Privacy Policy DRAFT

2. What Data We Collect

Helix AI is designed with a minimal-data philosophy. We do not maintain a copy of your core business or transactional records. Specifically, we collect and store the following on your behalf:

• Artifacts generated during your Helix sessions (e.g., outputs, summaries, generated content)
• Custom code, scripts, and configuration files associated with your Helix environment — including copies of your automations and related source files, which we maintain in version control so that Helix can read, modify, deploy, and track changes to them on your behalf
• Screenshots of demos or sessions, where explicitly captured
• Reports produced by Helix on your behalf
• Account and authentication data necessary to operate your Helix account, such as your name, email, organization, and Helix login credentials

We do not maintain a standing copy of your underlying business-system data (e.g., financial records, vendor data, or transaction histories); Helix accesses such data only as transiently required to execute a task you initiate. Outputs we generate and store for you (such as reports and screenshots) may include specific values from your business data.

3. How We Use Your Data

Data collected by Helix AI is used for the following purposes:

• To operate and deliver the Helix AI service to you
• To store session artifacts, reports, code, and customizations on your behalf so they are accessible across sessions
• To provide technical support and troubleshoot issues
• To communicate with you about your account, updates, or Early Access program participation

We do not use your data to train Helix AI or any proprietary machine-learning model of our own. Additional practices specific to the Early Access Program are described in Section 7.

4. Data We Do Not Sell or Use for Training

To be explicit:

• Your data is not used to train AI models. We do not train our own models on your data, and we work only with AI providers under commercial terms that prohibit them from using your data to train their models. We take reasonable steps to ensure these protections are upheld.
• We do not sell, license, or share your data with third-party advertisers or data brokers
• We do not build user profiles for commercial purposes beyond service delivery

5. Data Storage and Security

All data stored on your behalf is held on third-party infrastructure that meets recognized enterprise-grade security standards. We select providers based on:

• SOC 2 compliance or equivalent certification
• Encryption at rest and in transit
• Industry-standard access controls

Sensitive credentials (such as authentication keys and access tokens for the systems you connect) are encrypted at rest.

We acknowledge that, as with any hosted SaaS provider, Helix engineering staff may access stored data to service your account, debug, or resolve support issues. We operate under strict internal access controls and confidentiality obligations.

6. Data Retention

We retain your stored data (artifacts, reports, code, customizations, screenshots) for as long as your account is active or as needed to provide services. You may request transfer or deletion of your data at any time.

• Data transfer: We will export your stored artifacts, reports, and code in a portable format upon request
• Data deletion: We will delete all stored data associated with your account — including copies of your code we maintain in version control — upon written request, within 30 days

To make a data request, contact us at: support@gethelix.ai

7. Early Access Program

If you are participating in the Helix AI Early Access Program, you are engaging in a collaborative product development process. As an Early Access participant:

• Your feedback, feature requests, and reported issues will directly influence product development
• Product interactions may be reviewed by the Helix team to improve the service
• This feedback loop is distinct from model training — your operational business data is not used to train AI models we own

We will communicate clearly if any additional data collection practices apply during the Early Access phase.

8. Service Providers and Third Parties

Helix integrates with the third-party platforms your business runs on — such as your business-management, file-storage, and operational systems — and acts within them on your behalf, with your authorization.

To operate the service, Helix also relies on third-party providers — including cloud hosting and compute, data storage, source-code hosting, and AI/inference providers — that process data on our behalf to deliver the service. We select them based on the standards in Section 5 and do not authorize them to use your data for any purpose other than providing their services to us.

9. Your Rights

You have the following rights with respect to your data held by Helix AI:

• Access: Request a summary of data stored on your behalf
• Portability: Request an export of your stored artifacts, reports, and code
• Deletion: Request permanent deletion of all your stored data
• Correction: Request correction of inaccurate account information

To exercise any of these rights, contact us at support@gethelix.ai. We will respond within 30 days.

10. Changes to This Policy

We may update this Privacy Policy as Helix AI evolves. We will notify active users of material changes by email or in-product notification. The effective date at the top of this document reflects the date of the most recent revision.

Continued use of Helix AI after a policy update constitutes acceptance of the revised terms.

11. Contact Us

For questions, data requests, or privacy concerns:

Helix AI

Email: support@gethelix.ai

Website: helixsmb.ai