Legal

Privacy policy

This policy explains what Solvey collects, why, who processes it on our behalf, and your rights. Lukas Dulecki is the controller for account data and a processor for the data your organization puts into its helpdesk.

Effective 2026-09-08

1. What we collect

Account data. Your name and email address, and the sign-in details our identity provider holds. If you sign in with Google or Microsoft, we receive your name, email and profile picture from them.

Helpdesk data.Whatever your organization puts into the service: tickets, replies and internal notes, the people who raise and handle them, settings, API keys (stored as hashes) and webhook subscriptions. This is your organization's data; we process it on its instructions.

Billing data. The seats your organization buys and the state of its subscription. Payment card details never reach us: they are collected and stored by Paddle, our merchant of record.

Technical data. Server logs, error reports and the minimum needed to keep the service secure and working: IP addresses, browser type, request timing. We do not run advertising trackers.

2. Why we use it

• to provide the service — showing you your tickets, delivering emails and webhooks, enforcing who may see what;
• to bill, through Paddle;
• to keep the service secure and to find and fix faults;
• to tell admins about their organization's account — trial ending, payment issues, material changes;
• to answer your support requests.

We do not sell personal data, and we do not use your data to train machine-learning models.

3. Tenant isolation

Each organization's data is isolated from every other organization's, in the application and again in the database. Internal notes are never emailed to requesters and never included in webhook deliveries. Our test suite proves both on every change.

4. Who processes data on our behalf

Where data leaves the European Economic Area or the United Kingdom, it does so under standard contractual clauses or an equivalent lawful mechanism. We will update this list before adding a subprocessor.

5. Retention

Helpdesk data is kept while your organization is subscribed or in its trial, and for 30 days after cancellation so it can be exported. After that it is deleted permanently. Backups roll off within a further thirty days. Server logs are kept for ninety days.

6. Your rights

You can access, correct, export and delete your personal data. Members of an organization can update their own profile at any time; the organization's admins can export everything and delete the organization. If you are in the EEA, the UK or another jurisdiction with similar rights, you may also object to or restrict processing, and complain to your data protection authority. Write to privacy@solvey.io; we answer within thirty days.

If your organization needs a data processing agreement, ask at the same address and we will provide one.

7. Cookies

We use only the cookies needed to keep you signed in and to protect the service against request forgery. There are no advertising or cross-site tracking cookies, so there is no cookie banner to click.

8. Security

Everything is encrypted in transit and at rest. Passwords and single sign-on are handled by our identity provider; we never see passwords. API keys are stored as hashes; webhook signing secrets are stored encrypted. Access to production is limited to the people who build the product. If we ever learn of a breach affecting your data, we will tell your organization's admins without undue delay and within seventy-two hours.

9. Changes

We may update this policy. Material changes are announced to your organization's admins by email at least thirty days before they take effect.

10. Contact

Lukas Dulecki, Haifa, Israel. privacy@solvey.io. See also our terms of service.

Our other policies

Terms of service · Privacy policy · Refund policy