HelmsteadHelmstead

Privacy policy

Version
1.2
Effective date
Choose version

You’re viewing an older version of this document

View current version
All legal docs
Table of contents

We’re Suverenum Inc. Helmstead is our product name. It helps businesses work with treasury and accounting data through workbooks and an AI assistant.

Our main domain is helmstead.co. This policy covers it and all its subdomains, including app.helmstead.co, plus related business communications.

We may also use suverenum.ai, opentreasury.app, goldhord.xyz, helmsteadhq.com, helmsteadlabs.com, helmsteadteam.com, or their subdomains to run or support Helmstead’s technical services. The same policy applies when we use those domains for that purpose.

“Personal information” means information that identifies you or can be linked to you. This policy applies even if you’ve never used Helmstead. For example, a customer might upload an invoice or workbook that names you.

Email privacy@helmstead.co with questions, requests, or complaints. You don’t need an account. Tell us what you need and your connection to Helmstead, if known. Please don’t send passwords, access tokens, or full financial documents initially.

You can also write to Suverenum Inc. at 2261 Market Street STE 77991, San Francisco, CA, 94114 US.

Depending on the law and how your information is used, you may be able to:

  • Find out what information is held about you and get a copy
  • Correct mistakes or ask for information to be deleted
  • Ask for certain uses to stop or be restricted
  • Withdraw consent or opt out of certain advertising uses
  • Complain or challenge a decision about your request

If we hold information for an organization, such as your employer, we’ll help identify it, route your request, and assist with its authorized instructions. We’ll handle requests about our own uses ourselves. A request can involve both.

If we need to check your identity or authority to act, we’ll ask only for information needed for that check. These checks won’t restart the legal response deadline or leave your request on hold indefinitely. Copies we provide will exclude secrets and protect other people’s rights. If an exception limits your request, we’ll explain why and how to challenge the decision.

Read more about your regional rights, AI, cookies and marketing, and deletion.

Our customers are organizations using Helmstead, such as your employer or another business holding information about you.

“Customer Content” means the records they provide or connect, including resulting workbooks, edit history, conversations, and AI results.

  • A controller decides why and how personal information is used. We act in this role for our own contacts, prospect research and outreach, account administration, marketing, and service activity used for operations and analytics.
  • A processor handles information on a controller’s behalf. We normally act in this role when handling Customer Content on an organization’s instructions.
  • A subprocessor handles information for another processor. This can be our role when a customer handles information for another organization.

Our role depends on the actual use. US “service provider” rules also depend on the activity and required contract terms.

When we handle Customer Content for an organization, its documented instructions, our customer terms, and any agreed data processing addendum govern that work. We will put the processing terms required by applicable law in place, including confidentiality, security, assistance with rights, and obligations for providers processing information on our behalf. We will process Customer Content only on documented instructions or as required by law.

This privacy policy explains our handling of personal information. It is not a customer contract or permission to use Customer Content for new purposes.

What other users or administrators can see depends on their permissions and the feature. Ask the customer organization about access to shared records, workbooks, and conversations.

What we receive depends on the features and connections enabled, their permissions, and what customers provide. Not every category applies to every person.

We receive names, work emails, profile and sign-in details from Microsoft or Google, organization membership, and roles. Connection records include permissions and access tokens, which let services connect to each other.

We use these records to manage accounts and access. Without information needed for sign-in or a connected feature, that feature may not work.

We receive:

  • Accounting entries, transactions, invoices, and customer, supplier, or other business contact details from customer-provided material or connected systems
  • Employment and payroll records, including pay, deductions, and tax details, from customer-provided material or connected systems
  • Sensitive financial and identity information in source records, including employee Social Security numbers or other national or tax identifiers, vendor tax identifiers, and bank account and routing details
  • Uploaded files and workbooks, including previous versions and edit history
  • Messages and attachments from connected email accounts
  • File contents and details about files (metadata), including file names, authors, and site, library, or drive names, from connected storage services and shared files

We use this material on the customer’s instructions to organize records, find requested information, maintain workbooks and history, and support its accounting and financial analysis. It may name employees, contractors, suppliers, customers, or correspondents. These records are Customer Content and are never used for advertising.

These file details can identify people or reveal information about their work even when we don’t open the file’s contents. See connected services for each connection’s scope and access controls.

The customer must properly authorize connections. Its permission is not consent from everyone named in the records. Uploaded or connected material may also include health information, protected characteristics, biometric information, or other specially protected data, which can require additional legal grounds. Provide only what’s relevant to the task.

Workbook autosave can keep workbook contents and recent edits on your device for recovery. When optional background workbook processing is enabled, we also keep temporary encrypted copies to finish tasks and recover results after a disconnection. These copies follow the retention rules below.

We receive contact details, requests, optional LinkedIn information, and messages through forms, email, support, or customer introductions. We use them to respond, help with problems, and manage the business relationship.

We collect professional contact information from public sources, such as company websites and professional profiles, and from third-party business-contact databases and providers that find and check contact details. We may combine it with details you give us to check or complete our records. Depending on the source, this can include your name, work email, job title or role, company, and professional profile links.

