Privacy Policy

Helmior Ltd (“Helmior”, “we”, “us”) provides Helmior, an AI coordinator that works inside a team’s group chat and keeps records of their work in a dashboard (the “Service”). This policy explains how we handle personal data when you visit helmior.com, use the dashboard, or take part in a chat where Helmior has been added.

Questions about this policy or your data can be sent to privacy@helmior.com.

For account, billing and website data, Helmior is the controller: we decide why and how that data is used.

For workspace content — the records, pipelines, notes, attachments and chat messages a business puts into Helmior — the business that holds the Helmior account (the “Customer”) is the controller, and Helmior processes that data on its behalf and on its instructions. If you are a member of a chat or a person named in a record and want to exercise your rights over that content, contact the business that uses Helmior; we will help them respond.

Account data. Your name, email address, the organisation you belong to and your role in it. If you sign in with a chat app — Slack, Microsoft Teams or Google Chat — we receive your name, an account identifier and, where the app shares it, your email address — never your password. If you connect WhatsApp or Telegram to chat with Helmior, we keep the account identifier that app gives us, which on WhatsApp is your phone number.

Chat data. Helmior acts only on messages that mention it and on the start phrase a Customer chooses for new records. From those messages we keep the text, the time it was sent, and the sender’s chat account identifier and display name. When a Customer connects a chat, Helmior may also note who is a member of that chat, so newcomers can be approved before their messages move anything. Other messages in the chat are not stored.

Workspace content. Everything a Customer’s team creates or confirms: records and their fields, stages, assignments, notes, attachments, and the activity history of every change — who made it, when, and the words that caused it.

Integration data. When a Customer connects a service such as Slack, Microsoft Teams, Google Chat, Telegram, WhatsApp, Google Sheets, Gmail or Meta lead ads, we store the credentials needed to use that connection and the data it delivers — for example, the answers a person submits on a Meta lead form.

Google account data. If a user connects Google features, Helmior receives the Google account email address and keeps the OAuth credential needed to make the approved API calls. The data each feature can access is described in Google Workspace API data and AI usage below.

Technical data. IP address, browser and device information, request logs and error logs, used to run and secure the Service.

Billing data. Plan, trial status, usage and invoices. Card details, where used, are handled by our payment provider and are not stored by us.

Correspondence. What you send us when you email us or book a walkthrough.

• To provide the Service — reading the messages addressed to Helmior, proposing changes, saving what a person confirms, and showing it in the dashboard. Basis: performance of our contract with the Customer.
• To sign you in and keep your account secure — access controls, abuse prevention and audit history. Basis: contract and legitimate interests in security.
• To support, maintain and improve the Service — diagnosing errors and monitoring the quality of AI responses. Basis: legitimate interests.
• To communicate with you — invitations, service notices and replies to your enquiries. Basis: contract and legitimate interests.
• To bill and to meet legal obligations — invoicing, tax and accounting records, and responding to lawful requests. Basis: contract and legal obligation.

We do not sell personal data, we do not use it for advertising, and we do not use workspace content to train AI models.

To understand a message and draft a reply, Helmior sends the message and the context needed to interpret it to a third-party AI model provider. We use providers’ business services, under terms that do not permit them to train their models on the data we send.

AI requests and responses are logged so we can investigate errors and misunderstandings. Access to those logs is restricted to the staff who need it.

The AI proposes; it does not decide. Nothing it suggests is saved until a person confirms it. Helmior does not make decisions about people that have legal or similarly significant effects.

Helmior uses data obtained through Google Workspace APIs solely to provide user-facing productivity, workflow automation and coordination features requested by users. Google features are optional and are connected through Google’s consent screen. Each feature uses the permissions it needs:

• Google account identity: the email address of the connected account, to identify it in Settings and match related Google connections.
• Gmail: permission to send messages from the connected account. Helmior does not read inbox messages or search mail. It may send a message and attachments after the user reviews and confirms the draft; sent-message details may be kept with the related workspace record.
• Google Sheets: permission to read or update a spreadsheet the user selects or links to a workflow. Helmior does not list the user’s Drive files. Relevant cell values may be used to answer a request or carry out a requested update.
• Google Docs and Drive: permission to create and manage files Helmior creates, and to read a document when a user provides its link. Helmior cannot browse or list the user’s Drive. A created or updated file remains in the user’s Google Drive; its content may also be saved in a Helmior record when the user asks Helmior to keep it there.
• Google Meet and Calendar: permission to create and manage events Helmior creates on the connected calendar, and to read transcript entries for eligible meetings. When a transcript is available for a meeting attached to a workflow record, Helmior creates a summary and stores the summary and transcript with that record’s notes and activity history.

