Privacy

Who we are

VectraForge (UEN 53532893A) runs xupport.io, the app, and the API. Registered office: 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051. If you buy a workspace, you are our customer. People who write to your widget, form, or inbound address are your end users. We process their messages to provide the helpdesk you asked for.

What we collect

• Account. Name, email, password hash or Google id, optional authenticator secret, session list (device label, IP, last seen).
• Workspace. Tickets, messages, attachments you upload, help articles, tags, brand settings, Slack channel id, webhook URL.
• Billing. Plan and Stripe customer id. Card numbers stay with Stripe.
• This marketing site. If you allow analytics cookies, page views via Google Analytics. The chat widget stores a conversation id in your browser so the thread can continue. See Cookies.

Why we use it

To run the product you signed up for: login, the inbox, mail, Slack, optional bot replies, billing, and abuse prevention. We do not sell personal data. We do not use your tickets to train a public model.

Under Singapore’s PDPA we use the data to perform the contract and to operate the service. If you are in the EEA or UK, those are our legitimate interests and/or contractual necessity. You can object or ask for access, correction, or deletion at hello@xupport.io.

Who else sees it

• Hosting and database (our cloud provider).
• Stripe, if you start checkout.
• Resend, if mail goes in or out.
• OpenAI, if the bot or copilot runs and a key is configured — ticket text needed to draft a reply.
• Slack, if you connect a channel.
• Google, if you sign in with Google.

Each processor only gets what that feature needs. Workspace data is separated in the database with row-level security. A request is tied to one organisation.

How long we keep it

Account and tickets stay while the workspace is open. If you close the workspace, we delete or irreversibly anonymise the data when the contract ends, unless the law says we must keep a record (for example invoices). Session and password-reset tokens expire.

Your rights

You can ask for a copy of your account data, a correction, or deletion. California residents can ask what we collected and to delete it; we do not sell or “share” personal information for cross-context ads. We will not discriminate against you for asking.

Children

Xupport is for work teams. Do not use it to collect data from children under 13 (or the age that applies where you are).

Transfers

Infrastructure may sit outside Singapore. We use contracts and access controls so the data stays used only for Xupport.

Changes

We will update this page and the date above when the practice changes. Material changes get a note in the app or by email if you have an account.

Also: Terms · Cookies · Security.