Privacy policy

Last updated 19 October 2026

This page says what DeltaBreen Limited (the operator of Help by DeltaBreen), a company registered in Ireland with company number 826627, of Gorey, Co. Wexford, Ireland stores when you use Help by DeltaBreen, why, for how long, and who else handles it. For your account and your workspace's own settings we are the controller. For what people write to a business that uses Help, that business is the controller and we handle it for them, under our data processing agreement. We have not appointed a data protection officer; write to [email protected] about anything on this page.

1. If you have an account with us

We store your email address, the workspaces you belong to and your role in each, when you last signed in, and which version of the terms you accepted. Sign-in is by a code sent to your email, or by your company's own sign-in where your workspace sets it up; we store no password, and if you turn on two-step sign-in its secret is kept encrypted. We keep an audit log of actions in a workspace (who did what, and when) for 400 days. When you delete your account the address is removed at once and what your workspaces held is deleted thirty days later.

If you give your name under Settings, then Team, the customers whose tickets you are given are told it ("Bo has been assigned to your ticket"). They never see your email address. Leave the name empty and they are told only that someone has the ticket. A signature you write is added under your replies, so the customer reads it.

If you give a site's support address, we email it a code to prove it is yours, and then name the site by it in our emails to that site's customers.

If you switch on notifications in your browser, we keep that browser's push address and keys, encrypted. A notice names a ticket's number and site and never anything a customer wrote, and it reaches your browser, encrypted so that only it can read it, through the push service of the company that makes your browser (Google, Mozilla, Apple or Microsoft). Switching notifications off, signing out everywhere or deleting your account forgets the address.

If your workspace texts and calls whoever is on call when a ticket is urgent, we keep the mobile number you add, encrypted, show only its last three digits, and send it only to your workspace's own Twilio or Vonage account, with a text or a call that names a ticket and never anything a customer wrote. Removing the number, leaving the workspace or deleting your account forgets it.

2. If you wrote to a business that uses Help

That business is the controller of what you sent; we handle it for them. We store your message, the replies, the page you wrote from, your browser's description of itself and the language the form was in, and, if you gave one, your email address, which is kept encrypted and used only to tell you about replies after you confirm it. Files you attach are kept with the ticket, in storage in the EU: the file, its name and its size. They are only ever handed out through a link that works for one minute, and they are deleted with the ticket. If you are logged in to the business's own site, it may tell us a few short facts it chooses about you, such as your plan or your role there; they are kept on your tickets and deleted with them. If you rate a closed ticket, your stars and any words you add are kept with it. Closed tickets are deleted after the period that business's plan sets. To see, correct or delete what a business holds about you, ask that business; we will help them answer.

If you email the business through Help, or reply to one of our emails, your email arrives in a Microsoft 365 mailbox of ours, which we read and empty as it comes: we keep what you wrote above any email you quoted, and the files it carried where the business keeps files, and nothing else of the email. Microsoft removes the deleted email for good after 14 days. If the business copies you in on a ticket, we keep your address encrypted and email you copies of its replies only after you confirm.

On a site with help articles, while you write a message what you have typed so far is sent to us after each pause, so we can suggest articles that may answer it, and what you type into the site's help search is sent to us to find articles. We keep none of it and log none of it, and the business can switch the suggestions off. We count how often each article is opened and how often someone says it answered them, as numbers, with nothing about who.

3. What an integration shows

When an agent opens your ticket, the business's own system may tell us who you are to them (for example your plan or your orders) so the agent can see it. The business may also have us look you up in its own Stripe or Shopify account, by an email address its site signed for you or that you confirmed. We show what comes back to the agent and keep none of it: it is not written to our database or our logs.

4. Where a business sends its tickets

A business can send its tickets, including what you wrote and your email address, to an address of its own choosing (its own server, or Zapier, Make or n8n), read them with an API key, and connect its own AI assistant, to which we send only what the person who connected it could see in Help and allowed it to. It can keep the files sent with its tickets in its own Google Drive, Dropbox or storage bucket, which then holds them, and send its emails to you through its own mail server. It can also bring its tickets over from the helpdesk it used before, with a key it gives us that we keep encrypted only while that runs. These are the business's own choices, not companies we use. We run no AI ourselves.

5. Payments

Paddle, our merchant of record, takes payments. We never see or store card details. We store which plan a workspace is on and whether its subscription is active.

6. Why we use it, and the basis in law

• To give you the service and run your account and workspace: because you asked for it under our terms (the contract).
• To keep the service secure and working, stop abuse, keep the audit log and tell our own team when an account is made: our legitimate interest in a safe service that works, kept to what that needs.
• Browser notifications: only after you switch them on in that browser (your consent), which you take back by switching them off.
• Records the law makes us keep, such as for tax: our legal obligation. Paddle keeps the invoices, as merchant of record.

We do not sell data or show advertising, and we make no decision about you by automated means alone that has a legal or similarly significant effect on you. An email address is needed to have an account, since that is how you sign in.

7. Logs and security

Our request logs record the route that was called, the time and the outcome, never the contents of a ticket, and are kept for 30 days. Counters that limit abuse are stored under a keyed hash, not an address in the clear. Servers are in the EU. The security page says more.

8. Cookies and storage in your browser

We use no cookies for advertising or analytics. The portal keeps your sign-in and a few choices in your browser's own storage, such as a reply you have not sent yet, which stays in that browser for a week, and whether notifications are on. Cloudflare's check on the sign-in form uses what it needs to tell people from bots. Our form on a business's site keeps its session in memory and sets no cookies. Paddle's checkout sets its own cookies when you pay, under Paddle's own policy.

9. How long we keep it

• Your account: until you delete it. What your workspaces held is deleted thirty days after that.
• The audit log: 400 days.
• Tickets: until the retention period of the business's plan has passed after they close; test tickets for a week.
• Request logs: 30 days. Backups of the database: up to 30 days.
• A browser's notification address: until notifications are switched off there. A key for bringing tickets over: until that ends.

10. Who else handles data

11. Outside the EU

Our servers and storage are in the EU. Where a company in the table is outside the EU, or may reach data from outside it, the table names the safeguard: a decision of the European Commission that the country protects data adequately, the EU–US Data Privacy Framework, or the Commission's Standard Contractual Clauses.

12. Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, have its use restricted, take it with you in a common format, object to its use, and take back a consent you gave. Write to [email protected] and we answer within a month. For what you wrote to a business, ask that business first, since it decides. You can also complain to the Data Protection Commission in Ireland, or to the authority where you live.

13. Children

Help is made for businesses and is not meant for anyone under 16.

14. Changes to this page

If we change this page in a way that matters, we tell account holders by email before it takes effect, and the date at the top changes.