Privacy

Your workspace's content is the tickets, conversations, customers and files your team puts into TicketingSystem. Your organization decides what goes in and who sees it; we store and process it on your behalf, to run the service for you.

Account and billing data is what we need to run your account: who you are, how you sign in, and what plan you pay for. We are responsible for that.

If you wrote to a company that uses TicketingSystem and want to see or erase what it holds about you, ask that company: it controls your data and can export or erase it from its workspace. We will help it do so.

• Tickets: their subject, status, assignment, tags and custom fields, every message and internal note, and their history.
• Contacts, the customers who write in: their email address, their name if known, and the company you file them under.
• Attachments: files added to tickets, by your team or arriving with email, in a private storage bucket.
• The rest of a workspace: issues and projects, help-center articles, satisfaction survey answers, automations, saved views and macros, invitations, webhooks and API keys (stored as a hash, never the key itself).
• Email records: who each sent and received message was addressed to and whether it was delivered, and a list of addresses that bounced or reported spam, so we stop sending to them.
• Team accounts: name, email address, a hashed password or a linked Google sign-in, and two-factor settings. Each signed-in session records the browser and IP address it came from, and sign-in attempts are counted by IP address to slow down password guessing.
• Help-center sign-ins: the customer's email address and name, and a one-way hash of their IP address for rate limiting, never the address itself.
• Your workspace's audit log of administrative changes and who made them.
• Billing: your plan, seat count, trial and billing period dates, and the Stripe customer and subscription ids. Card details go to Stripe and never reach us.

Our application logs name records by id and are built to leave out the message text, names and other values they were handling. Google Cloud also logs each request's URL, IP address and browser.

We set sign-in cookies only: your team's session (with a short-lived copy that saves a database read), short-lived cookies during two-factor and Google sign-in, and a separate cookie for your customers' help-center session, which works only on that workspace's help center. There are no analytics, advertising or third-party tracking scripts on this site or in the app.

• Google Cloud hosts the application, its database, attachments, secrets and logs, in the United States (us-central1).
• Resend sends our email (replies to your customers, notifications, sign-in links) and receives the mail sent to your workspace's address, so it handles those messages and addresses.
• Stripe takes payment for paid plans on its own pages. When someone starts a subscription we give it your workspace's name and id, that person's email address, and the number of seats. Stripe keeps its billing records after a workspace is deleted.
• Google sign-in, only if you choose it, tells us your name, email address and profile picture, and issues sign-in tokens that we store with your account. Your profile picture is then shown from Google's servers.

We do not sell personal data, and we do not use your content to train AI models.

Your workspace's content stays until you erase it or delete the workspace. Marking a ticket deleted or as spam hides it from your team and your customers; it does not erase it. To remove a customer's data for good, erase the contact (below).

Some records are removed on their own, every day:

• Delivery logs of your outgoing webhooks, once settled and 30 days old.
• The log of automation runs, after 90 days.
• Help-center sign-in requests, 7 days after they expire.
• Stored answers to repeated API requests, after 1 day.
• Files uploaded but never attached to a message: after 1 day if the upload never finished, after 7 days if it did.
• Records of incoming payment events from Stripe, after 90 days.

Team members' accounts, with their sign-in sessions and the sign-in counters kept by IP address, stay with the account, which can belong to more than one workspace. Customers' help-center sessions stay until the contact is erased or the workspace is deleted.

The database is backed up every day and each backup is kept for 14 days; it can also be restored to any moment in the last 7 days. A deleted attachment stays recoverable for 7 days. So data you erase or delete leaves the live service shortly afterwards, and our backups within 14 days, as the older copies expire.

• A workspace's owner can export the workspace at any time from its settings, as a file of JSON lines: its members, tickets, messages, contacts, issues, articles and settings. Attachments are listed, but their files are not in the export, so download any you need before deleting a workspace. Credentials and working records are left out: passwords, API keys, invitations, sign-in sessions, and the processing logs of incoming mail and webhook deliveries.
• Owners and admins can export one customer's data for an access request: their details and company, their tickets with the conversation they can see (not internal notes), what they wrote on other tickets, and their survey answers.
• Reports can be downloaded as CSV.

Owners and admins can erase a contact, usually within minutes. Their tickets, with those tickets' files and mail records, are deleted; on other tickets, what they wrote is replaced with a notice and their files and address are removed; their help-center sign-ins and sessions are removed, and search no longer finds them. The request and the audit log keep only ids, not the details erased.

Erasure does not reach what your team wrote about them on other tickets, the company record they were filed under, copies already sent out by email or webhook, our list of addresses that bounced, or backups, which expire within 14 days.

The owner can delete a workspace from its settings. Nothing is removed for 7 days, so a mistake can be undone; after that every ticket, contact, message, setting and stored file of the workspace is deleted. Cancel any paid subscription first: a workspace with a live subscription is not deleted. Members' own accounts are kept, since they can belong to other workspaces, and Stripe keeps its billing records.

Our staff look inside a workspace only to help with a problem, read-only and for at most 30 minutes at a time, and each visit appears in that workspace's audit log, as do changes we make to the workspace's account, such as its plan. More on how data is protected is on the security page.

Write to support@2bunsllc.com with any question about this page, or to see, correct or erase your account data. If we change what we store or who processes it, we will update this page and its date.