so past totals may go down.
  • Billing records: six years, as UK tax law requires.
  • "Bring ShuffleDesk to your team" invitations that don't lead to a sign-up: 12 months.
  • Server logs: up to 90 days.

9. Your rights

Under UK and EU data protection law, you have the right to:

  • access the personal information we hold about you;
  • have it corrected if it's wrong;
  • have it deleted;
  • restrict or object to how we use it;
  • receive it in a portable format;
  • withdraw consent at any time, where we rely on consent.

To use any of these rights, email hello@shuffledesk.io. We'll reply within one month. If your organisation is the controller of the information, we'll pass your request to them and help them respond.

You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to your local data protection authority. We'd appreciate the chance to put things right first.

California residents: you have the right to know what personal information we collect and to ask us to delete it, and we won't treat you differently for asking. We do not sell or share personal information for cross-context behavioural advertising.

10. Security

We use encryption in transit (HTTPS) for everything, store passwords only as secure hashes, and restrict access to personal information to people who need it to run ShuffleDesk. Video and audio are encrypted between browsers and never recorded. No system is perfectly secure, but if a breach affects your information, we'll tell you and the relevant organisations as the law requires.

11. Age

ShuffleDesk is a workplace tool for adults. It isn't intended for anyone under 18.

12. Changes to this policy

If we make significant changes, we'll let workspace admins know by email before they take effect, and update the date at the top of this page.

13. Contact us

Rezero Consulting Ltd, Ground Floor, Dearing House, 1 Young Street, Sheffield, S1 4UP, United Kingdom
Email: hello@shuffledesk.io