Privacy Policy

Who we are

WishSupport is a product of Wishdoor of Elahi 9/2B, Surma R/A, Akhalia, Sylhet 3100, Bangladesh ("we", "us"). This policy covers the website at wishsupport.app, the portal at portal.wishsupport.app, the documentation at docs.wishsupport.app, the client API at api.wishsupport.app and the WishSupport React SDK.

We handle personal data under the law that applies to it, including, for people in the UK and the EU, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR). For anything about your personal data, email wishdoor25@gmail.com.

Our role: controller or processor

Account holders, team members, website visitors and anyone who contacts us. We decide how and why this data is used, so we are its controller.
Merchant data that an app sends us. A developer who connects their app to WishSupport sends us details about their merchants: the shop domain and shop name, the requester's name and email, the merchant's plan in that app, and ticket subjects, messages and attachments. For this data the developer, as the owner of the space, is the controller. We are their processor: we handle it only to run the service for them, and on their instructions.

If you are a merchant who contacted support through an app that uses WishSupport, that app's developer decides how your data is used, and their privacy policy applies. Please send requests about your data to them first. If you write to us instead, we will pass your request to them and help them answer it.

What we collect

Your account

Your name, email address, username and password. We store the password only as a one-way hash.
Optionally, a phone number and a profile picture.
Your sign-in sessions, each recorded with the IP address and browser it came from, so that you can see and end them.

Your spaces and team

Space names, handles, descriptions, logos and settings; who belongs to which space; invitations, including the email address or username invited; join requests; and the team members chosen to receive email alerts.
The names you give your API keys. The keys themselves are stored only as hashes.

Conversations

What a connected app sends about each merchant: shop domain, shop name, requester name and email, the merchant's plan in the developer's app, ticket subjects, messages and attachments.
Your team's replies, with who sent each one, and how far each side has read.
Names in a conversation are kept as they were shown when each message was sent, so a later profile change does not rewrite it.

Audit logs

A record of administrative actions in each space, such as changing a space's settings, inviting or removing members, creating or revoking API keys, deleting tickets, and freezing spaces or team members. Each entry records who acted, when, what changed and the IP address the action came from.
A history of each ticket: who sent, deleted, closed or reopened what, and when.

Billing

Paddle takes your payment. We never see or store your card details.
We keep a record of your subscription: the plan, its status, monthly or annual billing, trial and renewal dates, any scheduled cancellation, and the customer and subscription IDs Paddle gives us, with a history of changes.
Each month's count of support requests, used to apply your plan's limits.

Website, contact form and logs

The contact form on wishsupport.app collects your name, work email, Shopify App Store URL (optional), number of apps and your message. To limit spam, your IP address is held in memory for up to 15 minutes.
Our servers keep request logs, including the IP address, browser details and the address requested, to keep the service secure and to fix problems.

How we use it, and our legal bases

To provide WishSupport: running your account, spaces and conversations, applying your plan and sending service emails. Legal basis: performing our contract with you.
To process merchant data for developers: on the space owner's instructions, under our contract with them. The developer is responsible for the legal basis.
To keep the service secure and the record accurate: sessions, rate limits, request logs, audit logs, and keeping deleted content as an audit trail. Legal basis: our legitimate interests in protecting the service and our customers, and in a reliable record of who did what.
To bill you: mirroring your subscription from Paddle and applying your plan's limits. Legal basis: performing our contract with you.
To answer you when you use the contact form or email us. Legal basis: our legitimate interest in replying, or steps you ask us to take before entering a contract.
To meet legal obligations, such as answering lawful requests from authorities. Legal basis: legal obligation.

We do not sell personal data, use it for advertising, or use it to profile you.

Emails we send

To account holders: email verification, password resets, email address changes and space invitations. Space owners also get a notice when the month's support requests reach 80% of the plan's limit, and when a request is first held at the limit.
To a space's alert recipients (the team members the owner chooses, or the owner if none are chosen): a new ticket, and a merchant message left unread by the team for 5 minutes.
To merchants, on the developer's behalf: when the team closes their ticket, and when a reply from the team is left unread for 5 minutes. These go to the requester email the developer's app sent us.

These are service emails, sent because the service needs them. We do not send marketing email.

Cookies

WishSupport uses only the cookies the portal needs to work, and none that track you:

A session cookie that keeps you signed in. It is set when you sign in, and it stops working when you sign out or the session expires.
A preference cookie (sidebar_state) that remembers whether you left the portal's sidebar open, for 7 days.