Limited Use compliance. Helmior does not use Google Workspace API data, including raw data or data derived from it, to develop, train, retrain or improve generalized or non-personalized artificial intelligence or machine learning models.

When a requested feature uses AI, Helmior sends the AI provider only the request and relevant context needed for that feature. Depending on the request, this can include selected spreadsheet values, linked document text, a meeting transcript, or related workflow records. The Google OAuth credential is not included. AI providers process this information to return the requested result, subject to their business service terms and applicable data protection requirements. Helmior does not permit these providers to use Google Workspace API data to train generalized models.

For service monitoring and troubleshooting, AI prompts and responses may also be sent to a service provider that helps us monitor the Service, together with usage information and account details such as the user’s name, email and workspace. These logs can therefore contain Google Workspace data included in the AI request or response. They are kept for a limited period, and access is restricted to staff who need it for support and operations.

Helmior protects Google Workspace data against unauthorized access and handles it in accordance with this Privacy Policy and Google’s API Services User Data Policy. Google Workspace data is not sold or used for advertising.

We share personal data only with service providers who process it on our behalf, under written agreements that require them to protect it:

• Hosting and infrastructure providers — run our servers, database, website delivery and file storage.
• AI model providers — receive prompts and the relevant content needed to provide the requested AI feature, as described above.
• Monitoring providers — receive AI prompts, responses, usage details and account details so we can find and fix problems.
• Email delivery and payment providers — sending service email and taking payment.
• Google — receives API requests made with the permissions you approve, and provides the requested account, spreadsheet, document, email or meeting service.
• Microsoft — receives sign-in requests only if you choose to sign in with Microsoft.

The chat platforms and other services a Customer connects (for example Telegram, Slack or Meta) are not our processors: data moves between them and Helmior because the Customer connected them, and each handles data under its own privacy policy.

We may also disclose data where the law requires it, to protect the rights and safety of our users or the public, or to a successor as part of a merger or acquisition, in which case this policy will continue to apply.

We and our service providers may process data in countries other than the one you live in, including India, the United States and the European Union.

Where personal data from the UK, the European Economic Area or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Workspace content is kept for as long as the Customer’s account is active. When a person or record is deleted, it can be restored for 30 days and is then permanently removed. The activity history is kept for the life of the account.
• Google connections are removed when disconnected, including the stored OAuth credential and account link. Disconnecting stops future API access; it does not by itself delete content already saved to a Helmior record, sent email, or monitoring logs.
• Google data saved in workspace content, including sent-message details and meeting summaries or transcripts, follows the workspace-content retention and deletion periods above. Google files created by Helmior remain in Google Drive until the user deletes them there.
• After an account closes, workspace content is deleted within 90 days, unless the Customer asks us to delete it sooner.
• Backups are overwritten on a rolling basis.
• Logs are kept for a limited period for security and debugging, then deleted.
• Billing records are kept for as long as tax and accounting law requires.

We take measures appropriate to the data we hold, including:

• encryption of data in transit;
• keeping each Customer’s data separate from every other’s;
• permission checks on changes;
• access controls, and restricted staff access.

No system is perfectly secure. If we become aware of a breach that affects your personal data, we will notify the affected Customers and, where required, the relevant authorities without undue delay.

This website (helmior.com) sets no cookies and runs no analytics or advertising trackers.

The dashboard uses only strictly necessary cookies, to keep you signed in and to protect sign-in when you connect an integration. Because they are essential, they do not require consent.

Depending on where you live — including under the UK and EU GDPR, India’s Digital Personal Data Protection Act, and US state privacy laws — you may have the right to:

• access the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent, where processing is based on consent;
• complain to a data protection authority, such as the UK Information Commissioner’s Office or your local regulator.

To exercise a right over your account data, email privacy@helmior.com. For workspace content, contact the business that uses Helmior (see section 2). We will respond within the time the law requires, usually one month, and may need to verify your identity first. We will not discriminate against you for exercising a right.

Helmior is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@helmior.com and we will delete it.

We may update this policy as the Service changes. The date at the top shows when it was last revised. If a change materially affects how we use personal data, we will tell account admins by email or in the dashboard before it takes effect.

Helmior Ltd — privacy@helmior.com. If you are not satisfied with our response, you may contact your local data protection authority.