Privacy Policy

1. Information we collect

We collect information you provide directly, information generated by your use of the Service, and information from the third-party providers that power the Service.

• Account information: name, email address, and workspace details, collected through our authentication provider, Supabase, when you sign up or log in.
• Workspace content: knowledge base articles, support requests, contact records, and request form configuration that you or your team create in the Service.
• Support conversations: messages, attachments, and other content submitted by your customers through your help center or request forms.
• Billing information: subscription plan, billing address, and payment details, processed and stored by our payment processor, Stripe. We do not store full payment card numbers.
• Usage and log data: pages visited, device and browser information, IP address, and timestamps, collected automatically when you access the Service.
• Custom domain configuration: DNS records and domain ownership details you submit to connect a custom domain to your workspace.

2. How we use information

• To provide, operate, and maintain the Service, including your help center, support request forms, and workspace settings.
• To power AI features, including Supa for your team and on your help center, AI request summaries, and related-request search. The content each feature needs is sent to OpenRouter, which passes it to the AI model provider (currently OpenAI); search text is sent to Voyage AI through OpenRouter to build search embeddings; and related-request checks are processed by TypeSafe AI. We remove email addresses and secret-looking values from support content before it reaches these providers where the feature allows.
• To process subscription payments and manage billing through Stripe.
• To send transactional email, such as account, billing, and workspace notifications, through Resend.
• To secure the Service, prevent abuse, and troubleshoot issues.
• To communicate with you about updates to the Service and, where you have consented, about product news.

3. Legal bases for processing

Where the UK/EU GDPR applies, we process personal information on the following legal bases: performance of a contract with you, our legitimate interests in operating and improving the Service, your consent where requested, and compliance with legal obligations.

4. Third-party service providers

We rely on the following categories of third-party providers to operate the Service. Each provider processes information only as necessary to perform its function for us.

• Supabase - authentication and database hosting.
• Stripe - subscription billing and payment processing.
• OpenAI - AI-assisted response generation for AI credit features.
• Resend - transactional email delivery.
• Vercel - application hosting and infrastructure.
• Google Analytics - optional, consent-based website and product usage analytics.

5. Workspace data and your customers

If you administer a Supahelp workspace, you control the knowledge base content, support requests, and contact records within it, and you are responsible for your own customers' data and for having a lawful basis to process it. In this relationship, you act as the data controller for your customers' information, and Supahelp acts as a data processor, processing that information only to provide the Service to you.

6. Data retention

We retain personal information for as long as your workspace is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and workspace data as described in the "Your rights" section below.

7. International transfers

Our service providers may process and store information in the United States and other countries. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for transfers of personal information from the European Economic Area, the United Kingdom, or Switzerland.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port the personal information we hold about you, and to object to certain processing. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with your local data protection authority.

9. Cookies

We use cookies and browser storage that are necessary to operate the Service, such as keeping you signed in, maintaining your workspace session, and remembering your cookie preference. With your consent, we also use Google Analytics cookies to understand how visitors use the Service. You may decline analytics cookies by choosing essential cookies only; to change a saved choice, clear this site’s browser data and choose again when prompted.

10. Children's privacy

The Service is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Data security

We use reasonable administrative, technical, and physical safeguards to protect the information we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date above and, where appropriate, through the Service or by email.

13. Contact us

Questions about this Privacy Policy can be sent to jimmy950928@gmail.com. These pages are governed by the laws of New Zealand.