Who this is for. Two audiences, and they need different things. An organisation evaluating Serviceplane needs to know what we do with the data it entrusts to us and who else touches it — sections 3 to 9. A member of the public who used a chat window, called a phone line or sent a form to an organisation that runs on Serviceplane needs section 10, which is written for them.
This policy describes what the software actually does, verified against it, rather than the widest set of rights a lawyer could reserve. Where something is not in place we say so.
1. Our role
Almost always, we are a processor and our customer is the controller. An organisation decides what content its assistant may answer from, what it retains, who may see what, and what it does with a request. We process on its instructions.
We are a controller only for our own business data: the accounts of our customers' staff, our billing records, and the operational logs we keep to run the platform.
If you are a member of the public and want data corrected or deleted, the organisation you contacted decides that. We will help them act on it, and section 10 explains how to reach them.
2. What this policy does not cover
The websites, phone systems and record systems our customers operate. When the Services read a customer's SharePoint or push a message through its own mailbox, that system is governed by the customer's own policy, not this one.
3. What we process, and where it goes
This is the same table as section 2 of the Trust and Governance document, which is the longer technical version.
| Data | Held in Serviceplane | Sent outside | Why |
|---|---|---|---|
| Chat messages, emails, call transcripts, assistant transcripts | PostgreSQL, tenant-scoped, redacted before it is written | The model provider: the question plus the approved passages it may answer from | To generate the answer |
| Files attached to a case (≤ 5 MB) | PostgreSQL, served only to staff who may see the case, every download audited | — | Supporting documents |
| Text messages (SMS) | PostgreSQL, redacted at write, threaded on a case | The customer's voice/SMS platform for delivery; the model provider for the answer | Two-way texting |
| Web form submissions | PostgreSQL, redacted at write | Email provider for the receipt, if the customer enabled receipts | Requests from people who prefer to write |
| Record facts (parcel/account replica) | PostgreSQL, read-only replica pushed by the customer | The model provider, only in staff mode or after the person verified their identity | To answer about a specific record |
| Call audio | Not stored | A streaming speech-to-text provider, when the customer configures one | Real-time transcript for agent assist |
| Website voice (the visitor speaks through their browser) | The relay stores nothing. The redacted transcript is kept on the case like a phone call | A real-time audio relay (Fly.io), then the customer's voice platform, which transcribes and speaks | Talking to the assistant from a website, when the customer has it turned on |
| Addresses being checked for nearby work | — | The U.S. Census geocoder (address string only) | Proximity lookup |
| Preferred language | PostgreSQL, learned once from the conversation | — | To reply in the person's language |
| Survey answers | PostgreSQL (score and a redacted comment); the link token stored only as a hash, usable once | — | Satisfaction measurement |
| Audit events | PostgreSQL, append-only and hash-chained | Customer export; optionally to URLs the customer subscribes | Traceability |
Nothing goes to a third party that is not in this table. There are no advertising, analytics or telemetry SDKs in the chat widget or the staff workspace. We do not sell personal information, and we do not share it for cross-context behavioural advertising — under any definition, in any state.
Our marketing site is a separate matter, and the distinction is worth being exact about. serviceplane.ai carries Microsoft Clarity — page views, clicks, scrolling and anonymized session replays — which is the one analytics tool on it and sets cookies. It is not in the product: no customer's data and no member of the public's conversation passes through it. The site loads it only when the browser has not signalled an opt-out: Global Privacy Control (the universal opt-out signal the Colorado Privacy Act requires us to honour) or Do Not Track suppresses it entirely, so there is no banner to dismiss. The notice is published at https://serviceplane.ai/privacy/, and the gate is a tested behaviour (apps/workspace/src/__tests__/site-pages.test.ts) rather than an intention.
4. Redaction before storage
Payment card numbers (validated by Luhn), Social Security numbers and bank routing numbers (validated by the ABA checksum) — and an account number read out beside a routing number or after an explicit banking cue — are removed from inbound text before it is stored, embedded, sent to a model, or placed on an audit event. Only the redacted text is ever written.
The rule is deliberately narrow around account numbers. A utility or assessor indexes its records by numeric identifiers — account, premise, person, tap, badge, field activity, adjustment — and a redactor that removed digit runs on sight would destroy the identifier staff use to look a person up, on every call, silently.
Payment card handling. During an assisted call the session can be put in secure pause, and while it is paused every transcript turn is dropped before storage, embeddings or any model. Pause can be raised three ways and the audit record says which: by the contact-centre platform's own signal, which also stops the audio at source so it never reaches speech-to-text; by the representative, from a control in the panel; or by the system itself, when an arriving turn contains a number that validates as a card or routing number. The representative can always see whether the assistant is listening.
