Privacy Policy

Last updated: 2026-07-05

1. Introduction

TicketON (“TicketON”, “we”, “us”, “our”) provides a customer-support and live-chat platform that businesses (“Merchants”) use to communicate with their customers across channels — including a mobile app for support agents, a web dashboard, an embeddable chat widget, and integrations with external platforms (such as Shopify and Telegram). This Privacy Policy explains what personal data we process, why, who we share it with, and the choices and rights you have.

Contact for any privacy question or request: [email protected].

2. Our roles: Controller and Processor

• As a controller, we decide how and why we process data about the people who create and use a TicketON account — Merchants and their support agents (“Operators”) — for example to provide, secure, and support the service.
• As a processor, we process data about a Merchant’s own end-customers and website visitors strictly on that Merchant’s behalf and instructions (for example, chat messages, contact details, and visitor analytics collected through the widget embedded on the Merchant’s own website). For that data the Merchant is the controller and is responsible for providing notice to, and obtaining any required consent from, its end-customers.

If you contacted a business through TicketON (e.g., via a chat widget on that business’s website), please refer to that business’s privacy policy and direct your requests to them; we will assist them as their processor.

3. Data we process

3.1 Account & Operator data (we are the controller)

• Identity & contact: name / nickname, email address.
• Credentials: password (stored hashed) and authentication tokens. If you sign in with Apple or Google, we receive the identifier, email, and name those services release to us.
• Device & technical: push notification token, account/user identifiers, and technical logs needed to operate and secure the service.
• Billing: if you subscribe to a paid plan, our payment processor handles your payment; we receive limited billing data (such as plan, status, and partial card details) to manage your subscription, but we do not store full card numbers.

3.2 End-customer & visitor data (we are a processor for the Merchant)

Processed on the Merchant’s behalf through the widget, dashboard, app, and connected channels:

• Contact details a customer provides or an Operator records: name, email, phone number.
• Conversation content: chat and text messages, and any attachments (photos, videos, audio, and files).
• Voice / video calls: real-time audio and video between a customer and an Operator. Calls are not recorded by us unless the Merchant enables it.
• Visitor analytics: approximate location (country / city derived from the visitor’s IP address), pages viewed, referral / UTM parameters, browser and device information (user agent), and IP address.
• Commerce data: where a Merchant connects a store (e.g., Shopify), related order and customer information needed to assist the customer.

3.3 Connected support mailboxes (Gmail / Outlook)

A Merchant can connect an email mailbox (Google Gmail or Microsoft Outlook) as a support channel. This happens only with the Merchant’s explicit OAuth consent, which can be withdrawn at any time — by disconnecting the mailbox in TicketON or by revoking TicketON’s access in the Google or Microsoft account security settings.

For a connected mailbox we access email data solely to provide the support channel:

• Read incoming messages (including attachments) so they appear as support tickets for the Merchant’s Operators;
• Send replies written by Operators (or drafted with AI assistance and approved by the Merchant’s configuration) from the connected mailbox;
• Manage processed messages (e.g., mark a message as read) so the mailbox reflects the conversation state.

We do not use email data from connected mailboxes for advertising, do not sell it, and do not allow humans to read it except with the Merchant’s permission (e.g., for support), where necessary for security or abuse investigations, or where required by law. Email content is processed by our AI provider only to assist with the specific conversation (e.g., drafting a reply) and is never used to train generalized AI or machine-learning models. OAuth tokens are stored securely and used only to operate the connected channel.

Google API Limited Use disclosure: TicketON’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use data and our legal bases (GDPR)

• Operate the service — authenticate users, route conversations, send and receive messages, calls and attachments. Legal basis: performance of a contract; our legitimate interests; or processing on a Merchant’s instructions.
• AI-assisted support — to suggest or generate replies, search a Merchant’s knowledge base, and help moderate content, conversation content and related text are processed by our AI provider (OpenAI) acting on our behalf. This content is not used for third-party advertising and is not used by those providers to train their generalized models for advertising. Legal basis: performance of a contract / legitimate interests / Merchant instructions.
• Notifications — transactional emails and push notifications (e.g., new message, password reset). Legal basis: contract / legitimate interests.
• Website analytics — to understand how our website is used and improve it, using Google Analytics and Microsoft Clarity (see “Cookies”). Legal basis: consent where required / legitimate interests.
• Billing and payments — to process subscriptions and payments for paid plans through our payment processors. Legal basis: performance of a contract / legal obligation.
• Security, fraud prevention, reliability, and debugging. Legal basis: legitimate interests / legal obligation.

We do not use personal data for third-party advertising, and we do not sell personal data. We use limited analytics on our website to understand and improve it, as described under “Cookies”.

5. Automated decision-making and AI

Some features rely on automated processing. In particular, our AI tools suggest or draft replies, search a Merchant’s knowledge base, and help flag or moderate content. These tools assist Operators and do not, by themselves, make decisions that produce legal or similarly significant effects about you without human involvement. You have the right to obtain an explanation of automated processing that significantly affects you, to express your point of view, to contest a decision, and to request human review. To exercise these rights, contact [email protected].

6. Sub-processors and third parties

We share data only with service providers that help us run TicketON, under appropriate data-protection agreements. By category:

We may also disclose data to comply with law, enforce our terms, or in connection with a merger, acquisition, or asset sale. We do not sell personal data.

7. International transfers

Some of our sub-processors (for example our AI, communications, email, analytics, and payment providers, including OpenAI, Google, Microsoft, and Stripe) are located in the United States or other countries. Where we transfer personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

8. Retention

We keep account data for as long as the account is active and as needed to provide the service. End-customer and visitor data is retained according to the Merchant’s instructions and settings and is deleted or returned when the Merchant’s account ends, subject to legal retention requirements. Backups are purged on a rolling schedule.

9. Security

We use measures including encryption in transit (HTTPS / TLS), hashed passwords, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your data.

10. Cookies

We use cookies and similar technologies on our website and web dashboard:

• Strictly necessary cookies — to keep you signed in, secure your session, and remember basic preferences. These are required for the service to work.
• Analytics cookies — to understand how our website is used and improve it. We use Google Analytics (traffic and usage statistics) and Microsoft Clarity (aggregated interaction analytics, heatmaps, and session replay). These are set only with your consent where required by law.

You can manage non-essential cookies through our cookie banner (where shown) and through your browser settings. Blocking strictly necessary cookies may affect how the service works.

11. Your rights and choices

Depending on where you live (e.g., EU / UK GDPR, California CCPA), you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, and to withdraw consent.

• Account holders / Operators: email [email protected].
• Account deletion: you can request deletion of your account and associated personal data at any time by emailing [email protected]. We will delete or anonymize your data unless we are required to keep it by law.
• End-customers: please contact the business you interacted with (the controller). We will help that business fulfil your request.

You also have the right to lodge a complaint with your local data protection authority.

12. Children

TicketON is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page and revise the “Last updated” date above.

14. Contact

Questions or requests regarding this Policy or your personal data: [email protected].