Privacy

SupportDist runs SupportDist.

Questions or requests about your data: [email protected]. Anything else: [email protected].

• Businesses use SupportDist to run help desks. If you run one, we're responsible for your account's data.
• If you wrote to a business's help desk, that business decides what happens to your message; we keep it for them, and nothing else.
• No ads, no analytics, no tracking — not on our site, not in the widgets on other sites. We never sell or share personal information.
• We never store your IP address: only, for a day or two, a keyed hash of it that limits how much one address can send.
• The one cookie is the session cookie of a signed-in member. The widget sets none.

Signing in is handled by EmbedAuth (embedauth.com), which keeps your email address, your name if you give one, and your password (hashed) or your Google sign-in. We never see your password.

We receive your email, your name and an account id from EmbedAuth, and keep them with your plan, the help desks you own, the teams you're on and your settings (for example, whether a desk emails you about new tickets), when you created the account and when you last signed in. We use them to provide the service: to show you your inbox, to let your teammates see who answered, and to email you what you asked to hear about.

Signed in, your browser holds one cookie: a random session id. Our server stores only a hash of it. A session ends after 14 days unused, 30 days after you signed in at most, or when you sign out.

When you invite someone to a desk's team we keep their email address and send them an invitation; the link works for 7 days, and the invitation is deleted when it's used, withdrawn or out of date.

From your account page you can sign out everywhere, or delete your account. Deletion is immediate: it takes with it the help desks you own, with every ticket, customer and community post on them, and your sign-in at EmbedAuth. If you have Premium, cancel it first.

Each help desk on SupportDist belongs to a business. When you write to one — through its help center, its widget on its own site, or its community — that business is the controller of your data and we process it on its behalf, under the processing terms in our terms. To exercise your rights over it (to see it, correct it or have it deleted), ask the business; we help it do what you ask, and you can also write to us.

What we keep for the business:

• your name (if you give one) and your email address — so the team can answer you, and so we can email you their replies and the link to your conversation;
• what you write, and the topic you pick;
• if you wrote from the widget, the address of the page you were on — its site and path, never anything after them;
• if the desk asks, whether the help was good or not, and anything you add;
• when each message was sent, and when you last opened the conversation.

Your conversation is private between you and the desk's team. You open it with a link only you are sent: its key is in the part of the address after #, which browsers never send to a server, so it never reaches a log. The team can also leave notes on it that you don't see.

A conversation is closed 7 days after it's solved (writing again starts a new one). It's kept until the business deletes it, erases you as a customer, or deletes its desk — or until its owner deletes their account.

To stop one address from flooding a desk, we count how many conversations (at most 20) and community posts (at most 30) it sends one desk a day — by a keyed hash of the day, the desk and your IP address (for IPv6, its /64 block), never the address itself. The counts are deleted after 2 days.

A desk's community is public: anyone can read it. When you post, the name you give is shown with your post; your email address is never shown. The desk's team uses it to reach you — for example, to tell you when they've replied, or to turn your question into a private conversation.

A desk may hold posts for approval before they appear. Posts the team rejects are deleted 30 days later; the team can delete any post at any time.

A desk's widget runs inside a frame from SupportDist on the business's own site. It sets no cookies and loads nothing from anyone else — no fonts, no analytics, no trackers.

So that you can get back to a conversation you started in it, the widget keeps, in the browser's storage for that frame on that site, the number and key of each conversation, and its subject, under sd-conversations:{desk}. It never leaves your browser except to open those conversations. Clearing the site's data removes it.

The widget tells us the address of the page it was opened on (its site and path, nothing after), which the team sees with your message.

We send email from our own mail server: to a desk's customers (we got your message; the team replied, with the reply and your link), to a desk's team (a new ticket; a customer replied — each member can turn these off), invitations to a team, and a note to a community poster when the team replies to their post.

Email carries no tracking pixels and no tracked links. Replies to it aren't read: answer from your link instead.

Every request to SupportDist — the widgets included — passes through Cloudflare, which protects it from attacks and delivers it quickly. Cloudflare processes your IP address and the request on our behalf.

Our servers are rented from a hosting provider in the EU. The web server's access log records each request's IP address, time, page, referring page and browser; its error log, the IP address of a request that went wrong. We use them to keep the service secure and to fix faults, and they're deleted after 5 days. Sign-in links (which carry tokens) are never logged, and conversation keys never reach a server.

Our application's own logs never record your IP address, your email address or what you wrote.

Payments are handled by PayBroadcast (paybroadcast.com) through Stripe. Your card details go to them, never to us. At checkout Stripe may use cookies of its own to prevent fraud.

We learn your plan, your subscription's status, when it renews and the ids PayBroadcast gives your subscription. They keep the payment history, which the law requires for accounting.

We keep a record of each billing notice PayBroadcast sends us for 365 days, to sort out problems and disputes. When you delete your account, the details in those records are erased; only the notice's id, type and outcome remain.

Our newsletter's list is kept by SubscribeAm (subscribeam.com). The signup form on our home page is theirs: your email address goes to them, never to our server, with your IP address, which they keep for 90 days as a record of the request.

We use the address only to send you the newsletter. Unsubscribe with the link in any issue, or by writing to [email protected], and it's deleted.

We set no cookies unless you sign in. Then only one:

• __Host-sd_session — your session (see above), for 30 days at most. It can't be read by scripts and is only sent over HTTPS.

Your browser also stores, in its local storage, things that never leave it:

• theme — your light or dark theme choice, on SupportDist's own pages.
• sd-conversations:{desk} — in a desk's widget, the conversations you started there (see above).

All of these are needed for what you asked for, so they need no consent. There are no analytics, advertising or tracking cookies, and no third-party scripts.

The sign-in form, the pricing and payments panels and the newsletter form are frames from EmbedAuth, PayBroadcast and SubscribeAm, and may store what they need to work under their own policies.

Wherever you live, you can ask us what we hold about you, and to correct it, delete it or hand it over. If you're in the EU, the EEA or the UK these are your rights under the GDPR, and you can also object, and complain to your data protection authority.

Members can delete their account, their desks and anything on them themselves. If you wrote to a help desk, ask the business first: it decides about your messages. Either way, [email protected] reaches us, and we answer within a month.

We rely on the contract to provide the service to members; on the business's instructions for its customers' data; and on our legitimate interest in keeping the service secure for the logs and the intake counters.

Accounts are for people 16 or over. Help desks are run by businesses for their own customers, who are responsible for what they ask of them.

If this policy changes in a way that matters, the date at the top changes, and members are told by email before it applies.