Privacy

Your customers’ mail is stored

Help desk is a shared inbox, so it must keep the mail. When a customer writes to the address of your team, the server stores the mail as a ticket in Cloudflare D1: the sender’s address and name, the subject, and the text and the HTML of the mail. It stores your replies and your private notes in the same ticket. The messages that a visitor writes in the chat box are stored the same way.

Only the members of your team can read a ticket. A member of one team can never read the tickets of another team. The text is cut at 50,000 characters for each mail.

Attachments are not kept. The ticket says how many attachments the mail had. A mail bigger than 5 MB is refused.

No log has an address, a subject or the text of a mail. Our logs show only that a mail came in, with no personal data.

What else the server stores

• Your email, to know whose teams they are. You can own 3 teams.
• For each team: its name, its address, the members (up to 5, with the email addresses of the people you invited), the canned replies, the help articles and the addresses you blocked as spam.
• For each ticket: its status, who it is assigned to, and a random token in the reply address of the ticket.

The server never stores the IP address of a customer or of a visitor of the chat box. Cloudflare counts messages by IP address to limit abuse. We do not store or log that address.

What the customer sees

A reply goes out from the address of your team, with the name of your team. It has no information about the member who wrote it. The customer answers to the address of the ticket, and the answer goes into the same ticket.

The public help page of your team (/h/your-team) shows the articles you wrote, to anyone who has the link. It is not for search engines unless you make it public.

Mail passes through Cloudflare

Cloudflare’s email service receives the mail for your team’s address and sends your replies. Your customers’ mail providers keep their own copies, as for any other mail.

How long it stays, and how to delete it

Your data stays until you delete it. In a ticket, choose “Delete” to delete that ticket with its messages. In the settings of a team, the owner can choose “Delete this team”. That deletes every ticket, reply, note, canned reply, help article and member of the team. Cloudflare D1 keeps point-in-time backups of the database for up to 30 days, so deleted data can stay in a backup for that time.

The spam button marks the ticket as spam, hides it, and blocks the sender’s address for your team. Later mail from that address is dropped.

Delete my account

Sign in and choose “Delete my account”. The server then deletes every team you own, with all its tickets. You leave the teams of other people, and your address is removed from the tickets and notes there. It also deletes your sign-in account. This cannot be undone.

Your sign-in is shared with Kevin’s other apps. So you are signed out of them too. A request goes to Kevin automatically. He deletes what those apps keep for your account soon after.

Signing in

To sign in you use Google (on Google’s site) or a code sent to your email. The sign-in service keeps your email and sets a cookie on utilarium.app (and on kamadorueda.com when the sign-in goes through it) for 30 days. For details, read the sign-in section of Coro’s privacy page.

Customers and visitors of the chat box do not sign in. The chat box sets no cookie.

Where it runs

Help desk runs on Cloudflare. The records are in Cloudflare D1. Like any web host, Cloudflare sees your IP address and the page you ask for.

Analytics and error reports

Cloudflare Web Analytics can add a small script to the pages, to measure visits and speed. We do not control that script. Our own code sets no cookie and keeps no profile of you.

If the page has an error, it sends a report with the error message, page type and browser. It has no ticket, address or text. Cloudflare keeps technical request logs, with no IP address, for 7 days. For about 1 in 10 requests, Cloudflare also records the browser and operating system, the language, the network and an approximate location. These records hold no mail and no address.