Privacy Policy

Overview

ScopeHQ ("we," "us," "our") provides software products that integrate with Zendesk and other third-party platforms. This Privacy Policy describes what data we collect, how we use it, and your rights regarding it.

We process customer data on your behalf as a data processor; you remain the data controller.

1. Information We Collect

1.1 Information you provide directly

• Account information — name, work email address, company name, billing details (processed by Stripe — see Section 4).
• Configuration data — Zendesk subdomain, API tokens, Azure DevOps personal access tokens, organization URLs, and field mappings you enter into our admin interfaces.
• Support communications — messages you send to support@scopehq.org.

1.2 Information collected automatically when you use our products

• Operational metadata — IP addresses, user agent strings, timestamps, and event logs that help us diagnose problems and prevent abuse.
• Usage events — counts of API calls, ticket sync events, and feature interactions, used for billing, capacity planning, and product improvement.

1.3 Information from your Zendesk and integrated platforms

• Ticket content — subject, description, comments, attachments, requester email, priority, status, tags, and custom field values for the tickets the agent interacts with through our products.
• Azure DevOps work item data (Bridge only) — work item ID, type, title, state, assignee, area path, iteration, description, comments, attachments, and the custom field used to link work items to Zendesk tickets.
• Account / CRM data (Lens only) — organization fields you map to CSM ownership, renewal date, ARR, and related fields.

2. How We Use Information

• Provide the service — sync tickets and work items between Zendesk and Azure DevOps; index ticket history for similar-ticket retrieval; route notifications.
• Bill you — process subscription payments, calculate overage, and send invoices.
• Communicate — respond to support requests, send service notifications, and deliver transactional messages such as license keys and payment receipts.
• Improve the service — analyze aggregated, de-identified usage to identify bugs, optimize performance, and design new features.
• Comply with the law — respond to lawful requests from authorities and enforce our Terms of Service.

We do not sell your personal information.

3. How We Store and Protect Information

• Encryption in transit — all communication between our products and your systems uses TLS 1.2 or higher.
• Encryption at rest — third-party credentials (personal access tokens, API tokens) are encrypted with AES-256 before being written to our database.
• Access controls — production data is accessible only to a small number of authorized engineers via audit-logged service accounts.
• Hosting — we use Vercel (United States) for application hosting and Supabase (United States) for database hosting. Both are SOC 2 Type II audited.
• Retention — ticket-content snapshots used for retrieval are retained while your subscription is active. Operational logs are retained for 30–90 days. On account deletion, customer-scoped data is removed within 30 days.

4. Third-Party Sub-Processors

We use the following sub-processors to operate the service. A current list is maintained at scopehq.org/subprocessors. We will notify customers of material changes.

5. Your Rights

Subject to applicable law (GDPR, CCPA, and others), you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to processing or request a copy of your data in a portable format.
• Withdraw consent for marketing communications at any time.

To exercise these rights, email privacy@scopehq.org with the subject "Data subject request." We respond within 30 days.

6. Cookies and Tracking

We use first-party cookies for authentication and session management. We do not use advertising or behavioral-tracking cookies. Our marketing site (scopehq.org) may use privacy-respecting analytics — see that site's cookie banner for specifics.

7. Children

Our products are designed for business use. We do not knowingly collect information from children under 13.

8. International Transfers

If you access the service from outside the United States, your data will be transferred to and processed in the US. Where required, we rely on Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland.

9. Changes to This Policy

We will notify customers via email of material changes at least 30 days before they take effect. The latest version is always available at scopehq.org/privacy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: