Privacy Policy | Helmara

1. About this policy

Helmara is an AI business automation platform with six specialist modules: Content Generation, Email Campaigns, Customer Support, Calling Agent, Lead Generation and Paid Ads. This policy covers the public marketing website and, where applicable, information processed through Helmara services.

The product architecture described in Helmara’s Master Proposal is the primary factual source for platform data categories and retention defaults. Verified website behaviour (forms, browser storage and scripts) is stated separately from proposal-specified product processing.

Define when Helmara acts as a controller and when it acts as a processor on behalf of a client (including for leads, recipients, call participants, support-widget visitors and advertising audiences). Confirm the legal entity name, registered address and jurisdiction of incorporation that should appear as the responsible organisation.

2. Information we collect

2.1 Information you provide on the website

The public Contact form currently collects the following fields (verified from the live form implementation):

Full name
Work email
Company name (optional)
Topic / enquiry type
Message

Submissions are sent to Helmara’s contact API for email delivery to the configured contact inbox. A honeypot field is present for spam filtering and is not intended for human input.

2.2 Account and client information (product)

The documented platform design includes processing of account-related information such as user account details, email address, WhatsApp approval number, business/company profile, subscription or module selections, and authentication/session information.

2.3 Information processed through modules (product)

Depending on which specialists a client enables, documented workflows may process:

Content: brand kits, logos, colours, fonts, tone, source uploads, generated content/media, social connections and schedules
Email: mailboxes, lists, validated addresses, campaigns, recipients, email events and suppression/unsubscribe data
Customer Support: knowledge content, website visitor conversations, escalations and related support records
Calling: call targets, scripts, call outcomes, transcripts and, where opted in, recordings
Lead Generation: targeting criteria, sourced/enriched lead records and suppression lists
Paid Ads: connected ad accounts, campaign settings, creatives and performance metrics

2.4 Automatic / technical data on the marketing site

The current static marketing site does not load analytics pixels or set first-party tracking cookies. Browser localStorage is used for theme preference (pp-color-mode). Language is selected via crawlable URLs (/ English, /ar/ Arabic). Pages load Google Fonts and a GSAP animation library from third-party CDNs.

Confirm whether production hosting/CDN or API infrastructure logs IP addresses, user agents or other request metadata, and whether any production analytics or error telemetry will be enabled.

3. How we use information

Documented operational purposes include using information to:

respond to website enquiries
create and manage client accounts
provide selected Helmara modules and workflows
generate requested content and operate campaigns, support, calling, leads and ads features where enabled
deliver approvals and notifications (including via WhatsApp where configured)
connect third-party services chosen by the client
process subscription/billing status and invoices
secure, operate and maintain the platform, including audit records
comply with applicable legal obligations where required

Map each processing purpose to lawful bases for every relevant jurisdiction. Do not publish GDPR/CCPA lawful-basis tables until counsel has confirmed them.

4. AI and automated processing

Helmara workflows may use AI systems for functions such as content generation, support responses, calling-agent conversations, transcription, text or speech generation, intent classification and workflow assistance, depending on the module and configuration.

Personal or business data that appears in prompts, transcripts, knowledge bases, lead records or campaign content may be processed by AI systems to deliver the requested feature. Helmara does not claim that AI providers never process personal data, and does not claim that AI providers never retain data unless that has been contractually verified for the active deployment.

Confirm active AI providers for each production environment and whether any workflow constitutes automated decision-making with legal or similarly significant effects under applicable privacy law.

5. Connected services

Clients may connect third-party accounts to operate modules (for example social, email, calendar, messaging or advertising accounts). Connection mechanisms may use OAuth or provider-specific authentication. Helmara processes information required to operate the connection and the requested workflow; it does not claim unrestricted access to a user’s entire external account.

Connected third-party services process information under their own terms and privacy practices. Their policies are not reproduced here.

6. How information is shared

Information may be shared with:

Service providers needed to host, deliver email, process payments, provide AI/speech/telephony or otherwise operate Helmara
Client-directed integrations that a client chooses to connect
Legal or safety disclosures where required by law or to protect rights and safety, subject to legal review of the final wording

Helmara does not claim that information is never shared with third parties. The architecture relies on external providers.

Finalise the current service-provider / subprocessor list for public disclosure. Confirm whether Helmara sells personal information and whether standard business-transfer language should be included.

7. Payments

The documented architecture delegates payment-card handling to Stripe. Card numbers are not designed to be stored in Helmara’s application infrastructure. Helmara may still retain subscription, invoice, payment-status and related billing information needed to operate the account, and may receive billing events or customer/subscription identifiers from the payment provider.

This describes Stripe delegation of card handling — not a claim that Helmara itself is PCI certified. See also Security & Trust.

8. Data retention

The following defaults come from Helmara’s documented retention specification (Master Proposal D.8). They are product defaults, not marketing estimates.

Data category	Documented default
Client business content / M1 assets	Indefinite while client-owned; deleted on tenant offboard
Email events	13 months rolling
Call transcripts	90 days default (configurable)
Call recordings	30 days; opt-in only; auto-deleted
Ad metrics	24 months
Support conversations	13 months
Invoices	7 years
Audit log	3 years
Leads	Indefinite while client-owned until offboard or DSAR/deletion

Website contact enquiries are emailed to the configured inbox; retention of those mailbox copies depends on the inbox provider and internal mail practices.

Confirm retention for website enquiry emails and any production logs/backups beyond the product schedule above.

9. Data security

Helmara’s documented architecture includes encryption at rest and in transit (TLS 1.2+), tenant isolation, role-based access, managed secret storage for production credentials, approval controls for important outbound actions, and audit logging as a design control. Details are described on the Security & Trust page.

No security measure is perfect. Helmara does not claim absolute security guarantees or unsupported certifications.

10. Your privacy rights

The documented architecture includes per-tenant export and deletion workflows, with a documented 30-day target for data subject requests. Exact rights available to an individual depend on applicable law and on whether Helmara or a Helmara client is the responsible party for that processing.

Finalise rights wording for each relevant jurisdiction (access, correction, deletion, portability, objection, restriction, complaint pathways) and the process/contact channel for submitting requests.

11. International data transfers

Helmara’s architecture references configurable data-region options in the proposal. Transfer mechanisms, residency commitments and cross-border disclosure language require legal confirmation before they can be stated as firm policy.

Confirm international transfer mechanisms (for example SCCs or other lawful tools), production hosting regions and any residency commitments that may be offered to clients.

12. Cookies and website technologies

On the current public marketing site (verified from implementation):

No first-party tracking cookies are set by the static pages
No analytics or advertising pixels are loaded by the static pages
localStorage stores theme preference (pp-color-mode)
Language is selected via crawlable URLs (/ English, /ar/ Arabic), not browser storage
Google Fonts and GSAP are loaded from third-party CDNs

See the dedicated Cookie Policy for the verified browser-technology inventory.

13. Children’s privacy

Confirm minimum user age and children’s privacy position. Do not publish an invented under-13 or under-18 statement until the business decides.

14. Changes to this policy

When this policy is finalised, material updates will be reflected on this page with a revised “Last updated” date. Additional notice methods (email or in-product) remain subject to legal review.

15. Contact us

For product or website enquiries, use the Contact form.

Insert the privacy contact email, postal address, Data Protection Officer (if any), and EU/UK representative details (if applicable) once confirmed. Until then, privacy-specific requests should not rely on an unpublished dedicated privacy mailbox. Related contractual terms are drafted separately in the Terms of Service.