Both are strictly necessary for the service you asked for, so they don't need consent. The website at wishsupport.app and the documentation set no cookies and load no analytics, advertising or tracking scripts.

When you buy or change a paid plan, Paddle's checkout opens in the portal, and Paddle may set its own cookies there to process the payment and prevent fraud. Those are covered by Paddle's privacy policy.

Paddle, our Merchant of Record and reseller, which sells you your subscription, takes payment, issues invoices and handles tax and chargebacks. You give Paddle your payment and contact details in its checkout, and we pass it your WishSupport account ID so the purchase reaches the right account. Paddle uses this data as a controller under its own privacy policy.
Wishdoor's notification service, which sends our emails, and so receives each recipient's address and the email's content.
Wishdoor's file service, which stores attachments, profile pictures and space logos in a public storage bucket.
Resend, which delivers contact form messages to our inbox.
Hosting and infrastructure providers that run our servers, database and network.
People inside WishSupport, as the product requires. A space's members see its conversations, including the merchant details, and the names of the other members. The owner also sees the space's audit log, and the names and email addresses of everyone on their team. A connected app reads the tickets of the shops it serves.
Others, only when necessary: professional advisers, authorities when the law requires it, and a buyer or successor if the business is sold or merged, who would remain bound by this policy.

Attachments and public links

Attachments, profile pictures and space logos are stored in a public storage bucket. Each file gets a long, unguessable link, and WishSupport shows that link only to people with access to the conversation or profile. The link itself is not protected, though: anyone who has it can open the file without signing in, including someone it was forwarded to. An attachment's link also contains the shop domain and ticket code it belongs to.

Deleting a message hides its attachments in WishSupport, but the files stay stored. Please don't send passwords, payment card details, identity documents or other sensitive files as attachments.

How long we keep it

Account data: for as long as your account exists. If you ask us to delete your account, we erase your personal details from it (name, email address, username, phone number and profile picture) and keep the empty record only so that the messages and audit entries linked to it still make sense. Messages you sent in a space keep the name shown when you sent them, because they are part of that space's conversation record.
Conversations and space content: for as long as the space exists. Deletion is soft, so deleted messages, tickets and spaces are hidden but kept: a deleted message stays as a tombstone naming who deleted it, and its content and attachments stay in our records. Archiving a ticket is not deletion either. A space owner who needs merchant data erased can ask us at wishdoor25@gmail.com.
Audit logs, ticket histories and subscription history: kept for as long as we run the service. They are append-only and outlast what they describe, because they are the record of who did what.
Sessions: until you sign out, end the session from your account settings, or it expires.
Request logs: only as long as we need them for security and troubleshooting.
Contact form messages: in our inbox for as long as we need them to answer you and follow up.
Payment records: kept by Paddle under its own policy and tax law.

Copies held in backups are replaced in the normal backup cycle.

International transfers

We are based in Bangladesh, and some of our service providers process data in other countries. Where personal data of people in the UK or the European Economic Area is transferred outside those areas, including to us, we make sure it is protected as UK and EU law require, for example by an adequacy decision or by standard contractual clauses, including the UK International Data Transfer Agreement or Addendum.

Security

Traffic to WishSupport is encrypted with HTTPS.
Passwords are stored only as one-way hashes. API keys are shown once, when they are created, and stored only as hashes.
Sessions live on our server, so they can be ended at once. You can see and end yours from your account settings.
Every request is checked against the space it belongs to, so one customer's data cannot be read through another's account or API key.
Requests are rate limited, and our logs leave out passwords, tokens and API keys.

No system is perfectly secure. If a breach affects your personal data, we will tell you, and the authorities, as the law requires.

Your rights

You have the right to:

access the personal data we hold about you, and get a copy;
correct data that is wrong or incomplete;
have your data erased;
restrict or object to how we use it, including where we rely on legitimate interests;
receive the data you gave us in a portable format; and
withdraw your consent, where we rely on it.

You can change your name, username, phone number, profile picture, email address and password yourself in the portal's account settings, and see and end your sessions there. The portal has no self-service account deletion yet. To delete your account, or to use any other right, email wishdoor25@gmail.com from the address on your account, and we will reply within one month. Some rights have limits: for example, we keep audit records that a space's owner relies on.

If you are unhappy with how we handle your data, please tell us first. If you are in the UK, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, and if you are in the EU, to the data protection authority where you live or work.

If you are a merchant, the developer whose app you used controls your conversation data; see our role.