What we hold, and why.

Two sets of people: the business that signs up for WireDesk (the account owner), and the customers who talk to that business's agent by chat, phone, or email. The account owner is our customer; their customers' data is theirs, and we process it on their instructions.

• Your name and email address, because they are how you sign in.
• A password hash, if you did not sign in with Google or GitHub. We never see the password itself.
• What you configure: your agent's persona, the website and text you train it on, your phone number and handover number, your widget styling.
• Usage counts — answered messages and voice minutes — because that is what we bill on and what your spend cap measures.
• Your Stripe customer id, if you enable billing. Card details go to Stripe and never reach us.

Whatever they say to your agent, and how to reach them back: a phone number on a call, a browser-scoped visitor id on your website, an email address in a thread. Plus anything the agent is configured to collect — a name, a callback number, an order reference.

Voice calls are transcribed. We store the transcript, not the audio. There is no recording to retrieve, subpoena, or lose.

On Cloudflare's network: a D1 database for records, Vectorize for the searchable form of your knowledge base. Cloudflare decides which of its data centres holds a given record, and we do not currently offer region pinning. If you need data residency in a specific jurisdiction, tell us before you sign up rather than after.

Only the processors the product needs to work, and only the part each one needs:

• xAI — the conversation, to generate a reply. Under xAI's API terms, this is not used to train their models.
• Cloudflare — hosting, storage, and the embedding model behind knowledge search.
• SignalWire — phone numbers and SMS, if you attach a number.
• Resend — email delivery, if you use the email channel or receive a notification from us.
• Stripe — payments, if you enable billing.

We do not sell data, and we do not use one customer's conversations to improve another's agent. Your knowledge base is scoped to your agents and is never searched on anyone else's behalf.

Conversations, contacts, and collected data stay until you delete them or close your account. Diagnostic records of inbound calls are dropped after seven days. Deleting an agent takes its knowledge base, transcripts, and collected data with it; that is not reversible.

You can export your conversations, contacts, and collected data as CSV from the app, and delete any of it. Closing your account removes your records, releases your phone numbers, and cancels your subscription.

If one of your customers asks you to delete what your agent holds about them, you can do it yourself from the Contacts page — you do not need to ask us, and you should not have to wait on us.

One session cookie, so you stay signed in. No analytics or advertising cookies, and nothing on the marketing pages at all. The chat widget stores a visitor id in the browser it is embedded in so a visitor's conversation survives a page reload; it is scoped to that site and identifies nobody by name.

If we change something material here, we will say so on this page and date it. For anything else — a question, a deletion request, a security review — use the contact form, or read the security overview first.