We use this information to identify relevant business prospects and contact them about Helmstead, even if they haven’t contacted us or used our services. Suverenum Inc. acts as the controller for this prospect research and business-to-business outreach.

We use these providers for that work:

  • FullEnrich helps us find, check, and add professional contact details using third-party data providers.
  • Exa helps us research public professional and company information and add relevant details to prospect records.
  • Outreach2day sends our business outreach. It connects to our sending mailboxes and handles prospect contact details, campaigns, messages, replies, and sending statistics.

Publicly available contact details aren’t consent to marketing. Receiving outreach doesn’t subscribe you to our Helmstead emails. We don’t use Customer Content or data excluded from marketing by the connected-service restrictions in this policy for prospect research or outreach.

To stop direct marketing, including prospect research used for that purpose, reply to an outreach email with your request or email privacy@helmstead.co. You can also ask where we obtained your details, request a copy or correction, or ask us to delete them. We handle these requests under the rights and retention rules in this policy.

This section applies only where email signup is available. You’ll be able to sign up through our homepage, blog, and article pages for one subscription to our newsletter, product updates, and promotional offers about Helmstead’s own products and services. If you sign up, Unitpost will manage your email address, subscription, and a copy of your signup details.

This subscription is optional and based on your consent. Signing up won’t give permission to add you to advertising audiences or other marketing lists. If you previously agreed only to receive blog articles, that permission will stay limited to blog articles unless you opt in again to the wider subscription. Changing this policy won’t expand your earlier permission.

We’ll record your signup, what you agreed to receive, your consent, the form you used, and the time recorded by our server. We’ll keep the exact signup wording and the text and version of the privacy policy shown. Signup will take effect only after our shared consent service has saved this evidence and Unitpost has completed your subscription. We’ll check the address’s format, but won’t verify that the mailbox exists or belongs to you. There’s no confirmation-email step.

AWS will store these records in Amazon RDS. Your email address and Unitpost contact reference will be encrypted and kept separate from your consent history, connected by reference codes. The history won’t contain email addresses, IP addresses, browser details, cookies, or submitted form contents.

AWS will keep separate records to detect changes to consent history and encrypted instructions to preserve withdrawals and deletions after a backup is restored. These copies won’t contain email addresses; the records used to check for changes also won’t contain document text or Unitpost contact references. Reference codes still count as personal information while they can be linked to you.

See how to unsubscribe and how long we keep these records.

Our demo scheduler is provided by HubSpot. When you book, it collects your name, email address, company, the meeting time, and anything you add to the booking. We keep these details in HubSpot to arrange the demo and follow up. The scheduler may use cookies that HubSpot needs to run it.

We receive device and browser details, IP addresses, page visits, feature activity, identifiers, error information, and audit and security records. These help us understand use, troubleshoot problems, and protect the service.

APIs are tools that let software services exchange information. Requested features may send relevant information to the AI provider, subject to the source-specific limits in this policy. See Manage connections for access controls and what happens when you disconnect.

Google and Microsoft supply the sign-in information described above. Signing in does not by itself grant access to mailboxes or files. Those connections are enabled separately.

File access depends on the connection:

Provider Information and purpose
Google Drive Read permission covers file names and contents, including shared files and personal files in a work account. We read files to answer requested chat questions.
Microsoft OneDrive Access covers file names, contents, and metadata across files the account can open, including shared files and files in SharePoint or Teams sites. Files shared later are included. We retrieve relevant files for requested assistant tasks.

Mailbox access depends on the connection:

Provider Information and purpose
Gmail Read permission covers the whole mailbox: subjects, senders, bodies, and attachments, including old or personal mail. We read mail to answer requested chat questions.
Outlook Read permission covers mailbox subjects, senders, message bodies, and attachments. We retrieve relevant mail for requested assistant tasks.

The information we receive depends on the source and permissions:

Provider Information and purpose
Sage We may receive financial and payroll records, including deductions, employee Social Security numbers, vendor tax identifiers, and bank account and routing details.
QuickBooks Online Supplies the connected company’s chart of accounts, customers, vendors, invoices, bills, journal entries, payments, and reports, within the authorized accounting permissions. We read them when someone in your treasury pulls them into a workbook for accounting or financial analysis. A QuickBooks Online accounting connection does not itself grant payroll access.
Xero, where offered and enabled Selected accounting features may read accounts, contacts, transactions, invoices, bills, payments, or reports for instructed accounting and workbook tasks. These are illustrative categories; access depends on the feature and granted permissions.

Mail, files, and uploads may incidentally contain any of these categories.

To remove an in-app connection, select Disconnect for Gmail, Google Drive, Outlook, OneDrive, or a QuickBooks Online company in Helmstead Integrations, if your role allows it.

Review sign-in and data permissions separately using the Google access controls and Microsoft access controls.

You can also disconnect Helmstead in QuickBooks Online’s app-management or My Integration area.

For Xero, review or revoke access in your organization’s connected-app settings. Ask your organization’s administrator or contact us if you need help.

Use Google linked apps to remove Helmstead’s permission to access Google data.

Sign-in and mailbox or file permissions are separate. Stopping “Sign in with Google” alone does not remove mailbox or file access. Google’s access guide explains both controls.

