Privacy text

A template for the support part of a product's privacy policy. Fill in the {…} parts from the product's settings in ALIAS. Use part A always, and part B only if the product's contact is optional. ALIAS applies what this text promises: the keeping times, the copy, the erasure and the withdrawal are the service's own behaviour, not a promise to keep by hand.

Part A: support without a contact

What we keep when you ask for help. When you send a report from {product}, we keep:

• what you wrote;
• a screenshot, if you sent one;
• the details {product} adds about where you were and what it was doing ({the context fields and the telemetry, in plain words});
• the version of {product};
• our answers.

Who you are to us. Nobody, by name. The first time {product} talks to our support service, the service gives it an anonymous id and a secret. They aren't made from anything about you, your device or your account anywhere. The id is {product}'s alone: if you use another product with the same support service, it gets a different id, and the two can't be linked. We don't ask for, and don't keep, your name, email, phone number or account.

Moving to another device. {product} can show a short code that works for 10 minutes. Typing it in on your other device gives that device the same id, with a secret of its own.

How long we keep it:

• A report: {keep_done_days} days after it was resolved or closed.
• Everything of your id: {keep_unseen_days} days after {product} last talked to the support service.
• Both are deleted automatically.

Your copy, and erasing it. In {product}'s {where: e.g. Settings › Support}, you can:

• download everything we keep about your id, as a file;
• erase all of it at once. Your id, its reports and screenshots, and any contact you gave are deleted, for good, at once.

Who sees it. Only the people who answer {product}'s support, signed in with their organisation's account, see it. Everything they do (answering, blocking, erasing) is logged. We use your reports only to help you and to fix {product}. We never sell them or use them for advertising.

Part B: a contact, only if you choose to give one

Giving a contact is up to you. In {product}'s {where}, you may give us an email address {or: or another way to reach you, such as a handle on a forum} so we can write to you about your reports. Support works the same without it.

If you give one, we keep:

• the contact itself;
• what kind it is (an email, or something else);
• when you gave it.

We use it only to answer your reports to {product}. Never for news, offers or anything else. It isn't shared with any other product, even one that uses the same support service.

With a contact, you're no longer anonymous to us. The people who answer {product}'s support can see it. Every time one of them opens it, that's logged.

We don't check it. We send no mail to confirm the address, and it's shown to support as unverified. If you type in someone else's address by mistake, nothing is sent to them automatically.

Withdrawing it. You can withdraw it at any time in {product}'s {where}. It's deleted at once (not hidden, deleted). It's also deleted when you erase your data, and when your id is deleted after {keep_unseen_days} days without use.

Why we may keep it. Only because you agreed by giving it to us (consent: GDPR Article 6(1)(a)). Withdrawing it doesn't affect the answers we sent before.

For the operator

• The products' keeping times are their keep_done_days and keep_unseen_days. The service applies them every hour.
• GET /v1/me/data is the copy. DELETE /v1/me is the erasure. DELETE /v1/me/contact is the withdrawal.
• The audit (the admin page's Log) records:
  • contact.give, contact.withdraw and contact.view (each with the kind only, never the value);
  • user.erase_self, user.erase, user.block and user.reset_secret.
• If the product's support people write to a contact from their own mailbox, those mails are under the operator's own mail retention. Say so in the policy if it's longer than the times above.