#Access to your account
Each person signs in to the console with their own email and password, over encrypted connections. When you change your password from your Profile, your other devices are signed out.
#Good habits
- Ask each new teammate to change their password the first time they sign in.
- On a shared computer, turn off Remember me when you sign in.
- If the console signs you out because your user signed in from another device, and it wasn't you, change your password right away.
#Who sees what: roles and permissions
In Team, each teammate sees only the workspaces and agents you assign to them, and does only what their permissions allow.
- The account owner always has all permissions.
- Suspend anyone who no longer works with you right away: they lose access even if they are signed in. Their data stays.
See Team, roles and permissions.
#The data we process on your behalf
To run agents and channels, SupportFast stores and processes the following data about your customers and your business on your behalf:
| Data | Examples |
|---|---|
| Conversations | Messages, attachments, internal notes, folders and labels. |
| Contacts | Name, email, phone, language, variables, lists, change history. |
| Calls | Recording, if it is on; transcript, summary, outcome and extracted data. |
| Knowledge base | Website pages, documents, texts and FAQs that you use for training. |
| Automations and campaigns | The data that passes through runs and sends. |
#Who is responsible for what
For your customers' data, your business is the data controller: it decides why and how the data is used. SupportFast processes it on your behalf, as data processor, under the Data Processing Agreement (DPA), which is Annex A to the General Terms of Service.
So it is up to you to inform your customers through your own privacy notice, and to answer their requests about their data.
Your account data is a different matter: users' names and emails, your plan and your billing details. For this data, SupportFast is the data controller and the Privacy Policy applies.
#The providers that process the data
We rely on providers that we choose and that are bound by the contracts the GDPR requires: hosting, storage, artificial intelligence models, voice, payments. Who they are, where they are based and where they keep the data is in the list of Sub-processors.
We don't use your data, or your customers' data, to train artificial intelligence models. If you connect your own OpenAI key, messages go through your OpenAI account and the terms you have with OpenAI apply: see Data sent to other services.
#Your customers' consent
#In the website chat
If you enter the link to your Privacy Policy in Agent profileGeneral, the chat opens with the “Privacy Policy” screen and the I agree button. Until the customer presses it, they can't write. Without a link, the chat doesn't ask for any consent. See Agent profile: General and The privacy consent.
Tell customers that an artificial intelligence is answering. In the chat, say so in the Welcome Message, for example “Hi, I'm the virtual assistant at Officina Rossi. How can I help you?”.
#On the phone
The greeting the voice agent has when you create it says that an artificial intelligence is answering and that the call may be recorded. If you change it, or add other welcome messages, keep both notices. With Customer in Who speaks first?, the agent doesn't say any greeting, and so no notices either. To give them on every call, leave AI Agent. With Recording with consent on, if the customer refuses consent during the call, the call audio is not kept in SupportFast, not even the part recorded before the refusal; the transcript and the summary remain. See Recording and consent.
#In campaigns and the contact book
How to record consent for promotional messages and calls in the contact book, and how to stop contacting people who no longer want to be contacted, is explained in Consent and rules and Blocking contacts.
#Keeping and deleting data
When you no longer need some data, export what you want to keep and then delete it from the console. What you delete disappears from the console. To find out how long data stays in our systems, or for a request under the GDPR, write to info@supportfast.ai: see If one of your customers asks for their data.
| What you delete | How | What stays in the console |
|---|---|---|
| A conversation | In the conversation, Chat optionsDelete chat. For several conversations, use Multi-select. | The contact stays in the contact book. |
| A call | In the call details, Delete call. | The contact stays in the contact book. |
| A contact | On the contact card, More actionsDelete contact. | Their conversations and calls stay. |
| An agent | From the agent's settings or its menu, with the “Delete Permanently” confirmation. | Its conversations, or its calls, disappear with it. Contacts stay. |
| A workspace | From the workspace menu or its Settings. See Workspace settings. | Nothing: everything it contains disappears. |
| The account | From your Profile, only the owner, after deleting the agents and canceling the paid plan. | Nothing: everything closes, for you and for the team. |
#If one of your customers asks for their data
Look them up in Contacts: from their card you see their data and all their activity. To give them a copy, export the data to a file, as explained in Exporting contacts and Exporting and deleting. To remove it from the console, delete their conversations and calls, then the contact: they disappear from the console. Also check what you have sent to other services.
If the customer asks for their data to be erased, or makes another request under the GDPR, also write to info@supportfast.ai with the contact and the request: we will tell you how to proceed for the data that remains in our systems.
#Data sent to other services
- Your OpenAI key. If you connect it, the AI works through your OpenAI account. See OpenAI key.
- Webhooks and API calls. They send the data you choose to the services you specify. See Calling an external API.
- End-of-call emails. You choose the recipients and the content, for example the summary or the link to the recording. See Post-call: data, email, webhook.
#Legal documents and contacts
Besides the Privacy Policy, the DPA and the Sub-processors mentioned above, the Terms of Service apply. For privacy questions, or to exercise your rights, write to info@supportfast.ai.