For a work or school account, use Microsoft My Apps to revoke permissions you granted to Helmstead. Your administrator must remove permissions granted on your behalf. Microsoft’s permissions guide explains how.

Where a feature supports a personal Microsoft account, use Microsoft account consent to manage its permissions.

Removing the local connection in Helmstead and revoking its Microsoft permissions are separate controls.

Disconnecting ends future use of that connection. For QuickBooks Online, we delete our stored connection credential and ask Intuit to revoke access. Intuit’s revocation may not take effect immediately, but that does not delay our duty to stop accessing and processing the affected QuickBooks data. Disconnecting does not delete your books in QuickBooks Online or records in the source service.

Copies already held in Helmstead, such as workbook entries or chat answers, follow our retention and deletion rules. These include the stricter Microsoft API deletion duties, which apply without a separate deletion request when their triggers occur, and the QuickBooks Online stop-processing and secure-deletion duties. For other copied records, you can request deletion through the same retention and deletion section.

The assistant uses prompts, meaning a user’s questions or instructions, and information it’s authorized to retrieve. This can include accounting records, workbook cells, emails, attachments, and file contents or details.

It produces outputs, such as answers, analysis, titles, and workbook changes. We also receive user feedback. Saved answers and results can contain personal information from the original records.

We currently don’t use Customer Content to train or fine-tune models. Training teaches a model from data. Fine-tuning adapts an existing model using more data.

Any future training would need a separate change, with clear notice beforehand, appropriate customer instructions or authorization, and consent where required. It could happen only where law and contracts allow it. Continuing to use Helmstead would not give that permission. No authorization or policy change can override Google’s, Intuit’s, Xero’s, or other applicable source-specific restrictions.

We don’t use Customer Content for advertising or for evaluation or benchmarking across customers. This includes customer financial records, files, prompts, and AI answers. This policy also gives no general permission for other model testing or reuse.

The selected provider is Amazon Bedrock from Amazon Web Services (AWS), or Microsoft Azure OpenAI. Requests don’t automatically switch to the other provider. The company that publishes a model isn’t necessarily a direct recipient when AWS or Microsoft hosts it.

  • AWS’s published commitments say AWS and third-party model providers don’t use Bedrock inputs or outputs for training.
  • Microsoft’s privacy documentation says inputs and outputs aren’t available to OpenAI or other customers. They aren’t used to train base or foundation models or improve Microsoft or third-party products without explicit permission or instruction.

“No training” doesn’t mean information is never stored or reviewed. Providers’ storage, logs, automated abuse checks, and authorized human review depend on the model, features, and settings. Providers can keep saved responses separately from Helmstead’s conversation history. These disclosures do not authorize processing that conflicts with Customer Content limits or source-specific restrictions.

AI answers can be wrong. Review them before relying on them, especially for decisions affecting people.

Our use and transfer of information received through Google APIs will adhere to the Google API Services User Data Policy and Google Workspace user data policy, including Limited Use requirements. These are mandatory rules for Google-connected features.

We will use Google data only for permitted features offered to users. Transfers to others must be allowed by Google: to provide or improve those features with the required user consent, protect security, or meet applicable law. A transfer as part of a merger, acquisition, or asset sale requires the user’s explicit consent in advance.

People may read Google data only in cases Google allows:

  • The user explicitly agrees to a person reading the specific content needed for support
  • Access is necessary for security, such as investigating a security bug or abuse
  • Access is necessary to comply with applicable law
  • The information is genuinely aggregated and anonymized and used only for internal operations allowed by Google

We will not sell Google data or use it for advertising of any kind or creditworthiness or lending decisions. We will not use it to create, train, or improve AI models beyond the specific user’s personalized model for a permitted feature. Our current no-training commitment still applies.

These restrictions also apply to information derived from Google data, including aggregated or anonymized forms.

Information accessed or obtained through Microsoft APIs, including Microsoft Graph, is subject to the Microsoft APIs terms. “Microsoft APIs Data” includes API-derived identity information, mail, files, and metadata, and any aggregated, anonymized, or derived forms, whether or not they identify a person.

We will:

  • Request only the minimum permissions and data needed for the intended feature, and never request, use, or make data available outside the customer’s expressly granted permissions.
  • Obtain all necessary consent before processing and additional consent if processing changes.
  • Keep copies up to date and reflect corrections, restrictions, and deletions made in the source data.
  • Delete all Microsoft APIs Data associated with a user when they abandon or uninstall Helmstead, close their Helmstead account, or abandon that account. This includes copies held by us or providers acting on our behalf. No separate deletion request is needed.

These deletion duties take priority over general history and backup retention. We may preserve specific information only where required by law, for the required purpose and duration.

We will not use or transfer Microsoft APIs Data for advertising or marketing. This includes identity information obtained through Microsoft APIs, even if it resembles a business contact record. Independently obtained business contacts may be used under the marketing rules below; we will not relabel API-derived information as independent contact data to bypass this restriction.

These rules concern Microsoft as a source of connected data. Microsoft Azure OpenAI hosting has separate terms. Sending Microsoft-source data to an AI provider does not remove its source-specific restrictions. See Microsoft access controls to revoke permissions.

