Privacy Policy

1. Introduction

Hostao LLC ("we", "our", "us") operates Suhep, a SaaS platform offering AI-powered knowledge base, ticketing, and live chat tools available at suhep.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using Suhep, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, password (hashed), company name, and account preferences when you register.
• Support Tickets: Content of tickets you submit, including descriptions, attachments, and correspondence with our support team.
• Chat Messages: Conversation history with the Suhep AI chatbot and human agents.
• Usage Analytics: Page views, session duration, feature interactions, browser type, operating system, IP address, and referral URLs.
• Cookies and Tracking: Essential session cookies, authentication tokens, and optional analytics cookies (see Cookie Policy).
• Payment Information: Billing details are collected and processed by our payment processor. We do not store full card numbers.
• Communications: Emails, support messages, and feedback you send to us.

3. How We Use Your Information

• Provide, operate, and improve the Suhep Service
• Process and respond to support tickets and inquiries
• Authenticate users and maintain account security
• Send transactional emails (account confirmation, password reset, ticket updates)
• Analyze usage patterns to improve product features
• Comply with legal obligations
• Detect, prevent, and investigate fraud or abuse
• Send service announcements (we do not sell your data for advertising)

4. Third-Party Service Providers

We share data with trusted sub-processors only to the extent necessary to deliver the Service:

• Application infrastructure: Hosting, database, authentication, and service delivery
• Communications providers: Email, WhatsApp, and notification delivery where enabled
• Payment processor: Billing and subscription management when a paid arrangement is active

All sub-processors are contractually obligated to process data only for specified purposes and maintain appropriate security measures. A full list is available in our Data Processing Agreement.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until account deletion + 30 days
• Support tickets: 24 months from resolution
• Chat logs: 12 months
• Usage analytics: 24 months (anonymized after 6 months)
• Payment records: 7 years (legal/tax requirements)

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

GDPR (EU/EEA users)

• Right of access, rectification, erasure ("right to be forgotten")
• Right to data portability and restriction of processing
• Right to object and withdraw consent
• Right to lodge a complaint with your local supervisory authority

CCPA (California users)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt out of sale of personal information (we do not sell data)
• Right to non-discrimination

India DPDPA 2023

• Right to access information about processing of your personal data
• Right to correction and erasure
• Right to grievance redressal (see Grievance Officer below)
• Right to nominate a representative

To exercise any of these rights, email us at privacy@suhep.com. We will respond within 30 days (or as required by applicable law).

7. Data Security

We implement reasonable security measures including TLS encryption in transit, access controls, least-privilege operational access, monitoring, and abuse-prevention controls. No system is 100% secure; in the event of a breach, we will notify affected users within 72 hours where required by applicable law.

8. International Data Transfers

Suhep is operated from the United States. If you are located in the EU, EEA, UK, or India, your data may be transferred to and processed in the United States. For EU transfers, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

9. Children's Privacy

Suhep is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacy@suhep.com and we will delete it promptly.

10. Grievance Officer

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 30 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance.