Transparency

Exactly where your data goes.

The privacy policy is the legal version. This is the engineering version: the exact details, kept current. If this page ever disagrees with what Descalate actually does, treat it as a bug and tell us.

Follow one ticket through the system

Pick a step to see what the data looks like at that moment, and where it lives.

  1. In your browser
  2. Crossing to our servers
  3. Analysis
  4. Storage
  5. Back to you
Your browser
Our API
Fireworks AI
Supabase
Step 1 · You click AnalyzeStill in your browser
Hi, I’m Haruka Tanaka (田中 春香).
Order JP-TEST-804219 still hasn’t arrived.
You can reach me on +81 90 XXXX 1842.
I need it before the 20th.
The raw ticket, exactly as it appears on your screen.

PII redaction coverage

Everything below is stripped in your browser before anything leaves it, and replaced with a placeholder like [REDACTED:name]. Pattern-based redaction will miss novel formats. If you spot one, it goes on the list.

Names5 patterns +
“Hi Sarah” → “Hi [REDACTED:name]”“Thanks, John” → “Thanks, [REDACTED:name]”“I’m Takashi” → “I’m [REDACTED:name]”“Haruka Tanaka (田中 春香)” → “[REDACTED:name] ([REDACTED:name])”Standalone Kanji, Hiragana, Katakana and Hangul sequences
Labeled fields2 patterns +
“Full name — X” → “Full name — [REDACTED:name]”Mobile, DOB, Customer ID, Order #, Case number, Invoice #, Username, Address, Passport, Driver’s license, and around 30 more label variants
Contact info5 patterns +
Email addressesUS phone numbers in standard formatsInternational phones with country codes (+81, +44…)Masked phones (e.g. +81 90 XXXX 1842)Phone extensions
Government identifiers2 patterns +
US Social Security Numbers (XXX-XX-XXXX)Passport, driver’s license, national ID, EIN, VAT (via labeled fields)
Financial info4 patterns +
Card numbers (13–19 digits, all major issuers)“Visa ending in 1234”, “JCB ending with 6832”“Last 4: XXXX”Routing, account, IBAN, SWIFT (via labeled fields)
Dates of birth3 patterns +
“March 14, 1986” → “[REDACTED:date_of_birth]”03/14/1986, 14-03-1986, 1986-03-14Any field labeled DOB / Date of birth / Born on
Reference IDs4 patterns +
Dash-segmented IDs (e.g. JP-TEST-804219)Invoice numbers (INV-xxxx)Case, order and customer IDs (via labeled fields)Any 10+ digit numeric string
Addresses3 patterns +
US street addresses with street-type suffixesJapanese block-style (e.g. 2-4-8 Sample-chō)“Apt. 502” apartment numbers
Postal codes4 patterns +
US ZIP+4 (12345-6789)Canadian (A1A 1A1)Japanese (123-4567)UK postcodes

Sub-processors

The external services your data touches. We review each one at least quarterly and give 30 days’ notice before adding or removing anyone.

Fireworks AIRuns the MiniMax M3.1 Flash model that produces your analysis
fireworks.ai ↗
United StatesTrains on your data: No
What they seeRedacted ticket text and cultural signals detected in your browser
RetentionOperational logs only, not analysis content
Last reviewedNovember 6, 2026
SupabaseDatabase and authentication
supabase.com ↗
United StatesTrains on your data: N/A
What they seeYour account record, usage counter and signal history. Never ticket text.
RetentionUntil you delete your account; signals age out at 24 months
Last reviewedNovember 6, 2026
VercelHosts our API and this site
vercel.com ↗
United StatesTrains on your data: N/A
What they seeTicket text in memory during a single API call, discarded immediately after
Retention30-day operational request logs
Last reviewedNovember 6, 2026
ResendTransactional email (sign-in codes, account notices)
resend.com ↗
United StatesTrains on your data: N/A
What they seeYour email address and account-related message content
Retention90-day delivery logs
Last reviewedNovember 6, 2026

What we store. What we don’t.

We store
✓Sentiment class: calm / concerned / frustrated / angry
✓Escalation signal IDs detected (from a fixed 14-item taxonomy)
✓Overall escalation risk: low / medium / high
✓Response-time band: 15 min / 1 h / 4 h / 24 h / 48 h
✓Inferred customer region (21 regions covered)
✓Agent region from your profile
✓Timestamp of the analysis
✓Platform the ticket came from (currently Zendesk)
We never store
✕The customer’s ticket text, in any form
✕The customer’s name, email, phone or any other PII
✕The analysis reasoning or suggested reply body
✕Your Zendesk credentials or session
✕Anything about tickets you didn’t click Analyze on

Signals age out at 24 months. Operational logs age out at 30 days. You can delete everything about yourself from your account page at any time.

Reserved for later.

Our signals schema includes four columns that are null at launch and will only ever contain a value once you’ve either opted in through a future feature or filled in a future signup step. We disclose them here instead of adding them quietly later. If any of these ever becomes populated for you, we’ll ask first.

reply_actionWhether you copied / modified / ignored the suggested reply. Populated only after you explicitly opt in to outcome sharing via your account page (feature not yet shipped).
outcome_labelWhether the ticket was resolved / escalated / reopened in the days after your analysis. Populated only after you explicitly opt in (feature not yet shipped).
industryThe industry you selected at signup (e.g. SaaS, e-commerce, fintech). Captured so that in the future we can ship industry-specific signal packs. Null for users who signed up before this field existed.
verticalWhich industry-specific signal pack was active on your analysis. Null at launch; will be populated once we ship vertical packs.

Changelog

Every change to a sub-processor, PII coverage, the signal taxonomy or retention gets a dated entry here.

November 8, 2026Added the signals table. Every analysis now writes one row of structured extraction (sentiment class, escalation signal IDs, risk, response-time band, cultural region, timing — never ticket text). Documented in What we store below. Added four reserved columns (reply_action, outcome_label, industry, vertical) that are null at launch and will only be populated after explicit opt-in or a future signup step.
November 6, 2026Published the first transparency page. Set the sub-processor list, PII coverage and signal taxonomy as described above.
Spot something that looks wrong?This page is only useful if it’s accurate. privacy@descalate.app