“QuickBooks data” includes the User Data and Personal Information accessed through Intuit’s services, including company financial data that does not identify a person. We will follow Section 12.2 of the Intuit developer terms, dated 14 October 2025. These limits also cover copies and information derived from QuickBooks data.

Suverenum Inc. does not process QuickBooks User Data or Personal Information on Intuit’s behalf. We may process it on the customer organization’s instructions under its own data processing addendum with us. That does not make us Intuit’s processor or subprocessor. Our legal role depends on the actual processing purpose and applicable law, not a contract label.

We store, process, and use QuickBooks data only to provide Helmstead’s features to users, within their consent, Intuit’s permitted uses, and applicable law. Permissions remain tied to the connected company and customer organization; copying data or deriving new information does not create a new permission.

We don’t sell QuickBooks data. We will make it available to third parties, including service providers and AI providers, only for uses that directly support or facilitate the user’s access to or use of Helmstead. Before sharing, we will require written agreements with data-protection and security terms at least as restrictive as Intuit’s terms and applicable law, and enforce those obligations. Consent cannot authorize a prohibited use.

We keep each customer organization’s QuickBooks data isolated within its workspace. We don’t share one customer’s QuickBooks data with another customer or use it for cross-customer insights, evaluation, or benchmarking. Authorized people in that customer’s workspace and permitted service providers access it to support that customer’s use of Helmstead, not to supply data to another customer. Our no-advertising and current no-training commitments also apply.

If a user revokes consent, disconnects QuickBooks Online, or terminates, deletes, or stops using Helmstead, we will immediately stop accessing and processing the affected company’s QuickBooks data. This includes copies and derived information in workbooks, edit and conversation history, AI results, and temporary copies used to finish tasks or recover results. We will require service providers processing that data for us to stop immediately too.

Ordinary history periods, the 30-day deletion-completion aim, backup schedules, or a continuing customer purpose do not postpone this stop. A delay in Intuit completing revocation does not extend our permission either.

Stopping access and processing is separate from securely deleting copies. Disconnecting does not mean every stored copy is instantly erased. We will securely delete QuickBooks data on a valid user request made directly to us or through Intuit where it handles that request. If you make a valid request through Intuit, you don’t need to repeat it with us. Deletion covers affected copies and derived information held by us and service providers acting for us.

Copies awaiting secure deletion stay protected and out of active use. The only exception to secure deletion is for specific records we must keep to meet recordkeeping obligations under applicable law. Those records stay protected and out of active use, with processing limited to the legally required purpose and duration. We will securely delete them when the obligation ends.

Where a Xero connection is offered and enabled, we will use its data only for selected features within the granted permissions and use cases approved by Xero, under the Xero developer terms. “Xero API Data” includes information accessed, received, transmitted, or generated through the platform’s APIs, in raw or processed form. These restrictions cover that data and its derivatives, whether or not they identify a person.

  • We will not use Xero API Data to train, fine-tune, adapt, or enhance any AI model.
  • We will not pass Xero API Data to another third party, including an AI provider, without the associated user’s consent, or for any purpose or activity that conflicts with Xero’s terms. Consent cannot authorize a prohibited use. AI inference must also comply with Xero’s approved-use-case and data-use requirements; choosing an AI provider is not blanket permission for inference.
  • We will not sell user data or aggregate and supply user data or Xero API Data to another app or third party.

Cookies are small records stored by your browser. Local storage and similar browser databases can keep preferences, identifiers, or recovery data on your device. Pixels and similar tools can send information about a page visit or event to a provider.

We use these technologies for the following purposes:

Category Purpose
Sign-in and security Maintain sessions, recognize an authenticated browser, and protect access
Preferences and recovery Remember your website language for 365 days after each language choice and keep device-local workbook autosave recovery data
Analytics Understand page visits and feature use, diagnose problems, and measure website interactions
Advertising Measure campaigns and conversions, recognize browsers or devices, and help show relevant ads

We use PostHog for analytics on our own website, helmstead.co, and application, app.helmstead.co:

  • Website analytics automatically capture clicks and create heatmaps showing page interactions. These features are off in the application.
  • Session replay, which records visits for playback, is off on both.
  • A shared analytics cookie on helmstead.co and its subdomains can link website visits with signed-in application activity and the user’s organization. Its identifiers are pseudonymous: they replace names but can still be linked to a person.

We use Google Ads, Meta Ads, and LinkedIn Ads to reach prospective customers and measure advertising results. For advertising, we send marketing information in two forms:

  • Website and conversion events, including website activity and browser/device identifiers
  • Marketing contact details, such as email addresses, so advertising platforms can match those contacts to people using their services

These disclosures involve our marketing contacts and website/conversion events. Customer Content is excluded from advertising, including customer financial records, files, prompts, and AI answers. Google API data is also excluded from advertising, and Microsoft APIs Data is excluded from both advertising and marketing, including API-derived sign-in identities.

We treat these advertising disclosures as a sale or sharing wherever applicable privacy laws define them that way. This can apply even if we aren’t paid for the information.

