Who this policy is for
Ebeba is a customer-support platform. Companies (“tenants”) use it to receive and answer support requests from their own users. This policy explains what Ebeba does with personal data in two very different situations, and it matters which one applies to you.
If you are a tenant — someone whose company uses Ebeba, or who logs into an Ebeba agent account — Ebeba is the controller of your account data, and this policy describes how we handle it.
If you contacted a company’s support team and reached Ebeba — you are an end user. The company you contacted decides what data is collected and why. Ebeba only processes it on that company’s instructions, as its processor. This policy tells you what we do technically, but the company you contacted is who you should approach to access or delete your data. We will refer such requests to them rather than acting on them ourselves.
Ebeba is operated by Tap Slots, Inc., a Delaware corporation doing business as Ebeba, with its principal place of business at 7745 Spanish Lake Dr, Las Vegas, Clark County, NV 89113, USA.
What we collect
Tenant and agent account data
Names, display names, email addresses, hashed passwords, profile images, notification preferences, and records of activity within the platform such as which agent replied to which conversation and when. We need this to operate accounts, authenticate logins, route conversations, and keep an audit trail of who did what.
Support conversation content
Messages, attachments, and any personal data an end user includes in them. We do not choose what this contains — end users write it, and tenants decide what to ask for. Conversations may also carry an identifier supplied by the tenant’s application (for example an in-game player id) so agents can tell whose account they are looking at.
Technical data
IP addresses, browser and device information, timestamps, and server logs. These exist to operate and secure the service — diagnosing faults, detecting abuse, and preventing unauthorised access.
What we do not collect or do
We think these are clearer stated outright than left to be inferred.
- We do not sell personal data.
- We do not use support conversation content to train machine learning models.
- We do not read tenants’ support conversations except where it is necessary to operate the service, investigate a fault, or respond to a request from that tenant.
- We do not use conversation content for advertising, and we do not run advertising on the platform.
- We do not combine one tenant’s data with another’s.
Legal bases
Where the GDPR or UK GDPR applies and Ebeba acts as controller (tenant account data), we rely on performance of a contract for operating your account, legitimate interests for securing the service and preventing abuse, and consent where we ask for it. Where Ebeba acts as processor (support conversation content), the tenant is responsible for establishing a legal basis, and we act only on their documented instructions.
Cookies and similar technologies
Ebeba uses cookies and equivalent browser storage in two distinct places, and they serve different purposes.
The agent dashboard uses them to keep agents signed in and to remember interface preferences between sessions. These are necessary for the dashboard to function; without them an agent would be signed out on every page load.
The embedded support widget, when a tenant places it in their own application or website, uses browser storage to associate a person with their ongoing conversation, so a reply is delivered to the same thread rather than starting a new one each time.
What the support widget stores, in full:
- A conversation token, in a cookie — so a reply reaches your existing thread instead of starting a new one each time.
- A note that your details have already been sent, in a cookie — so they are not sent again on every page load.
- A short-lived copy of which agents are available, in browser local storage with a timestamp — so the widget does not have to ask repeatedly while you have it open.
That is the complete list, and every item is necessary for the widget to function. We set no third-party cookies, use none of this for advertising or cross-site tracking, and share none of it with anyone. Because the widget is embedded by the tenant into their own product, the tenant is responsible for any consent notice their own users see.
Sub-processors
We use the following third parties to operate the service. They process personal data only to provide their part of it.
- Amazon Web Services — hosting for the application and its database. United States (us-east-2, Ohio).
- Amazon Web Services (S3) — file attachments sent in support conversations, stored encrypted (United States, us-east-2), and encrypted database backups (United States, us-west-2, Oregon).
- SparkPost — delivery of outbound email, including agent replies and notifications. United States.
- Cloudflare — DNS, and inbound email routing for support addresses, which means support email passes through Cloudflare on its way to us.
We do not use analytics, advertising, error-reporting or AI services that would receive support conversation content. There are none configured.
We will update this list before adding a sub-processor.
International transfers
Ebeba processes personal data in the United States. If you are in the UK or EEA, using the service means your data is transferred outside your jurisdiction.
Our sub-processors each provide their own safeguards for such transfers, including the European Commission’s standard contractual clauses. If you need a transfer agreement with us directly, contact us and we will put one in place.
Retention
We keep tenant account data and support conversations for as long as the subscription is active. We do not expire or delete them on a schedule, and there is no retention tier that shortens this on a cheaper plan — support history stays available for as long as you are a customer.
A tenant may ask us to delete specific conversations or contacts at any time, and we will act on that request. For 30 days after a subscription ends you may export your data; after that we may delete it.
Backups are kept on a rolling schedule and are overwritten in turn, so data deleted from the live service may persist in a backup for a short period before it ages out.
Security
Access to the platform requires authentication. Traffic is encrypted in transit with TLS. Backups are encrypted and access to production systems is limited to those who need it. No service can promise perfect security, and we do not.
Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to it.
Tenants and agents may exercise these rights against Ebeba directly, using the contact details below.
End users should contact the company whose support team they wrote to. That company decides what happens to the data, and we act on their instructions. If you approach us directly, we will pass the request to the relevant tenant.
If you live in a US state with its own privacy law, such as California, you may have rights to know what personal data we hold, to have it deleted, and to correct it — and a right not to be discriminated against for exercising them. We do not sell personal data and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.
Children
Ebeba is a business tool and is not directed at children. We do not knowingly collect personal data from children through tenant or agent accounts. Support conversations may originate from a tenant’s own users, whose age is the tenant’s responsibility to assess.
Changes
We will update this policy as the service changes, and will record the effective date at the top of the page when it comes into force.
Contact
For anything in this policy, including a request about your own data, email support@ebeba.com.
If you reached a company’s support team through Ebeba and want your data accessed or deleted, contact that company rather than us — they decide what happens to it, and we act on their instructions.