Version 1.0. Effective date: 3 September 2026.
In plain English
- We are a British Columbia, Canada company. Canadian privacy law applies to us.
- We collect the details you give us to run your account, billing details (your card goes to Stripe, not to us), records of what your account accessed, and technical logs including IP addresses.
- We use no advertising trackers and no analytics cookies. There is one sign-in cookie, and a bot check on our forms.
- Our systems run in the United States, on providers we name below.
- Datasets you upload are stored for you. We can technically access their contents, and we do so only to operate, secure and support the service or when the law requires it. We never send them to any AI service.
- If you contact us about Helix, we may use an AI model to research your company and help us reply. It receives your enquiry, not your account and not your datasets.
- We do not sell personal information.
- Wherever you are, you can ask to see, correct, delete or export your information and opt out of marketing. Write to contact@helix.tools.
1. Who we are
The Helix service is operated by Helix Systems Inc., a British Columbia company, doing business as "Helix" ("Helix", "we", "us"). Canadian privacy law applies to us. We have not appointed a Data Protection Officer or an EU representative; privacy questions and requests are handled by our privacy officer at contact@helix.tools.
2. Who this policy is for
This policy covers personal information about visitors to helix.tools, people who contact us, and the people who use the Helix portal, API, SDKs and MCP server on behalf of a customer.
It does not govern personal information that may be inside a dataset a customer uploads. The customer who uploads a dataset is responsible for it; we store and transfer it on that customer's instructions (section 4). Questions about such data go to that customer.
3. What we collect
Account and contact details. Your name, work email, company, role and phone number; your company's billing address; and, if you invite colleagues, their names and email addresses.
Billing. Stripe collects and holds your card details. We hold only Stripe identifiers and your payment status.
Usage and access records. Which datasets your account listed, uploaded, accessed or downloaded, when, and how much data moved. We use these for billing, security, and the audit trail that producers and consumers rely on.
Technical data. IP address, browser and device information, request logs, error reports, and — from our SDKs and tools — the SDK version and the outcome of each upload or download.
Communications and enquiries. Emails and support messages you send us; what you enter in our contact form, including how you reached our site; and whether an email we sent you was opened or clicked.
Datasets. The contents of datasets customers upload, held for those customers.
4. Datasets
Datasets are stored in dedicated, isolated storage for each producer, encrypted in transit and at rest. We hold the encryption keys, so we can technically access dataset contents. We do not access, use or disclose them except to operate, secure and troubleshoot the service, to provide support a customer asks for, to investigate abuse, when the law requires it, or with the customer's permission. We never use dataset contents for our own purposes.
We do not send dataset contents to any AI model or AI service, and we do not use them to train, tune or improve any AI model. If we ever offer a feature that applies AI to a customer's datasets, it will be off unless that customer turns it on, and we will describe what it does and where the data goes before they do.
5. Cookies and similar technologies
We set one cookie to keep you signed in to the portal; it expires after 24 hours. Our developer documentation sets a short-lived cookie to keep you signed in there. Our forms use Cloudflare Turnstile to block bots; Cloudflare may collect device and network information for that purpose under Cloudflare's own privacy policy. We use no analytics, advertising or social-media trackers, and no cookie other than these. Because of that, we show no cookie banner.
6. How we use personal information
- To provide the service, sign you in, and run your account.
- To bill you and pay producers.
- To keep the service secure, detect abuse, and keep audit records.
- To answer your questions and support you.
- To send you service messages about your account, billing and changes to the service.
- To tell you about Helix if you are a customer or have asked us about Helix. You can opt out at any time (section 11).
- To research and answer enquiries. If you contact us about Helix, we may use an AI model to research your company from public sources, including its website, and to help us decide how to reply. The model receives your name, role, company, country, the website or LinkedIn address on your enquiry, and the message you sent. It does not receive your email address, your account data or any dataset. Its output is for our staff; it does not contact you itself, and no decision with a legal or similar effect on you is made this way.
- To create marketing material. We use AI tools to draft marketing images and copy. They receive the prompts we write, and we do not put your personal information or dataset contents in them.
- To improve the service.
- To meet our legal obligations.
7. Who we share it with
Service providers who process personal information for us, under our instructions:
- Amazon Web Services (hosting, storage, email delivery, and — through Amazon Bedrock — the AI model used to research enquiries) — United States.
- MongoDB Atlas (database) — United States.
- Redis Cloud (short-lived sign-in tokens and rate limiting) — United States.
- Stripe (payments and payouts).
- Cloudflare (bot protection on forms).
We also use AI services from OpenAI, Google, Hugging Face and Anthropic to create marketing images and copy. They receive only the prompts we write, and no personal information about you.
Other users of the service. A producer sees the company names of the consumers that access its datasets; a consumer sees the company name of each producer whose dataset it accesses. Billing details are never shared between users.
When the law requires it, or to protect our rights, our users, or the public.
If the business changes hands, personal information may transfer to the successor, who must honour this policy.
We do not sell personal information, and we do not share it for advertising.
8. Where your information is stored
We are a Canadian company, and our providers store and process personal information in the United States. By using the service you understand that your information is transferred to, stored in and processed in the United States, where it may be accessible to authorities under that country's laws.
9. How long we keep it
| Information | How long |
|---|---|
| Sign-in links | 15 minutes |
| Portal sign-in session | 24 hours |
| Your account and contact details | While your account is open. After it closes, we remove or redact them from your account record. |
| Datasets and dedicated storage | Until you delete them, or until your account closes. After the 14-day grace period that follows a cancellation, we close the account and destroy your dedicated storage and datasets; destruction follows the archiving of the final account summary, so it may complete some days after the grace period ends. |
| Request and security logs (including IP addresses) | About 400 days |
| Activity records | 365 days |
| Billing, usage and access records; the audit archive | At least 7 years |
| Contact enquiries and correspondence | Until no longer needed, or until you ask us to delete them |
| Research on an enquiry produced by the AI model | 30 days |
| Database backups | Rolling backups that expire within 12 months |
We may keep information longer where the law requires it or where it is needed for a dispute.
10. Security
We use reasonable technical and organisational measures to protect personal information, including encryption in transit and at rest, isolated storage for each producer, access controls, and logging of privileged access. No system is perfectly secure, and we cannot guarantee that a breach will never occur. If a breach creates a real risk of significant harm to you, we will tell you and the authorities as the law requires.
11. Your rights, wherever you are
You can ask us to:
- Show you the personal information we hold about you.
- Correct anything inaccurate.
- Delete your personal information, subject to the records we must keep (section 9).
- Export your information. You can download your own datasets from the portal at any time while your account is open, and we will give you a copy of your account information on request.
- Stop marketing. Every marketing email we send says who sent it and how to stop. Reply to it, or write to us, and we will stop within ten business days. Messages about your account, billing and changes to the service are not marketing and continue while your account is open.
- Withdraw consent where our use of your information relies on it.
Write to contact@helix.tools. We may ask you to verify your identity. We will respond within 30 days. If you are not satisfied, you may complain to the Office of the Information and Privacy Commissioner for British Columbia or to the Office of the Privacy Commissioner of Canada. If a privacy law in your country gives you further rights, we will honour those that apply to us.
12. Children
The service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe we have, tell us and we will delete it.
13. Changes to this policy
For a material change we will give at least 30 days' notice by email to your account address. The current version is always at helix.tools/privacy.html.
14. Contact
Helix Systems Inc., doing business as Helix Vancouver, British Columbia, Canada contact@helix.tools · https://helix.tools