Advertising providers may collect information about your activity over time and across other websites, apps, and services. They may match the events or contact information we provide with information they already hold, under their own privacy terms and applicable law.

We use Unitpost to send service emails, such as account or security notices, and marketing emails, including newsletters. Necessary service messages are separate from marketing.

The optional Helmstead email subscription has its own consent and scope. Signing up won’t give permission to add you to advertising audiences or other marketing lists.

You can opt out of targeted advertising or the sale or sharing of your information, stop newsletters and other marketing messages, or withdraw consent for optional tracking.

Use app settings or email us to make any of these choices. You don’t need an account or identity verification for advertising opt-outs.

Each email covered by your subscription will include an unsubscribe link. You’ll be able to withdraw at any time using that link, Unitpost’s unsubscribe controls, or by emailing privacy@helmstead.co. We’ll record your choice and stop all emails covered by your subscription. The public signup form won’t override a withdrawal, global unsubscribe, or block on sending to the address. Withdrawing won’t stop necessary service messages. A broader opt-out will still apply to the scope you choose.

Where law requires prior consent for optional tracking or marketing, we will obtain it before that activity. Calling analytics “first-party” does not remove that requirement. Where applicable law requires us to honor an opt-out preference signal, including Global Privacy Control (GPC), we will treat it as a valid opt-out for the browser or device and any associated profile to the extent the law requires. You don’t have to email us as an additional condition for a legally valid signal.

The older Do Not Track (DNT) browser setting is different from GPC. Our analytics setup does not use DNT to change tracking behavior. This does not change our obligations to honor legally recognized opt-out signals.

Depending on the services enabled, providers may include:

What they help us do Providers
Run Helmstead and store information AWS
Run the AI assistant AWS, Microsoft
Understand how people use Helmstead PostHog
Find and fix errors Sentry
Send service and marketing emails Unitpost
Manage Helmstead email subscriptions Unitpost
Keep email signup and consent records AWS
Book demos and keep contact details HubSpot
Send business outreach and manage replies Outreach2day
Find and check work contact details FullEnrich
Find public information about business contacts and companies Exa
Show ads and measure results Google Ads, Meta Ads, LinkedIn Ads

Providers receive information relevant to their work. Users and customer-selected services receive information within their permissions and instructions. Connected services have their own privacy terms for their separate activities.

Our prospecting providers’ roles depend on the service and purpose. Outreach2day’s terms cover mailbox access and backups for its outreach service; its privacy policy explains how it handles contact, mailbox, and campaign information. FullEnrich may use several third-party providers to find and check contact details. Its terms distinguish processing on a customer’s instructions from services it operates as an independent controller.

Exa may store information in our searches and use it, including in anonymized form, to improve or train its own models under its privacy policy and applicable terms. Retention and use depend on the service, settings, and agreement. These uses concern our prospect research and don’t change the Customer Content restrictions in this policy.

We may share necessary information with professional advisers, to meet valid legal requirements, address fraud or claims, or handle a business transaction such as an acquisition. Applicable restrictions and safeguards still apply, including the extra limits for Google, Microsoft API, QuickBooks Online, and Xero data.

A lawful basis is the legal reason for using personal information. Customers need a basis for their instructions to us. For our own uses covered by EU/European Economic Area (EEA) or UK law, the table below links each purpose to its legal basis:

  • Consent means freely agreeing to a specific use with enough information to understand it. It isn’t permission for every use.
  • Legitimate interests requires a business purpose that needs the information, balanced against your rights.
  • Contract applies where information is needed to carry out a contract with you personally, or take steps you request before entering one. A contract with your employer doesn’t automatically give us this basis for your information.
What we use information for Legal basis
Professional contacts, account records, and messages: administer accounts, maintain business relationships, and answer inquiries or support requests Legitimate interests in providing services to customer organizations and helping their contacts
If you contract with us personally: information needed to fulfill that contract or take steps you request toward it Contract, limited to the individual and necessary use described above
Account, audit, security, and error records: protect reliability and security Legitimate interests in preventing misuse and investigating incidents
Optional cookie-based analytics linking visits and account activity, and advertising tracking Consent where required. Legitimate interests cannot replace required cookie or tracking consent
Helmstead email subscription: send emails within the scope you agreed to and manage your subscription Consent
Minimal email consent and withdrawal records: show permission, respect opt-outs, check records for changes, and resolve disputes Legitimate interests in documenting permission and respecting choices, with the separate retention periods below and subject to your rights
Prospect research, finding and checking contact details, and business-to-business outreach, including to people who haven’t contacted us Legitimate interests in finding relevant business prospects and promoting Helmstead, only where applicable marketing rules allow it and an assessment shows our interests aren’t outweighed by your rights. Consent before the activity where required
Minimal prospect opt-out records: respect objections and prevent further direct marketing Legitimate interests in respecting your choices and documenting how we handled them, subject to your rights
Other marketing communications and sharing marketing contact details with advertising platforms Consent where required. Otherwise, legitimate interests in promoting Helmstead only where marketing rules and the rights-balancing assessment allow the specific use
Demo bookings and contact records: hold the meeting, follow up, and manage a prospective business relationship Legitimate interests in answering demo requests and managing prospective customer relationships. Contract only where you would become the customer yourself. You can object at any time
Records needed to meet a specific applicable legal duty Legal obligation
Records needed to bring or defend legal claims Legitimate interests in bringing or defending those claims

Usability analysis concerns service activity, not general reuse of Customer Content. Marketing is separate from information needed to operate an account.

