Privacy Policy

1. Who we are

HelpBird is a drop-in real-time chat widget for websites, operated by DevCloud Software. Throughout this policy, "HelpBird", "we", "us", and "our" refer to that operator.

Two distinct groups interact with the service, and we treat their data differently:

• Customers — site owners who sign up and install the chat on their own website.
• End users — the visitors of a Customer's site who message the Customer's support team through the chat. We process their data on the Customer's behalf.

2. What we collect from Customers

When you create a HelpBird account, we collect:

• Account info: name, email address, hashed password, the website URL where you'll install the chat.
• Billing info: handled by Stripe. We never see or store your full card number — we only keep a Stripe customer ID, the last four digits, and the card brand.
• Project configuration: widget settings, theme choices, banned-word lists, teammate invites, webhook URLs.
• Login telemetry: the IP address of each sign-in attempt, held briefly to rate-limit password guessing.

3. What we collect from End Users

When a visitor opens a page on a Customer's website that embeds our chat, the widget connects to our servers to load and send messages. In that flow we process:

• Message content: text the visitor sends, plus files they choose to upload (images, PDFs, documents). Images have EXIF metadata stripped (so GPS / camera info doesn't leak) before storage.
• Identity: a name and email address only if they choose to give them, or if the Customer passes them to the chat with HelpBird.identify() (optionally signed, so the Customer's agents can see the identity is verified).
• Connection metadata: IP address, browser/user-agent string, the URL of the page hosting the chat. IP is used for rate limiting, ban enforcement, and abuse detection — it is not sold or used for advertising.
• Anonymous visitors: identified by a random visitor ID kept in the browser's local storage for that website, so a returning visitor's conversation continues. The chat also keeps two small flags in the host site's local storage (whether it was left open, whether the greeting was shown). We do not build cross-site profiles.

We act as a processor for End User data. The Customer is the controller — their own privacy policy governs what their visitors are told. We process End User data only as needed to deliver the chat service to that Customer.

4. Cookies and similar technologies

We use a small, focused set of cookies and storage:

• Session cookies — keep you signed in across tabs. Cleared when you sign out.
• localStorage / sessionStorage — remembers UI preferences (collapsed/expanded state, dismissed hints).
• Google Analytics — on our website and admin panel (never inside the chat on your site), to understand how they're used. IP addresses are anonymized.
• Google Ads click ID — if you arrive from one of our ads, a first-party cookie (hb_gclid, 90 days) remembers the click so we can tell which ads lead to sign-ups.
• Cloudflare Turnstile — on the sign-up and contact forms, to keep bots out.

The chat widget your visitors load sets no analytics or advertising cookies. It is served from our own servers.

5. Sub-processors we rely on

Running the service requires a small number of vendors. Each receives only the data needed to do its job, under contract terms that forbid use for any other purpose.

• Stripe — payment processing for self-serve subscriptions.
• OpenAI — when AI features are in use (Pro plan or free trial), conversation text is sent to OpenAI: for AI auto-reply, for the AI drafting tools agents use in the inbox, and for the short summary written when a conversation is closed (on by default; can be turned off in Settings → Automation). OpenAI does not use this content to train models.
• Google — Analytics and Ads measurement on our website, and Firebase Cloud Messaging to deliver push notifications to the HelpBird mobile app (the visitor's name and the first 140 characters of their message).
• Cloudflare — Turnstile, the bot check on our sign-up and contact forms. It sees the browser and IP address of whoever submits them, never what they typed.
• Shopify — for stores that install HelpBird from the Shopify App Store: the app install, billing through Shopify, and Shopify's privacy requests.
• Email delivery provider — transactional emails (account verification, password reset, digest emails, support replies).
• Hosting & CDN — servers and static asset delivery for the widget script.

6. How we use the data

• To deliver and operate the chat service the Customer paid for.
• To prevent abuse — rate limiting, banned-word filtering, IP/CIDR bans, slow mode.
• To send transactional email (sign-up confirmation, password reset, billing receipts, digest summaries you opted in to).
• To compute aggregate analytics shown on the Customer's panel (daily conversation and message counts, reply times, CSAT, hour-of-day heatmap). Analytics are scoped to a single Customer's project; we never expose one Customer's data to another.
• To respond when you contact us.
• For stores that install HelpBird from the Shopify App Store: the store's name, domain, contact email, install and uninstall dates, HelpBird plan and how many conversations and team messages the store had in the last 30 days (counts only, never their content) are copied hourly into DevCloud Software's own customer and marketing records — for example, so we can contact merchants about HelpBird. Uninstalled stores stay there until Shopify's erasure request for the store, 48 hours after uninstall, removes their name and email.

