Privacy policy

This policy explains what information SupportFlow handles, why, and the choices you have. SupportFlow is an independent software project designed and built by Fahad Sani. It covers two groups of people: workspace users (the businesses and staff who sign up) and website visitors who use a SupportFlow chat on a business's website.

Who is responsible

For workspace accounts, SupportFlow is responsible for your account information. For conversations with website visitors, the business that installed the chat decides what is collected and why; SupportFlow processes that information on the business's behalf. Visitors should contact that business about their data, and businesses can delete it from their dashboard.

What we collect

Workspace users

• Name, email address and a hashed password (Argon2id). We never store your password itself.
• Workspace settings, help-centre articles, tickets, notes and replies you write.
• Session records: a hashed session identifier, IP address, browser user agent and timestamps.
• An audit log of administrative actions such as role changes, setting changes and deletions.
• Billing status. If card billing is enabled, payments are handled by Stripe; we never see or store card numbers.

Website visitors

• The messages you send in the chat and the replies you receive.
• Your name and email address only if you choose to give them, or if the business requires an email to reply.
• A random visitor identifier stored in your browser so you can continue a conversation. We store only a hash of it.
• A satisfaction rating and comment, if you choose to leave one.

We do not use advertising trackers, sell personal information or build profiles across websites.

How we use it

• To provide the service: deliver messages, show conversations to the business, and enforce plan limits.
• To generate AI replies, drafts and summaries when the business has turned this on (see below).
• To keep the service secure: rate limiting, abuse prevention and audit logs.
• To reply to messages sent through our contact form.

AI processing

When a business enables AI features, the visitor's recent messages and relevant passages from that business's published help articles are sent to the configured AI provider (Cloudflare Workers AI on this site; the software also supports Anthropic and OpenAI) to produce a reply. Internal notes are never sent. Each request contains one workspace's data only. Providers process this data under their API terms; we do not ask them to train models on it. Every AI-written message is labelled in the chat.

Cookies and browser storage

• sf_session: an httpOnly cookie that keeps you signed in to the dashboard. It expires after 30 days of inactivity or when you sign out.
• sf-theme: remembers your light or dark choice in local storage.
• On business websites, the chat stores its visitor identifier in local storage for that website only.

How long we keep it

• Conversations are kept until the business deletes them. Businesses can set automatic deletion of resolved conversations after a period they choose.
• Conversations in the public homepage demo are deleted after 24 hours.
• Expired sessions are removed automatically. Audit log entries are kept for one year.
• Contact form messages are deleted within 12 months.
• When a workspace is deleted, all of its data is deleted with it.

Your choices

• Workspace users can update their name and password, leave a workspace, or ask the owner to delete it.
• Businesses can delete an individual customer and all of their conversations from the Customers page.
• Website visitors can ask the business that runs the chat to access or delete their conversations.

Security

Data is scoped to its workspace on every request, connections are encrypted in transit, and access depends on your role. No system is perfectly secure; if you believe you've found a vulnerability, please tell us through the contact page.

Changes and contact

We'll update this page when our practices change and revise the date at the top. Questions? Use the contact form.