Privacy policy

This policy explains what data Helpdash ("Helpdash", "we", "us") collects when you use helpdash.io or any Helpdash-hosted workspace, why we collect it, how long we keep it, and the rights you have over it. We aim for plain English — if anything below is unclear, email privacy@helpdash.io and a human will respond.

1. Who is responsible for your data

For the marketing site (helpdash.io) and for your account, Helpdash is the data controller. For the data inside a customer's workspace (tickets, chats, end-customer details), the customer running that workspace is the controller and Helpdash processes it on their behalf.

2. What we collect

On the marketing site we collect minimal anonymised analytics (page path, referrer, country-level location, device class) using a first-party endpoint — no third-party trackers, no cross-site cookies, no advertising pixels. Cookies are described in our cookie policy.

When you contact us we receive the data you put in the form (name, email, company, the message itself) plus a timestamp and the originating IP. When you create an account we collect your name, email, password (stored only as a salted hash), and workspace slug; if you sign in with Google, we receive your name and email from Google. Inside a workspace, we store the operational data your team enters — tickets, replies, attachments, articles, audit events, automation rules, CSAT responses.

3. Payments

Our order process is conducted by our online reseller Paddle.com, the Merchant of Record for all our orders. When you subscribe, your payment details are collected and processed by Paddle — we never see or store your full card number. Paddle's handling of your data is described in the Paddle privacy policy. We receive from Paddle the information needed to run your subscription (plan, billing status, invoice references, billing country).

4. Why we use it

Marketing analytics: to understand which pages help and which don't. Contact form: to reply. Account data: to authenticate you, scope your workspace, and manage your subscription. Workspace data: to run the helpdesk product on your team's behalf as a processor.

5. Lawful bases (GDPR)

Performance of contract (running the product you signed up for), legitimate interests (basic first-party analytics and product improvement, minimised and anonymised), legal obligations (billing records), and consent (for non-essential cookies — opt-in and withdrawable from the "Cookie settings" control in the footer of any page).

6. Where data is hosted

Helpdash production infrastructure runs on cloud servers located in the European Union. Marketing-site traffic is served through a content delivery network.

7. Service providers

We share data only with the providers needed to run the service: our hosting provider (EU data centres), our DNS/CDN provider, Paddle (payments — Merchant of Record), and Google (only if you choose "Sign in with Google"). We do not sell personal data, and we do not share workspace content with anyone else.

8. How long we keep it

Marketing analytics: 13 months, then aggregated. Contact-form messages: 24 months from last reply. Account and workspace data: as long as the workspace is active, plus 30 days after cancellation so you can export it — after that it is permanently deleted, except where billing records must be retained for tax and accounting law.

9. Your rights & data deletion

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any of these rights — including full account and data deletion — email privacy@helpdash.io or support@helpdash.io. For data inside a customer's workspace, contact that workspace's admin (they are the controller; we are the processor). We respond within 30 days, usually much sooner. You may also lodge a complaint with your local data protection authority.

10. Security

All traffic is encrypted in transit (HTTPS/TLS). Passwords are stored only as salted hashes. Access inside a workspace is governed by role-based permissions, and changes are recorded in an audit log. Access to production systems is restricted to authorised personnel.

11. AI connectors (MCP)

A workspace admin can connect an external AI assistant to Helpdash over the Model Context Protocol, from Settings → AI connectors. This is off by default and nothing is shared until an admin creates a token or completes an OAuth authorisation.

Once connected, the assistant reads and writes workspace data on behalf of the operator who issued the credential, limited to the scopes granted. It acts with that operator's own permissions — a connector can never reach data the operator could not open in the app, and never reaches another workspace. Scopes are read-only unless write access is ticked explicitly. Values that hold passwords or secret keys are masked before they leave the server and cannot be read over a connector at all.

The receiving AI provider is chosen by you, not by us. When a connector is active, the data the assistant requests is transmitted to that provider and is then governed by their privacy terms; Helpdash sends nothing to any model provider of its own accord. Review the provider's terms before granting write scopes.

We store only a SHA-256 hash of a connector token — the key itself is displayed once at creation and cannot be recovered by us. Every connector call is written to the workspace audit log with the operator, the tool and the outcome. Revoking a token in Settings → AI connectors takes effect on the assistant's very next request.

12. Changes to this policy

We notify active workspace admins by email before any material change to this policy takes effect. The "Last updated" date at the top reflects the current version.

13. Contact

Helpdash — privacy requests: privacy@helpdash.io · general support: support@helpdash.io.