The Microsoft API deletion duties and QuickBooks Online stop-processing and secure-deletion duties take priority over all general history, retention periods, completion aims, and backup handling below. Their narrowly defined legal-retention exceptions apply. Other applicable source-specific restrictions also continue to apply.

Retention depends on whether information is still needed for its purpose, the customer’s instructions, and any actual legal duty:

  • Customer records, files, and workbooks: while needed for the customer’s ongoing work and history, subject to its retention and deletion instructions.
  • Contact and support records: while needed to answer an inquiry, resolve an issue, or maintain the business relationship.
  • Demo bookings and contact records: up to 24 months after our last contact, unless they become part of a customer relationship.
  • Prospect research and outreach records: while needed for a permitted business purpose. We consider the source, age and accuracy of the details, relevance to your role and company, our interactions, and any objection or deletion request. We remove information when it’s no longer needed, unless a separate lawful purpose requires it.
  • Prospect opt-out records: after you object to direct marketing, we may keep a minimal contact identifier and record of your choice for as long as needed to prevent further outreach and document how we handled your request. We don’t use these records to research prospects or send marketing.
  • Marketing records: while needed for permitted communications or audience membership, subject to the email subscription retention rules below. After an opt-out, we may keep a minimal record of the choice to avoid contacting the person again.
  • Activity, error, and security records: according to their relevance to the stated analysis, troubleshooting, or investigation, including whether an issue remains open.

We keep saved history for these periods:

History How long it stays
Main conversations Until the user deletes them
Workbook conversations Up to 5 years after the last message
Workbook edit history Up to 5 years after each edit; deletion is handled separately from conversation deletion

These 5-year periods are maximums, not minimum retention requirements or guarantees that all history will remain available. Valid deletion requests, account closure, service termination, and applicable source-specific limits take priority.

Workbook recovery data on your device expires 7 days after its last saved update. The app removes expired copies when it next checks or clears that browser storage. It may not remove them while the app is closed. You can remove them by clearing Helmstead’s site data in that browser. Deleting records on our servers does not clear copies on your device.

When background workbook processing is enabled, temporary copies of task inputs are cleared when the task ends and expire within 1 hour after we accept it. Copies used to recover results expire 24 hours after the task ends, and no later than 25 hours after we accept it. Expiry ends access; physical removal can happen later. Saved conversations and workbook history follow the separate periods above.

To request deletion, email privacy@helmstead.co and identify the account, organization, or records involved, if known. We’ll work with the responsible customer where its instructions are needed. For QuickBooks data, a valid request through Intuit is also accepted, without a repeat request to us, as described in the QuickBooks data limits.

We aim to complete deletion within 30 days after a valid, authorized deletion request or the end of the customer’s service, subject to applicable law and customer instructions. This is a completion aim, not an absolute guarantee or a rule deleting all records 30 days after collection. It includes addressing relevant copies held by providers on our behalf; backup expiry follows the lifecycle described below. This aim does not postpone source-specific stop-processing or deletion duties or require a separate request where those duties already apply.

Legal response deadlines apply independently of this aim and any identity checks. Verification must not restart those deadlines or leave a request on hold indefinitely.

We may need specific records for longer to meet an actual legal duty, investigate a security incident, or handle a legal claim. That does not allow unrelated uses. Accounting or audit records aren’t automatically exempt from deletion. Identifiers still count as personal information if they can be linked to someone. For QuickBooks data, only the legally required recordkeeping exception in the QuickBooks data limits applies.

Deleted information may remain in backups until those copies expire or are securely deleted under the applicable schedule. We’ll keep it protected and out of normal use, with access limited to recovery or necessary legal preservation. After a restore, we’ll apply deletion instructions and source-specific restrictions before any permitted active use. Customer processing terms can set a maximum backup-deletion period.

These rules will apply to the Helmstead email subscription, including earlier subscriptions limited to blog articles. Withdrawing consent for this subscription or unsubscribing globally in Unitpost stops all emails it covers. Keeping a record of your choice does not extend permission to send.

