Privacy policy

Last updated 15 November 2026

Supportbox gives teams a chat widget, an inbox and a help center so they can answer their own customers. This page explains what we store, why, who helps us process it, and how to have it removed. Questions: hello@usesupportbox.com.

Two kinds of people

• Teams who sign up and use Supportbox. For their data, we are the controller.
• Their customers, who write to a team through the chat on that team's site. For those messages, the team is the controller and we process them on the team's behalf. If you wrote to a company through its chat, contact that company about your data; we will help them answer you.

What we store about teams

• Your email address and team name, and the websites and project names you add.
• If you sign in with Google: your email address and the fact that Google confirmed it. We ask Google only for basic profile and email. We do not get your Google password or access to your Google data.
• Sign-in records: one-time links and codes (stored only as one-way hashes, for 15 minutes) and session records so you stay signed in, for up to 30 days of inactivity.
• Settings you choose, such as team members you invite, Slack connections and webhooks.

What we store for teams about their customers

• Messages written in the chat, the email address and name the customer gives, and replies from the team.
• The page address the chat was opened on and the browser's user agent, so the team knows where the question came from.
• If the team's site confirms who its signed-in customer is, the details it sends.

Why

To run the service you asked for: deliver messages, sign you in, send the emails the product needs (sign-in links, replies to customers who have left the chat, invitations), and keep the service safe. Network addresses are used briefly to limit abuse, such as too many sign-in attempts. We do not sell personal data, show ads, or use your conversations to train AI models.

Who helps us

• Cloudflare: hosting, database, realtime chat and sending email.
• Google: only when you choose "Continue with Google".
• Slack: only when a team connects its Slack workspace; new conversations and replies are then shared with that workspace.
• Anthropic: only when a team turns on AI answering with its own API key; customer messages are then sent to Anthropic to draft replies.

Cookies and storage

The dashboard keeps your sign-in in your browser's local storage. Short-lived cookies are used only during Google and Slack sign-in, to make sure the person finishing the sign-in is the one who started it. The chat widget keeps the current conversation in the visitor's browser so it survives a page reload. We use no advertising or tracking cookies.

How long we keep it

Account data and conversations stay until the team deletes them or closes its account. Teams can delete conversations and projects at any time. Sign-in links, codes and expired sessions are removed automatically.

Your rights

You can ask for a copy of your data, a correction, or deletion, and you can object to processing. Write to hello@usesupportbox.com and we will answer within 30 days. If you are in the EU or UK, you can also complain to your data protection authority.

Changes

If this policy changes in a way that matters, we will update the date above and, for significant changes, tell signed-up teams by email.