Privacy Policy

1. Who we are

SupportAI is a customer support automation service. Throughout this policy, “SupportAI,” “we,” “us,” and “our” refer to the operator of the SupportAI website and platform.

SupportAI acts as the data controller for personal data collected through our public website, marketing interactions, account registration, and the billing relationship with customers.

For support tickets, chat transcripts, end-customer identifiers, and other business data submitted by our customers into the SupportAI platform, SupportAI acts as a data processor (or service provider) on behalf of that customer. In those cases, the customer is the controller and determines the purposes and means of processing. Our role is explained in more detail in Section 5.

We have not designated a Data Protection Officer unless required to do so by applicable law. For privacy-related inquiries, you may contact us using the methods described in Section 14.

2. Scope

This Privacy Policy applies to personal data we process in connection with:

1. Website visitors and prospects individuals who browse ai4support.app, request a demo, submit a contact form, or otherwise interact with our marketing and sales materials.
2. Customer account holders and users , individuals who create an account, log into the SupportAI platform, manage settings, or are added as team members by an account administrator.
3. Support ticket and helpdesk data , personal data contained in support tickets, chat conversations, and associated metadata that our customers process through the SupportAI platform. This includes data pulled from integrated third-party systems such as helpdesks (Zendesk, Gorgias, Intercom, Freshdesk), ecommerce platforms (Shopify, WooCommerce), and knowledge bases.
4. Integration and connected-platform data , personal data that flows into SupportAI through APIs and integrations configured by the customer.

This policy does not cover how our business customers handle personal data within their own organisations. Customers are responsible for their own privacy notices and lawful bases when they upload or connect data to the SupportAI platform.

3. Categories of personal data collected

We collect and process the following categories of personal data, depending on how you interact with us:

4. Purposes and legal bases

Under the GDPR, we must have a lawful basis for each purpose of processing. The table below sets out our processing purposes and the corresponding legal bases we rely on.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can object to processing based on legitimate interests; see Section 9.

5. Controller vs processor roles

Because SupportAI processes data in different contexts, it is important to distinguish between our role as a controller and our role as a processor.

6. Data sharing and recipients

We share personal data with the following categories of recipients, only to the extent necessary for the purposes described in this policy:

• Hosting and cloud infrastructure providers : to host the SupportAI platform and store data. Our primary infrastructure is EU-based.
• Authentication providers : to manage secure user login.
• Payment service providers : if payments are enabled or processed, we may use third-party providers to handle billing and payment-related transactions. We do not store full payment card details.
• Email delivery and communication providers : to send transactional emails, service notifications, and (where opted in) marketing communications.
• Analytics and diagnostic providers : to understand website and product performance and usage.
• Customer support and business operations tools : to manage inquiries and customer relationships.
• Integrated third-party systems : connected by the customer through our platform (such as Zendesk, Gorgias, Intercom, Shopify, WooCommerce, Freshdesk, or other APIs). Data sharing with these systems is configured and controlled by the customer.
• Legal and regulatory authorities : where disclosure is required by law, court order, or governmental regulation.
• Professional advisers and acquirers : such as lawyers, auditors, or potential buyers in the context of a merger, acquisition, or asset sale, subject to confidentiality obligations.

Sub-processors

Where SupportAI acts as a processor on behalf of a business customer, the third-party services we use to deliver the platform are our sub-processors. Business customers may request a current list of sub-processors by contacting us through the methods described in Section 14.

7. International data transfers

Our primary hosting infrastructure is located in the European Economic Area (EEA). Where possible, we process and store personal data within the EEA.

Where personal data is transferred outside the EEA, the United Kingdom, or Switzerland, we aim to use appropriate safeguards as required by applicable data protection law. These safeguards may include contractual protections (such as the European Commission’s Standard Contractual Clauses), the UK International Data Transfer Agreement or Addendum, or transfers to jurisdictions recognised as providing an adequate level of protection.

You may request more information about the safeguards that apply to your data by contacting us through the methods described in Section 14.

8. Data retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. The table below summarises our retention approach.

9. Your data subject rights

Under the GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification: You can ask us to correct inaccurate or incomplete personal data.
• Right to erasure: You can request deletion of your personal data where there is no compelling reason for us to continue processing it (the "right to be forgotten").
• Right to restriction: You can ask us to restrict processing of your personal data in certain circumstances, for example while we verify a correction request.
• Right to data portability: You can request a copy of your personal data in a structured, commonly used, and machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to object: You can object to processing based on legitimate interests, including profiling. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the data protection supervisory authority in your place of residence, place of work, or where you believe an infringement may have occurred.

We aim to respond to valid requests within one month, subject to lawful extensions and identity verification. Where we act as a processor on behalf of a business customer, we will direct your request to that customer, who is responsible for handling it.

To exercise any of these rights, contact us through the methods described in Section 14.

10. Automated decision-making and AI

The SupportAI platform uses artificial intelligence and machine learning to:

• classify and route incoming support tickets;
• generate suggested draft replies for customer review;
• autonomously resolve certain low-risk, high-confidence support requests based on customer-configured rules and confidence thresholds;
• summarise ticket history and extract relevant information from connected data sources.

Whether an AI-generated reply is sent automatically or held for human review depends on the customer’s platform configuration, including confidence thresholds, escalation rules, and approval workflows. Customers remain in control of these settings.

Important: Unless a customer specifically configures the platform to do so and such configuration is lawful under applicable regulations, SupportAI does not intend to make solely automated decisions that produce legal effects or similarly significant effects concerning individuals on its own behalf. The platform is designed to support human decision-making, not replace it.

Business customers are responsible for reviewing and configuring automated workflows in line with applicable law, including any obligations under Article 22 GDPR concerning automated individual decision-making.

11. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include:

• encryption of data in transit (TLS) and at rest;
• role-based access controls and least-privilege principles;
• logging and monitoring of system access and activity;
• logical isolation of customer workspaces and tenant data;
• vendor security assessments for key service providers; and
• regular review of security practices and incident response procedures.

While we strive to protect personal data, no method of transmission or electronic storage is completely secure. We cannot guarantee absolute security.

12. Children

SupportAI is a business-to-business service intended for use by professionals and organisations. It is not directed to individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or product functionality. When we make material changes, we will:

• post the updated policy on this page with a new “Last updated” date;
• notify account holders by email or through an in-product notice where the changes are significant; and
• where required by law, obtain your consent to the updated terms.

We encourage you to review this policy periodically. Continued use of the website or platform after changes are posted constitutes acceptance of the updated policy to the extent permitted by law.

14. Contact

For questions, requests, or complaints about this Privacy Policy or our data practices, you may contact us through:

You also have the right to lodge a complaint with the data protection supervisory authority in your place of residence, place of work, or where you believe an infringement may have occurred.