Record Clock starts How long What happens
Active subscription records and original signup evidence, including the exact document versions When signup completes While you remain subscribed, with no age expiry or renewal requirement Keep the records described in the subscription section for the scope you agreed to
Consent and withdrawal history When we record your withdrawal 731 days Delete the history when this period ends. Earlier erasure requests follow the rules below
Email and contact links for a withdrawn subscription When you withdraw Until provider cleanup and rights requests are resolved, no later than 30 days after withdrawal Remove the links and subscription details no longer needed, including details on Unitpost contacts shared with other purposes
Unfinished signup records When we first record the request Expire after 7 days; removed by the next daily cleanup Delete email and contact links, the signup record and history, and unfinished request details. Remove data held only for this subscription from Unitpost
Details used to process a completed signup When processing completes Up to 30 days Delete the processing details. Keep the outcome in consent history for the applicable period above
AWS copies used to check consent records and minimal records of deletion When each copy is created 731 days; expired copies and versions removed by the next daily cleanup New daily check records preserve evidence while the underlying history is retained. Keep the latest needed check record without extending any older copy’s clock
Recoverable copies of email subscription consent data in databases under our control, including Amazon RDS When personal information is deleted from the primary database No more than 30 days Remove the deleted information from all recoverable database versions and copies, including backups
Encrypted AWS instructions for preserving withdrawals and deletions after a restore When each copy is created Protected for 32 days; removed by the next daily cleanup, no later than 33 days from creation Reapply withdrawals and deletions before restored information returns to use. Remove expired instruction copies on schedule
Unitpost backup copies Set by Unitpost’s backup process On Unitpost’s regular backup rotation schedule Unitpost removes remaining copies from encrypted backups. Our database’s 30-day deletion limit does not apply to those copies.

The 731-day consent-history period is for documenting choices and resolving disputes. It is not a consent expiry or statutory minimum. Public versions of our notices will remain available after individual signup records are deleted.

Through our privacy contact, you’ll be able to request a copy of your subscription data, consent history, and the associated document versions, or ask for deletion. On a verified erasure request, we’ll record the withdrawal, remove the subscription and its data from Unitpost, and remove encrypted email and contact links no other purpose needs. If the Unitpost contact is held only for this subscription and no retention exception applies, we’ll delete it. Deletion remains in progress until the required Unitpost cleanup is complete.

After an erasure request, we may keep minimal consent history for the rest of the 731-day period after withdrawal only where needed to establish, exercise, or defend legal claims and the law allows an exception. If we also need a link to your email or contact record for that exception, we’ll restrict access and explain the reason, retention period, and how to challenge it.

Withdrawal, global unsubscribe, or subscription cleanup won’t delete information still needed for a separate lawful purpose, such as necessary service messages. This can include a shared Unitpost contact. A broader deletion request will be assessed for each purpose under the rights and exceptions in this policy.

We’ll keep the minimal withdrawal or sending-block record needed to respect your choices. Our consent service will keep a code based on your email solely to honor your opt-out while we offer this subscription, without links to erased consent history or contact records. We’ll remove it if we permanently end that purpose.

We market Helmstead to US customers, many of them international businesses. Information may be handled in the United States and other countries where providers operate. US hosting doesn’t guarantee US-only support access, error logs, AI processing, or backups.

AWS hosts our website and app in Northern Virginia, United States. Its global delivery network processes requests and responses, including signed-in app traffic. AWS stores our application database in Amazon RDS in the United States.

Unitpost handles email addresses, related contact records, and email content for service and marketing emails in the United States under its data processing agreement, which automatically forms part of its Terms of Service.

The email subscription records will use the US storage locations described here for Unitpost and AWS. Signup requests are also subject to the global processing described above.

Prospect research and outreach have their own processing locations. FullEnrich’s published provider list includes providers that store information and find and check contact details in the European Union and the United States. Locations for Outreach2day and Exa depend on the service and its providers. The transfer safeguards below also apply to prospect information.

For transfers subject to EU/EEA or UK restrictions, we will use an applicable legal mechanism and the protections required for the information and recipient. These include:

  • An applicable adequacy arrangement, meaning legal recognition of sufficient protection for the covered destination or recipient
  • Appropriate contractual safeguards, such as EU Standard Contractual Clauses and the relevant UK Addendum or International Data Transfer Agreement, with required assessments and protections

We will assess the destination’s protections and apply supplementary measures where needed. For customer-directed processing, agreed processing locations and transfer terms govern our use of providers. We will not make a restricted transfer unless the required safeguards are in place.

Email privacy@helmstead.co to ask about transfers affecting your data or request details or copies of applicable safeguards.

The product includes access checks, controls that separate organizations’ data, and audit and security records to help protect information. No service can promise absolute security.

Use the contact details above for any request. Rights and exceptions depend on the law, the information, and our role.

Where these laws apply, you can ask to access, correct, or delete information, restrict its use, or receive a copy you can use with another service (portability). You can object to uses based on legitimate interests. If we rely on your consent, you can withdraw it without affecting earlier lawful use.

Where the law gives you rights concerning significant automated decisions, you can ask for information about the decision, human intervention, and a way to challenge it. If a customer makes the decision using Helmstead, we’ll help route your request to that organization.

You can object to direct marketing at any time. You can also complain to your data-protection authority, including the UK Information Commissioner’s Office.

EU GDPR requests generally require a response without undue delay and within 1 month. Any legally allowed extension needs a timely explanation. Other requests follow their applicable legal deadlines.

For UK data-protection complaints, we will acknowledge receipt within 30 days, investigate, and tell you the outcome without undue delay. This is separate from rights-response deadlines and the deletion-completion aim.

Where the California Consumer Privacy Act applies, including to covered business-contact information, you can:

  • Ask what categories and specific information we hold, where it came from, why we use it, and who receives it
  • Get a copy or request corrections or deletion
  • Opt out of sale or sharing
  • Limit sensitive-information use where the law gives that right

We won’t unlawfully discriminate against you for using these rights. Advertising opt-outs don’t require an account or identity checks. An authorized agent can act for you, with proof of authority where allowed. See tracking and marketing choices for how to make a request.

