# Privacy and security

> How to protect access to your account, which data we process on your behalf, and how to handle consent, deletions and your customers' requests.

Page: https://supportfast.ai/en/guide/help/privacy-security/ · Section: Legal · Updated on 30 October 2026

## Access to your account

Each person signs in to the console with their own email and password, over encrypted connections. When you change your password from your [Profile](https://supportfast.ai/en/guide/account/profile.md), your other devices are signed out.

### Good habits

- Ask each new teammate to change their password the first time they sign in.
- On a shared computer, turn off Remember me when you sign in.
- If the console signs you out because your user signed in from another device, and it wasn't you, change your password right away.

## Who sees what: roles and permissions

In Team, each teammate sees only the workspaces and agents you assign to them, and does only what their permissions allow.

- The account owner always has all permissions.
- Suspend anyone who no longer works with you right away: they lose access even if they are signed in. Their data stays.

See [Team, roles and permissions](https://supportfast.ai/en/guide/account/team.md).

## The data we process on your behalf

To run agents and channels, SupportFast stores and processes the following data about your customers and your business on your behalf:

| Data | Examples |
| --- | --- |
| Conversations | Messages, attachments, internal notes, folders and labels. |
| Contacts | Name, email, phone, language, variables, lists, change history. |
| Calls | Recording, if it is on; transcript, summary, outcome and extracted data. |
| Knowledge base | Website pages, documents, texts and FAQs that you use for training. |
| Automations and campaigns | The data that passes through runs and sends. |

### Who is responsible for what

For your customers' data, your business is the **data controller**: it decides why and how the data is used. SupportFast processes it on your behalf, as data processor, under the [Data Processing Agreement (DPA)](https://supportfast.ai/en/dpa/), which is Annex A to the General Terms of Service.

So it is up to you to inform your customers through your own privacy notice, and to answer their requests about their data.

Your account data is a different matter: users' names and emails, your plan and your billing details. For this data, SupportFast is the data controller and the [Privacy Policy](https://supportfast.ai/en/privacy-policy/) applies.

### The providers that process the data

We rely on providers that we choose and that are bound by the contracts the GDPR requires: hosting, storage, artificial intelligence models, voice, payments. Who they are, where they are based and where they keep the data is in the list of [Sub-processors](https://supportfast.ai/en/sub-processors/).

We don't use your data, or your customers' data, to train artificial intelligence models. If you connect your own OpenAI key, messages go through your OpenAI account and the terms you have with OpenAI apply: see [Data sent to other services](https://supportfast.ai/en/guide/help/privacy-security.md#data-sent-to-other-services).

## Your customers' consent

### In the website chat

If you enter the link to your Privacy Policy in Agent profile › General, the chat opens with the “Privacy Policy” screen and the I agree button. Until the customer presses it, they can't write. Without a link, the chat doesn't ask for any consent. See [Agent profile: General](https://supportfast.ai/en/guide/chat-agent/general.md) and [The privacy consent](https://supportfast.ai/en/guide/website/what-visitors-see.md#the-privacy-consent).

> **Tip**
>
> **Tell customers that an artificial intelligence is answering.** In the chat, say so in the Welcome Message, for example “Hi, I'm the virtual assistant at Officina Rossi. How can I help you?”.

### On the phone

The greeting the voice agent has when you create it says that an artificial intelligence is answering and that the call may be recorded. If you change it, or add other welcome messages, keep both notices. With Customer in Who speaks first?, the agent doesn't say any greeting, and so no notices either. To give them on every call, leave AI Agent. With Recording with consent on, if the customer refuses consent during the call, the call audio is not kept in SupportFast, not even the part recorded before the refusal; the transcript and the summary remain. See [Recording and consent](https://supportfast.ai/en/guide/voice-agent/recording-consent.md).

### In campaigns and the contact book

How to record consent for promotional messages and calls in the contact book, and how to stop contacting people who no longer want to be contacted, is explained in [Consent and rules](https://supportfast.ai/en/guide/campaigns/consent-and-rules.md) and [Blocking contacts](https://supportfast.ai/en/guide/contacts/blocking.md).

## Keeping and deleting data

When you no longer need some data, export what you want to keep and then delete it from the console. What you delete disappears from the console. To find out how long data stays in our systems, or for a request under the GDPR, write to [info@supportfast.ai](mailto:info@supportfast.ai): see [If one of your customers asks for their data](https://supportfast.ai/en/guide/help/privacy-security.md#if-one-of-your-customers-asks-for-their-data).

| What you delete | How | What stays in the console |
| --- | --- | --- |
| A conversation | In the conversation, Chat options › Delete chat. For several conversations, use Multi-select. | The contact stays in the contact book. |
| A call | In the call details, Delete call. | The contact stays in the contact book. |
| A contact | On the contact card, More actions › Delete contact. | Their conversations and calls stay. |
| An agent | From the agent's settings or its menu, with the “Delete Permanently” confirmation. | Its conversations, or its calls, disappear with it. Contacts stay. |
| A workspace | From the workspace menu or its Settings. See [Workspace settings](https://supportfast.ai/en/guide/workspace/settings.md). | Nothing: everything it contains disappears. |
| The account | From your [Profile](https://supportfast.ai/en/guide/account/profile.md#deleting-the-account), only the owner, after deleting the agents and canceling the paid plan. | Nothing: everything closes, for you and for the team. |

### If one of your customers asks for their data

Look them up in Contacts: from their card you see their data and all their activity. To give them a copy, export the data to a file, as explained in [Exporting contacts](https://supportfast.ai/en/guide/contacts/export.md) and [Exporting and deleting](https://supportfast.ai/en/guide/conversations/export-delete.md). To remove it from the console, delete their conversations and calls, then the contact: they disappear from the console. Also check what you have sent to [other services](https://supportfast.ai/en/guide/help/privacy-security.md#data-sent-to-other-services).

If the customer asks for their data to be erased, or makes another request under the GDPR, also write to [info@supportfast.ai](mailto:info@supportfast.ai) with the contact and the request: we will tell you how to proceed for the data that remains in our systems.

## Data sent to other services

- **Your OpenAI key.** If you connect it, the AI works through your OpenAI account. See [OpenAI key](https://supportfast.ai/en/guide/developers/openai-key.md).
- **Webhooks and API calls.** They send the data you choose to the services you specify. See [Calling an external API](https://supportfast.ai/en/guide/developers/api-calls.md).
- **End-of-call emails.** You choose the recipients and the content, for example the summary or the link to the recording. See [Post-call: data, email, webhook](https://supportfast.ai/en/guide/voice-agent/post-call.md#email-notifications).

## Legal documents and contacts

Besides the Privacy Policy, the DPA and the Sub-processors mentioned above, the [Terms of Service](https://supportfast.ai/en/terms-of-service/) apply. For privacy questions, or to exercise your rights, write to [info@supportfast.ai](mailto:info@supportfast.ai).