5. Subprocessors
| Subprocessor | Purpose | Status |
|---|---|---|
| Railway | Hosting: compute, PostgreSQL, Redis. US region | Always |
| Cerebras | Model provider | Always |
| Deepgram | Speech-to-text for real-time call transcripts | Optional |
| Postmark | Outbound email on the customer's behalf | Optional |
| Resend | Our own platform mail (invitations, notices) — never constituent data | Always |
| Fly.io | Real-time relay for website voice calls: the visitor's audio passes through it in transit and is not stored. US region | Optional, only where website voice is turned on |
| U.S. Census Bureau geocoder | Address geocoding, address string only, no account | As used |
| The customer's own voice platform | Telephony | Customer's own |
We give not less than 30 days' notice before adding a Subprocessor in a new category, and a customer may object on reasonable security or privacy grounds. Adding one within a category already disclosed, on terms no less protective, does not require prior consent.
Model providers are used under API terms that exclude inputs from training. We do not train or fine-tune models on customer data. Which model provider answers for an organisation is set by us, not by the organisation.
6. Retention
Retention is set by the customer, per channel: chat, voice, email and assistant sessions each have their own period, and zero means keep indefinitely. Purges run every six hours and on demand.
When a period expires, content is replaced rather than the row deleted: chat text becomes a removal marker and citations are dropped, calls lose the transcript and recording link but keep the summary, emails lose the body and attachments but keep the subject and addresses so old threads still thread. Counts, cases and analytics survive, so reporting does not change when content ages out.
Two things are never removed. The audit trail, because it is hash-chained and rewriting it would be detectable. And the records replica, which is a copy of the customer's own system that its own agent retires.
Legal hold. A case can be placed on hold with a reason; its chat, calls and emails are skipped by every purge until released. Holds and releases are audited.
7. Security
Encryption in transit throughout. Encryption at rest through the hosting provider's managed PostgreSQL volumes. Staff sign in through the customer's own identity provider; roles and groups come from the token; a deactivated colleague loses access within one token lifetime. Retrieval is permission-aware — content indexed from SharePoint carries the site's group ids, and a user retrieves only what their groups allow. Systems authenticate with per-tenant API keys stored only as hashes and revocable at any time.
On public channels the assistant will not state a record fact until the person proves who they are — naming the parcel or account and matching something the record already holds. Five failed attempts lock that subject for ten minutes, and a failure never reveals whether the identifier exists.
Not in place, and we would rather say it here. No SOC 2 or ISO 27001 report, and no completed third-party penetration test. Backups and point-in-time recovery rely on the hosting provider's managed PostgreSQL. The current list is kept in section 12 of the Trust and Governance document.
8. Where data is processed
Hosting is in the United States. Model providers, speech-to-text and email providers process in their own regions under their terms.
Personnel. Development and testing may be performed by non-US personnel on synthetic data only. Production access and support are US personnel.
9. Rights of organisations we serve
A customer may at any time export its data as CSV or JSON, verify the integrity of its audit chain itself, change its retention periods, place a legal hold, and require deletion with written certification of destruction. Every export is itself audited — counts and filters, never the exported values.
10. If you are a member of the public
You may have used a chat window, called a number, sent a form or received a text from an organisation that runs on Serviceplane. Here is the short version.
We are not that organisation. They decide what is kept and for how long, and they hold the relationship with you. We run the software.
What is kept about you is what you wrote or said, redacted of card, Social Security and bank routing numbers before it is stored; the request you opened and its history; your contact details if you gave them; and, if you answered one, a satisfaction score.
You are told when you are talking to software. The chat window shows a disclosure before your first message, and the phone assistant says it is automated.
The assistant answers only from content the organisation has approved. If nothing approved answers your question, it says so and offers a person rather than guessing.
It will not tell you about an account or property record until you prove it is yours — and if you get it wrong, it will not tell you whether the number exists.
Your rights — to know what is held, to correct it, to have it deleted, to opt out of sale or sharing (we do neither), and not to be discriminated against for asking — come from your own state or national law. Colorado residents have them under the Colorado Privacy Act; California residents under the CCPA as amended; others under their own law. Exercise them with the organisation you contacted. They are the controller and they can act. If you cannot reach them, write to us at [email protected] and we will route it to them and tell you we have.
Text messages. Reply STOP to any text and it stops immediately. An opt-out survives a merge of duplicate records.
Children. The Services are not directed to children and we do not knowingly process the data of a child under 13. If you believe we have, contact us and we will work with the organisation to remove it.
11. Changes
We revise this policy when what we do changes — not when what we intend changes. The version and date are at the top. A change that materially affects how customer data is processed is notified to customers in advance, and a new Subprocessor category gets the 30 days in section 5.
12. Contact
Adeel Syed
[email protected] · 469-200-0048
2AM Fusion, Inc.
Related: Master Subscription Agreement · Acceptable Use Policy · Service Level Agreement · Trust and Governance · Accessibility Policy