Legal
Privacy policy
Last updated
This policy explains what personal data SLA Desk ("we", "us") handles when you visit this website, create an account, or use the SLA Desk helpdesk service, and the choices you have. We have written it to be read, not skimmed past.
1. Who is responsible for your data
SLA Desk plays two different roles, depending on whose data it is.
- Controller for the data we collect to run our own business: the people who sign up for, pay for and administer SLA Desk accounts, and visitors to this website.
- Processor for the data our customers put into their helpdesk: their own customers' names, email addresses, tickets, messages and attachments. Each workspace owner is the controller of that data and decides what is collected and why. If you raised a ticket with a business that uses SLA Desk, please contact that business first about your data; we will help them answer you.
You can reach us about anything in this policy at [email protected].
2. What we collect
Account and workspace details
Your name, email address and a one-way hash of your password (we never store the password itself), the workspace name and address you choose, your role, and the settings you configure.
Billing details
The billing contact, number of agent seats and invoice history. Card details are entered on and held by our payment provider, Stripe. We never see or store your full card number.
Helpdesk content (as a processor)
Everything a workspace stores in the service: tickets, replies, internal notes, attachments, knowledge base articles, satisfaction ratings, and the names and email addresses of the people who contact that workspace, including emails received at a connected support address.
Technical and security data
IP address, browser user agent, and timestamps of sign-ins and actions, kept in server logs and in an audit trail of changes to tickets and settings. We use these to keep accounts secure, limit abuse and investigate problems.
How you found us
When you arrive on this website, we note the referring site and any campaign tags in the
link (such as utm_source) in the session we already use to run the site, without a
separate tracking cookie. If you then create an account, that source is saved on your account
and workspace so we know which channels bring customers. It stays with us and is never shared
with advertisers.
Page view counts
We count visits to our public pages as an anonymous daily total per page. No cookie is set and no IP address or other identifier is stored for this.
Messages to us
If you email us, we keep the correspondence so we can reply and follow up.
We do not use advertising trackers or third-party analytics on this website or in the product, and we do not sell personal data.
Customer portals and ticket emails show a small "Powered by SLA Desk" link, which each workspace can switch off. It is a plain link and does not track the people who see it.
3. How we use it
- To provide the service: sign you in, run your workspace, send and receive ticket email, and deliver the notifications you have switched on.
- To bill for the service and keep proper financial records.
- To keep the service secure: rate limiting, fraud and abuse prevention, virus scanning of uploads where enabled, and incident investigation.
- To help new workspace administrators get set up, with up to four setup emails in their first two weeks. Every one has an opt-out link, and opting out does not affect service emails such as billing notices.
- To support you when you ask for help, and to tell you about changes that affect your account, such as the end of a trial or a change to these terms.
- To process helpdesk content only on the documented instructions of the workspace that owns it, including the optional AI features described below.
Optional AI features
A workspace administrator can switch on AI-assisted replies. They are off by default. When enabled, the text of a ticket and relevant knowledge base articles are sent to our AI model provider to draft or send a reply, according to the mode the administrator chose. That content is used only to produce the response for that workspace.
4. Legal bases
Under UK and EU data protection law we rely on:
- Contract: to provide the service you signed up for and bill for it.
- Legal obligation: to keep accounting and tax records.
- Legitimate interests: to secure the service, prevent abuse, improve the product and reply to enquiries, where those interests are not outweighed by your rights.
- Consent: where we ask for it. You can withdraw consent at any time.
5. Who we share it with
We use a small number of carefully chosen providers (sub-processors) to run the service. Each is bound by a contract that limits what they can do with the data.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloud hosting provider | Servers, database and backups that run the service | All service data |
| Stripe | Payments, subscriptions and invoices | Billing contact, payment details, seat count |
| Resend | Delivery of outbound email | Recipient address, message content |
| Google (Gemini API) | Optional AI-assisted replies, only if a workspace enables them | Ticket text and knowledge base excerpts |
| Google Fonts | Typeface for this public website | Your IP address, when a marketing page loads |
| Cloudflare | Network delivery and protection against attacks; all traffic to the service passes through it | Your IP address and the requests your browser makes |
| Sentry | Error monitoring, so we can find and fix faults | Technical details of an error; we do not send IP addresses, cookies or form contents |
We may also disclose data where the law requires it, to protect the rights and safety of our users or the public, or to a buyer as part of a sale or merger, who would be bound by this policy.
6. International transfers
Some of our providers process data outside the UK and European Economic Area, including in the United States. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as appropriate.
7. How long we keep it
- Account data: while your account is open, then for up to 90 days after closure so it can be restored if closed by mistake, before deletion or anonymisation.
- Helpdesk content: as long as the workspace keeps it. Administrators can export data at any time, anonymise an individual customer, and set an automatic purge period for closed tickets.
- Billing records: six years, to meet accounting and tax obligations.
- Backups: overwritten on a rolling cycle, so deleted data leaves backups within weeks.
- Security logs: kept only as long as needed to investigate and prevent abuse.
8. Security
All traffic is encrypted in transit with HTTPS. Passwords are stored as salted one-way hashes, sign-in attempts are rate limited, each workspace's data is isolated from every other, access is controlled by roles, and changes are recorded in an audit trail. Backups are encrypted. No system is perfectly secure, but if a breach affects your data we will tell you and the relevant regulator as the law requires.
To report a vulnerability, please email [email protected].
9. Cookies
We only use cookies that the service needs to work, so we do not ask for cookie consent.
| Name | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in and remembers your workspace | Until you sign out or close the browser |
| CSRF token | Protects forms against cross-site request forgery | Session |
Inside the app, your light or dark theme choice is stored in your browser's local storage and never sent to us.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent. To use any of these rights, email [email protected]. We will reply within one month.
If your data sits in a helpdesk run by one of our customers, we will pass your request to that business and help them answer it.
You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner's Office, at ico.org.uk. We would appreciate the chance to put things right first.
11. Changes and contact
If we change this policy in a way that matters, we will update the date above and, for significant changes, email account owners before they take effect. Questions are welcome at [email protected].
See also our terms of service.