Customer data and privacy

Your helpdesk holds your customers' names, contact details, messages and attachments. This page covers the requests and questions that come up about that data. For how Growth Dept protects it in general, see the security page and the privacy policy.

Erase a customer when they ask#

When a customer asks you to delete their data, under GDPR, CCPA or a similar law:

1. Open Customers and search for them by name, email address or phone number.

2. Tick the box beside them. If they have more than one profile, for example one per email address, tick each.

3. Select Delete and confirm.

This erases the customer and everything tied to them: their tickets with all messages, the messages they sent on other tickets, their attachments and their customer field values. It cannot be undone. Any role that can work tickets can do it; observers cannot.

Deleting in the helpdesk does not delete them anywhere else. Remove them separately from:

• your Shopify store, your mail provider's mailbox and any other tool that holds their details;

• full exports someone already downloaded;

• internal notes on other customers' tickets that mention them by name.

What stays behind holds no personal details: the audit log and the data access log refer to the customer and their tickets by number only.

If you keep a register of erasure requests, note the date and the customer number before you delete.

Card numbers and other sensitive details#

The helpdesk stores messages exactly as customers send them. It does not detect or hide card numbers, national ID numbers or passwords that a customer types into an email or chat.

• Never ask customers for full card numbers, and say so in your macros and help center.

• If a customer sends one anyway, removing that one message is not available in the app. Delete the ticket through the REST API with DELETE /api/tickets/{id} (see The REST API and API keys), or ask support@growthdept.ai for help. Moving the ticket to the trash hides it but does not delete it.

Help center searches are an exception: before a search is stored for the statistics, email addresses become [email] and runs of five or more digits, such as order or phone numbers, become [number].

A customer asks what you hold#

There is no one-click download of a single customer's data. Open their profile to see their details, tickets and orders, and copy what they ask for. A developer can also fetch the customer and their tickets with the REST API. To see who on your team has read their records, use the data access log.

How long data is kept#

When Shopify tells the helpdesk that a store owner or customer asked to be erased, the cached store data for them is removed automatically.

Who can see the data#

Everyone in your helpdesk can read tickets and customers, observers included, because limiting a role to its own tickets is not available yet (see Access settings). Growth Dept staff open your helpdesk only to give support you asked for or to look into a problem, and each of their visits and reads is recorded in your audit log and data access log.