Privacy Policy

SupportBridge provides an embeddable helpdesk widget and ticket inbox. This policy describes what we process, on whose behalf, and with which providers. If you embed the widget on your website, you are the controller of your visitors' data and SupportBridge acts as your processor.

Data we process

• Account data — agent name, email, and a salted password hash.
• Ticket data — the message, requester name and email, and any attachments submitted through your widget.
• Technical context captured by the widget — browser, operating system, screen resolution, and the page URL where the ticket was submitted.
• Custom metadata your site passes via SupportBridge.identify() (for example a user ID).
• Operational data — IP address, used for abuse rate-limiting counters that expire automatically.
• Sign-in security log — for registrations, sign-ins, sign-outs, email confirmations, and password changes and resets (including failed attempts and why they failed): the time, your IP address, browser identification string, and the account involved. Email addresses typed into failed attempts are kept only as a one-way hash. It is used to detect and investigate account takeover and abuse.

Why we process it

To deliver tickets to your inbox, send confirmation and reply emails, trigger the alerts you configure, protect the service from abuse, and bill paid plans.

Who processes it for us

• A virtual private server provider — application hosting and the database
• Cloudflare — attachment storage (R2) and DNS/CDN
• Amazon Web Services — transactional email (SES)
• Paddle — payments and invoicing for paid plans (Paddle is the merchant of record; we never see card details)
• Telegram, Discord, Slack — only if you configure alerts to those services
• Anthropic, OpenAI, or Google (Gemini) — only if a workspace owner turns on the AI reply assistant, and only the one provider they choose. It runs either on the owner's own API key with that provider or on SupportBridge credit (in which case we send the request under our own account with that provider). When an agent asks for a draft, the ticket's subject, the customer's name, and the conversation text (plus internal notes, if the agent opts in) are sent to the chosen provider; the customer's email address is not sent. If a workspace owner also turns on automatic replies, a visitor's message and the ticket's earlier public messages are sent to the chosen provider when the visitor writes, without an agent asking, and any answer sent back is labelled as written by an AI assistant. We ask OpenAI not to store these requests; each provider's own retention and training terms apply to the account used. The feature is off by default and can be turned off at any time in Settings.

Retention and deletion

Sign-in security log entries are deleted automatically after 180 days.

Ticket data is kept while your workspace is active so you can reference past conversations. You can ask us to delete your workspace and its tickets at any time; a visitor who wants their ticket removed should contact the site that embedded the widget, which can pass the request to us.

Your rights

Depending on where you live you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us at [email protected].

Security

Data is encrypted in transit; passwords are stored as bcrypt hashes; sessions use signed, HTTP-only cookies; and webhook secrets are never displayed after they are saved.

This document is a plain-language template describing how the product works. It is not legal advice — have it reviewed by counsel for your jurisdiction before relying on it.