Privacy Policy — HelpDash
Version 1.3.2 · Effective from 30-10-2026
Status: APPROVED by BJS on 30-10-2026 (version 1.3.2). Written 22-09-2026 from what HelpDash actually does and stores. Not legal advice; no lawyer has reviewed this text.
HelpDash is a PROCESSOR for the personal data inside tickets: that data is governed by the Data Processing Agreement at https://helpdash.eu/dpa, not by this policy, which covers your agents' own data.
Built with AI: this product and its documents were written with the help of an AI assistant (Anthropic Claude) under human direction; no customer data is sent to an AI provider.
1. Who is responsible
Data controller: We make AI work s.r.o., IČO 29697115, Nové sady 988/2, Staré Brno, 602 00 Brno, contact support@helpdash.eu. HelpDash is our product; this policy covers only it.
2. Our default: minimise
We collect as little as we can get away with, technically and legally (our internal rule: minimise → hash → encrypt). We do not sell data. We do not run third-party advertising or cross-site tracking. If you decline optional data, the service keeps working — with the honest trade-offs listed in §7.
3. What we collect and exactly why
| What | Why (purpose) | Legal basis | Kept for | Where |
|---|---|---|---|---|
| Your agents' work email addresses (stored encrypted, found through a keyed lookup index) | sign-in links, invitations and notifications about your own tickets | contract (Art. 6(1)(b)) | while the account exists; erased with it | Scaleway Managed PostgreSQL, Paris (FR) |
| Agent display name, language, role and desk grants | show the workspace in your language and enforce who may open which desk | contract | account lifetime | Scaleway, Paris |
| Sign-in tokens (hash only), sessions (hash, IP, browser family) | prove it is your agent; expire idle sessions | contract · legitimate interest (security) | link 15 min; session 30 days at most | Scaleway, Paris |
| Audit trail of what an agent did (who, what, when — never the text of a message) | accountability inside your organisation, and evidence if something goes wrong | legal obligation (Art. 28(3)(h)) · legitimate interest | for as long as your organisation exists; deleted with it | Scaleway, Paris |
| API keys (hash + a keyed lookup index, never the key itself) | let your systems create tickets | contract | until you revoke the key | Scaleway, Paris |
| Technical logs (request id, route, outcome, timing) | keep the service up, spot abuse | legitimate interest | 30 days | Scaleway Cockpit, Paris |
| If you write to us on WhatsApp (the WhatsApp link on this site): your phone number, your WhatsApp name and profile picture (as far as your WhatsApp settings show them), and what you write. The link itself sends nothing to anyone until you write | answer your question | legitimate interest (Art. 6(1)(f)); contract when it is about your account | at most 90 days (the chat deletes itself); longer only when we copy it into a support ticket, which is then kept as our support tickets are | on our WhatsApp Business phone; WhatsApp Ireland Limited carries the chat as an independent controller under WhatsApp's own terms and privacy policy (data may reach the USA: EU-U.S. Data Privacy Framework, Standard Contractual Clauses) |
| Ticket content — your customers' personal data | processed only on your instructions, as your processor | your legal basis, not ours (Art. 28) | your retention setting; deleted on your erasure request | Scaleway, Paris — see the DPA |
4. Who else touches the data (processors)
Scaleway SAS, Paris (hosting, database, object storage for raw inbound mail, transactional email, logs — all in France) · Bunny.net (BunnyWay d.o.o., Slovenia; content delivery in front of the site) · Google Workspace (our own team mailboxes, where mail you send us lands). The authoritative, dated list — with what each one touches and what happens when it changes — is https://helpdash.eu/subprocessors; you are told before a new name starts processing. Each is bound by a data processing agreement; none may use the data for its own purposes.
5. Your rights
Access, rectification, erasure, restriction, portability, objection — write to support@helpdash.eu, we act within 30 days. You can complain to the Czech supervisory authority: ÚOOÚ, https://uoou.gov.cz. Erasure is real: our systems are built to delete (see §2).
6. Cookies and consent
Strictly necessary cookies/storage run always (session, security, your consent choice itself — consent-exempt). Everything optional (e.g. none exists) runs only after you opt in, per purpose, and can be switched off any time at /privacy#consent.
7. If you decline everything — the honest trade-off
Declining costs you no core functionality and we hold no grudge. Beyond what is technically necessary to serve the page, we then track nothing — no analytics, no profiles, no ads. What you give up: nothing — HelpDash runs no analytics, no A/B tests and no advertising; the only storage in your browser is the session that keeps your agent signed in. An agent account needs exactly the first two rows of the table in §3 — a work email and a name. Your customers need no account at all to write to you.
8. Changes
Changes to the service that touch data (new feature, new cookie, new processor, new price flow) update this policy in the same release — the version and date above always tell you where you stand. Material changes are announced in the service.