How we handle your data, honestly
Solves is a UK-first support desk at pilot stage. This page sets out what personal data we process, how long we keep it, and how you can ask for a copy or deletion. We align our handling with ICO guidance, but we do not yet claim formal UK GDPR compliance: a full review comes before public paid launch.
Pilot-stage copy: written to be accurate, not to overclaim.
The short answer
What we do with personal data, in one paragraph
We process the personal data you and your customers put into a support desk: account details for your team, and the contacts, messages and notes that make up your tickets. We encrypt the support content at rest, keep it only while there is a reason to, and you can ask for a copy or deletion.
For the support content you bring into Solves, you are the controller and we act as a processor on your behalf. For your own account and billing details, we are the controller. Our data processing agreement sets out both roles.
What we process
The personal data we handle, and why
We keep the categories deliberately narrow: what a support desk needs and very little else. The table groups them, what each is for, and how we protect it.
| Team account data | Names, email addresses and roles for people in your workspace, used to sign in, assign tickets and apply permissions. Held while your account is open. |
|---|---|
| Contact records | The name, email address and company of the people who write to your support addresses, grouped by brand. Encrypted at rest; searchable fields use a separate blind index, not the plaintext. |
| Ticket content | Subjects, message bodies, private notes, tags and saved replies. All encrypted before it touches the database, bound to your organisation so it cannot move between tenants. |
| Billing data | The details needed to take payment and issue a VAT-visible invoice. Card processing is handled by Stripe; we do not store card numbers. |
| Observability metadata | Timings, route families, error markers and a correlation id, so we can see and fix problems. No message bodies, email addresses, secrets or payloads. |
We do not sell personal data, and we do not use the contents of your tickets to train any model. There is no AI drafting or summarising in Solves.
How we protect it
Data protection built into the product
These are shipped behaviours, not promises for later.
Encrypted at rest
Customer support content is encrypted with XChaCha20-Poly1305 and per-organisation keys, each ciphertext bound to your organisation, table and field.
Authorised access only
Every row is scoped to your organisation, with brand and ticket visibility enforced by access policy, so a teammate never sees data outside their scope.
Metadata-only logs
Logging strips and redacts personal data by pattern and fails closed if anything sensitive reaches a log writer.
Configurable retention
A retention setting decides how long resolved and closed tickets are kept before deletion, in line with the ICO storage-limitation principle.
Metadata-only audit history
Changes to a ticket are recorded as audit metadata, so you can see what happened and when without exposing message content.
UK or EU hosting
Data is hosted with a UK or EU cloud provider. Our data residency and sub-processors pages give the detail.
Retention
Keeping data only as long as we need it
The ICO storage-limitation principle says you should not keep personal data for longer than you need it. We build that in rather than leave it to chance.
How retention is configured
- Account data is kept while your account is open, and deleted or anonymised within a defined window after you close it.
- Resolved and closed ticket content is governed by a retention setting you control, so old tickets are removed on a schedule that suits you.
- Observability metadata runs on its own short retention and is purged automatically.
- Billing records are kept for as long as we are required to, for example to meet UK tax and accounting obligations.
Where we are legally required to retain something, we keep only the minimum.
Your rights
Subject access, correction and deletion
UK data protection law gives people the right to ask for a copy of their personal data, a correction or deletion. We honour those requests and work to the one-month timescale the ICO sets for a subject access request.
How to make a request
- Email our support address from the account the request relates to, and say what you are asking for: a copy, a correction or deletion.
- We confirm receipt and, where needed, ask for enough detail to verify who you are, so we do not disclose data to the wrong person.
- We respond within one month; if a request is complex we will tell you and explain any extension.
If a request relates to one of your customers rather than your team, you are usually the controller, so it comes to you and we support you as your processor. Self-service export and the guided importer are still being built during the pilot, so for now ask us and we will help you get your data out.
What pilot stage means here
We align our handling with ICO guidance and have built encryption, access control, metadata-only logs and configurable retention into the product. We have not yet completed a formal data-protection review, so we do not claim UK GDPR compliance or any certification. That review, including a record of processing and a data protection impact assessment where needed, is in preparation before launch.
FAQ
Data protection questions
Can I request a copy of my data?
Yes. We aim to respond within one month, in line with the ICO timescale for a subject access request. While self-service tools are still being built, email our support address with enough detail for us to find your account safely, and we will confirm receipt.
How long do you keep my data?
Only as long as we have a reason to, which is the storage-limitation principle the ICO describes. Account data lasts while your account is open, a retention setting governs resolved and closed tickets, and observability records are metadata-only on a short retention.
Do you claim to be UK GDPR compliant?
No, not yet, and we would rather say so plainly than overclaim. We have built data protection into the product and align our handling with ICO guidance, but a full data-protection review comes before public paid launch.
Where is my data stored?
Encrypted at rest with per-organisation keys, on a UK or EU cloud hosting provider, with named sub-processors for specific jobs: Postmark for email delivery and Stripe for billing. Our data residency and sub-processors pages give the detail.
What happens to my data if I leave?
When you close your account, we delete or anonymise your support content and account record within a defined window, keeping only what we are required to, such as billing records for tax. Because export and the guided importer are still being built, ask us and we will help you get your data out.
Read the detail in our data processing agreement
It sets out the controller and processor roles, the categories of data, retention and how we assist with rights requests.