The following table summarizes the information described in this policy, including the Helmstead email subscription. Customer Content is normally handled on customer instructions and is excluded from advertising and cross-customer evaluation or benchmarking. Advertising disclosures concern marketing contacts shared with ad platforms and marketing website/conversion events.

In this table, “customer service recipients” means authorized customer users and the hosting, storage, connected-service, support, and selected AI providers needed for the requested feature. “Advertising” identifies disclosures to Google Ads, Meta Ads, and LinkedIn Ads for the two marketing flows above, including sale or sharing where the law defines them that way.

Information and California category Sources and purposes Recipients Advertising
Account names, work emails, organization membership, and roles — identifiers, customer-record information, and professional information Users, organizations, and sign-in services; access, account administration, and support Relevant identity and hosting providers; Unitpost for service emails and related contact handling No
Email subscription addresses, contact references, and signup, consent, and withdrawal records — identifiers and customer-record information Website signup forms; the agreed email subscription, managing membership, and recording choices Unitpost for subscriptions; AWS for consent records, encrypted contact details, processing requests, checking records, and preserving choices after recovery No
Prospect names, work emails, roles, companies, professional profile links, and outreach records — identifiers, customer-record information, and professional information Public company websites and professional profiles, third-party contact databases and providers, and details you give us; finding and checking business contacts, relevant outreach, and opt-out handling FullEnrich and its data providers; Exa; Outreach2day for contact details, campaigns, messages, replies, and sending statistics Research and direct outreach are separate from ad-platform audiences; any audience use follows the row below
Other marketing-contact emails and other contact details — identifiers and customer-record information Business contacts, forms, introductions, and prospect records where permitted; other marketing communications and sharing contact lists with ad platforms Unitpost for marketing emails and related contact handling; HubSpot for contact records; named ad platforms for contact matching Yes, for permitted contact lists shared with ad platforms
Website activity, conversions, and browser/device identifiers — identifiers and internet or electronic-network activity Marketing website visits and conversion events; analytics and campaign measurement PostHog, relevant hosting and error-reporting providers, and named ad platforms Yes, for marketing website/conversion events
Application activity and pseudonymous user/organization identifiers — identifiers and internet or electronic-network activity Application use; analytics, security, and troubleshooting, including linkage to website visits PostHog and relevant hosting and error-reporting providers No
Customer transactions, invoices, bank account/routing details, and vendor tax identifiers — customer-record information, identifiers, and commercial information Customers, Sage, QuickBooks, and files; instructed accounting and financial analysis Customer service recipients No
Employee identifiers, pay, payroll deductions, and employment records — identifiers, customer-record information, and professional or employment-related information Sage and customer-provided material, including uploads or connected mail/files containing these records; instructed accounting, payroll-related analysis, and workbook features Customer service recipients No
Files, workbooks, messages, attachments, prompts, AI answers, and metadata such as authors and site/library/drive names — identifiers, customer-record information, and categories reflected in the content Uploads, connected mailboxes/files, and assistant interactions; requested features, history, recovery, and support Customer service recipients No
Inferences about identifiable people, when produced — inferences Customer Content and requested AI analysis The same permitted recipients as the underlying Customer Content No
Social Security or other covered government identifiers, qualifying account credentials, private correspondence, and other covered sensitive content — sensitive personal information Sign-in/connection records, customer source systems, and uploads; access, security, and instructed features Providers needed for the function and authorized customer users where appropriate No

Categories overlap. For example, a Social Security number is both an identifier and sensitive personal information. A financial account or login combined with credentials that allow access can also be sensitive personal information under California law. Customer-provided material may contain protected-class information, biometric information, audio or visual material, education records, or other sensitive information. We handle that material as Customer Content, not as an advertising source.

Sensitive Customer Content is used for the customer’s instructed services and necessary protection of those services, not to build advertising profiles. You can request limits where California law gives that right. Retention periods and criteria are in how long we keep information.

We will not sell or share information we know belongs to someone under 16 without the authorization California law requires. Customer Content remains excluded from advertising regardless of age.

Covered access, deletion, and correction requests require acknowledgment within 10 business days and a response within 45 calendar days, with timely notice of any legally allowed extension. Covered sale/sharing opt-out and sensitive-information limitation requests must be handled as soon as feasible and no later than 15 business days.

We will review these California disclosures at least once every 12 months and update them as required by law.

Other US laws may give rights to access, correct, delete, or obtain a portable copy, and opt out of sale, targeted advertising, or certain profiling. Where you can appeal a decision, email privacy@helmstead.co with “Privacy appeal” and your request details.

People elsewhere, including Latin America and Asia, can use the same contact route for rights under local law. Coverage varies, including for business information and information we handle for customers.

Helmstead is for a professional business audience, not children. If customer records include a child’s information, we will handle requests according to our role, the customer’s instructions, and applicable law.

We will update the date and give notice of significant changes as required. New uses may need separate authorization or consent. Changing this policy does not supply that permission.