We do not sell personal data. We do not share message content with advertisers. We do not use End User content to train AI models.

7. Sharing and disclosure

We share data only in narrow, predictable situations:

• With sub-processors, as listed above, strictly to deliver the service.
• With the Customer, who already controls their own chat: messages, uploaded images, sender identity, IP for moderation actions, and webhook payloads.
• To comply with law, when we receive a valid legal request — subpoena, court order, or equivalent. We push back on overbroad requests and notify the affected account where we're not legally barred from doing so.
• In a business transfer, if HelpBird is acquired or reorganized. The acquirer would inherit this Privacy Policy; you'd be notified before any change in how your data is used.

8. Security

Concrete measures, not platitudes:

• HTTPS/TLS for every connection, including the widget websocket.
• Customer passwords are hashed (PBKDF2). Sub-admin passwords are hashed too.
• Webhook payloads are HMAC-signed so receivers can verify they came from us.
• Image uploads are validated by their actual bytes (not the filename), checked against a pixel ceiling, and have EXIF/XMP metadata stripped before storage.
• Signed per-visitor tokens on the chat's own API; CSP frame-ancestors and cross-site-request protection on the admin panel.
• Internal access to production data is limited to a small ops team, audited, and gated behind 2FA.

No system is unbreakable. If we ever discover a security incident affecting your data, we'll notify you without undue delay and tell you what we know.

9. AI agents and MCP connections

A Customer can connect an AI assistant — Claude, ChatGPT, Claude Code, Cursor, VS Code or any other client of the Model Context Protocol (MCP) — to their HelpBird account (see Connect AI agents). When they do:

• What the agent can do: it acts as the account owner, with the owner's plan and the same checks as the admin panel. It can read what the owner can read (conversations and their messages, contacts, help-center articles, settings, team, analytics, the plan and invoices) and make the changes the owner can make — reply to customers, edit articles, change settings and so on. Replies to customers, campaigns, deletions, sending data outside the account and cancelling the plan first return a preview and only happen once confirmed. No agent can make a payment or a refund: a plan change returns a link the owner opens in their own browser. Signing in, passwords, payment cards and deleting the account stay in the panel.
• Access is by OAuth tokens you can revoke: only the account owner can connect an app, by signing in to HelpBird and approving it. Each connection is a token; we store only a hash of it, its name, when it was created and last used, and which app it was issued to. Access tokens expire after an hour and are renewed only while the connection is active (a renewal token lasts 90 days without use). The owner can disconnect any app or token at any time in Settings → AI agents, and changing the password disconnects them all.
• What we keep: connection records stay with the account until it is deleted. App registrations that never completed a connection are deleted after 7 days, and unused sign-in codes within a day. We don't log the content of the agent's requests or of our answers; errors go to our server logs, kept for about 30 days.
• Where the data goes: what the agent reads is sent to the AI provider the Customer chose, and from then on is governed by that provider's terms and privacy policy, not this one. We don't receive or store the Customer's conversation with their AI assistant — only the tool calls it makes to HelpBird.

10. Data retention

• Messages: kept until the Customer deletes their account, which erases them. On Shopify, a store's customer-erasure request removes that shopper's messages, files and identity from its conversations.
• Uploaded files: kept with the conversation they were sent in, and deleted with it.
• Account data: kept while your account is active. We retain billing records for the period required by tax/accounting law (typically 7 years).
• Logs: server access logs are kept for a short rolling window (typically 30 days) for debugging and abuse investigation.

11. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA, LGPD, etc.), you may have the right to:

• Access the personal data we hold about you.
• Correct it if it's wrong.
• Delete it (right to be forgotten), subject to legal retention obligations.
• Export it in a portable format.
• Object to or restrict certain types of processing.
• Withdraw consent for optional processing — for example, unsubscribe from digest emails using the link in any digest.

To exercise any of these rights, email sales@devcloudsoftware.com. End users should contact the Customer who owns the site they're chatting on; we will assist that Customer with the request.

12. International data transfers

Our servers are located in the United States. If you access HelpBird from outside the U.S., your data is transferred to and processed in the U.S. By using the service you consent to that transfer. Where required, we rely on Standard Contractual Clauses (SCCs) with sub-processors that handle EU/UK personal data.

13. Children

HelpBird is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll delete it.

14. Changes to this policy

We may update this policy as the service evolves. Material changes will be announced on this page with a new "last updated" date and, where appropriate, by email to active Customers. Continued use after a change means you accept the updated policy.

15. Contact

Questions about this policy or about how we handle your data? Email sales@devcloudsoftware.com — we read every message.