What we hold, and why.

Two sets of people: the business that signs up for Wiredesk (the account owner), and the customers who talk to that business's agent by chat, phone, or email. The account owner is our customer; their customers' data is theirs, and we process it on their instructions.

• Your name and email address, because they are how you sign in.
• A password hash, if you did not sign in with Google or GitHub. We never see the password itself.
• What you configure: your agent's persona, the website and text you train it on, your phone number and handover number, your widget styling.
• Usage counts — answered messages and voice minutes — because that is what we bill on and what your spend cap measures.
• Your Stripe customer id, if you enable billing. Card details go to Stripe and never reach us.

Whatever they say to your agent, and how to reach them back: a phone number on a call, a browser-scoped visitor id on your website, an email address in a thread. Plus anything the agent is configured to collect — a name, a callback number, an order reference.

Voice calls are transcribed, and we store the transcript. We keep the audio only when the business has switched on call recording for its agent. The business is responsible for telling its callers, and can have the agent say so at the start of each call. A recording is deleted with its conversation.

On Cloudflare's network: a D1 database for records, Vectorize for the searchable form of your knowledge base, and R2 for the files you upload — knowledge files, kept so you can download or replace them, and your widget logo. Cloudflare decides which of its data centres holds a given record, and we do not currently offer region pinning. If you need data residency in a specific jurisdiction, tell us before you sign up rather than after.

Only the processors the product needs to work, and only the part each one needs:

• xAI — phone and browser calls, to answer them by voice. Under xAI's API terms, this is not used to train their models.
• Anthropic — conversations, to write the agent's chat and email replies and to summarise each conversation afterwards, and your website's text when you build an agent from it. Under Anthropic's commercial terms, this is not used to train their models.
• Cloudflare — hosting, storage, email delivery, and the embedding model behind knowledge search.
• Telnyx and SignalWire — phone numbers, calls and SMS, if you attach a number.
• Resend — secondary email delivery, if you use the email channel or receive a notification from us.
• Stripe — payments, if you enable billing.
• Firecrawl — your website's public address, when you build an agent from it, to read its colours, fonts and logo for the chat widget.

We do not sell data, and we do not use one customer's conversations to improve another's agent. Your knowledge base is scoped to your agents and is never searched on anyone else's behalf.

Conversations, contacts, leads, and messages the agent took stay until you close your account. Knowledge sources stay until you remove them from the agent. Diagnostic records of inbound calls are dropped after seven days.

Deleting an agent can be undone for 30 days. After that, its knowledge base and the files it was made from, phone number, chat widget and logo, actions, and what it remembered about callers are destroyed for good. The conversations, leads, and messages it handled are your record of talking to your customers, so they stay with your workspace until you close your account.

You can export your conversations, contacts, leads, and collected data as CSV from the app. Closing your account deletes your workspace's records — agents, conversations, contacts, leads, knowledge, and every file you uploaded — releases your phone numbers, and cancels your subscription. Stored files are removed from storage within a few hours.

The app does not yet let you delete one customer's conversations or contact record yourself. If one of your customers asks you to delete what your agent holds about them, send us their phone number or email address through the contact form and we will remove it for you. The notes an agent saved to remember a caller are the exception: an owner or admin can delete those from that person's contact page.

One session cookie, so you stay signed in. No analytics or advertising cookies, and nothing on the marketing pages at all. The chat widget stores a visitor id in the browser it is embedded in so a visitor's conversation survives a page reload; it is scoped to that site and identifies nobody by name.

If we change something material here, we will say so on this page and date it. For anything else — a question, a deletion request, a security review — use the contact form, or read the security overview first.