HelmsteadHelmstead

Privacy policy

Version
1.1
Effective date
Choose version
All legal docs
Table of contents

We’re Suverenum Inc. Helmstead is our product name. It helps businesses work with treasury and accounting data through workbooks and an AI assistant.

Our main domain is helmstead.co. This policy covers it and all its subdomains, including app.helmstead.co, plus related business communications.

We may also use suverenum.ai, opentreasury.app, goldhord.xyz, or their subdomains to run or support Helmstead’s technical services. The same policy applies when we use those domains for that purpose.

“Personal information” means information that identifies you or can be linked to you. This policy applies even if you’ve never used Helmstead. For example, a customer might upload an invoice or workbook that names you.

Email privacy@helmstead.co with questions, requests, or complaints. You don’t need an account. Tell us what you need and your connection to Helmstead, if known. Please don’t send passwords, access tokens, or full financial documents initially.

You can also write to Suverenum Inc. at 2261 Market Street STE 77991, San Francisco, CA, 94114 US.

Depending on the law and how your information is used, you may be able to:

  • Find out what information is held about you and get a copy
  • Correct mistakes or ask for information to be deleted
  • Ask for certain uses to stop or be restricted
  • Withdraw consent or opt out of certain advertising uses
  • Complain or challenge a decision about your request

If we hold information for an organization, such as your employer, we’ll help identify it, route your request, and assist with its authorized instructions. We’ll handle requests about our own uses ourselves. A request can involve both.

If we need to check your identity or authority to act, we’ll ask only for information needed for that check. These checks won’t restart the legal response deadline or leave your request on hold indefinitely. Copies we provide will exclude secrets and protect other people’s rights. If an exception limits your request, we’ll explain why and how to challenge the decision.

Read more about your regional rights, AI, cookies and marketing, and deletion.

Our customers are organizations using Helmstead, such as your employer or another business holding information about you.

“Customer Content” means the records they provide or connect, including resulting workbooks, edit history, conversations, and AI results.

  • A controller decides why and how personal information is used. We act in this role for our own contacts, account administration, marketing, and service activity used for operations and analytics.
  • A processor handles information on a controller’s behalf. We normally act in this role when handling Customer Content on an organization’s instructions.
  • A subprocessor handles information for another processor. This can be our role when a customer handles information for another organization.

Our role depends on the actual use. US “service provider” rules also depend on the activity and required contract terms.

When we handle Customer Content for an organization, its documented instructions, our customer terms, and any agreed data processing addendum govern that work. We will put the processing terms required by applicable law in place, including confidentiality, security, assistance with rights, and obligations for providers processing information on our behalf. We will process Customer Content only on documented instructions or as required by law.

This privacy policy explains our handling of personal information. It is not a customer contract or permission to use Customer Content for new purposes.

What other users or administrators can see depends on their permissions and the feature. Ask the customer organization about access to shared records, workbooks, and conversations.

What we receive depends on the features and connections enabled, their permissions, and what customers provide. Not every category applies to every person.

We receive names, work emails, profile and sign-in details from Microsoft or Google, organization membership, and roles. Connection records include permissions and access tokens, which let services connect to each other.

We use these records to manage accounts and access. Without information needed for sign-in or a connected feature, that feature may not work.

We receive:

  • Accounting entries, transactions, invoices, and customer, supplier, or other business contact details from customer-provided material or connected systems
  • Employment and payroll records, including pay, deductions, and tax details, from customer-provided material or connected systems
  • Sensitive financial and identity information in source records, including employee Social Security numbers or other national or tax identifiers, vendor tax identifiers, and bank account and routing details
  • Uploaded files and workbooks, including previous versions and edit history
  • Messages and attachments from connected email accounts
  • File contents and metadata from connected file-storage services and shared files, including file names, author identities, and site, library, or drive names

We use this material on the customer’s instructions to organize records, find requested information, maintain workbooks and history, and support its accounting and financial analysis. It may name employees, contractors, suppliers, customers, or correspondents. These records are Customer Content and are never used for advertising.

Connected-file metadata can identify people or reveal information about their work even when we don’t open the file’s contents. See connected services for each connection’s scope and access controls.

The customer must properly authorize connections. Its permission is not consent from everyone named in the records. Uploaded or connected material may also include health information, protected characteristics, biometric information, or other specially protected data, which can require additional legal grounds. Provide only what’s relevant to the task.

Workbook autosave can keep recovery data on your device, including workbook contents and recent edits. Where optional durable workbook processing is enabled, we also keep encrypted, short-lived execution and replay copies so work can finish and results can be recovered after a disconnection. These copies follow the retention rules below.

We receive contact details, requests, optional LinkedIn information, and messages through forms, email, support, or customer introductions. We use them to respond, help with problems, and manage the business relationship.

Our demo scheduler is provided by HubSpot. When you book, it collects your name, email address, company, the meeting time, and anything you add to the booking. We keep these as a contact record in our customer relationship management (CRM) system, also run on HubSpot, to hold the meeting and follow up about it. The scheduler may use cookies that HubSpot needs to run it.

We receive device and browser details, IP addresses, page visits, feature activity, identifiers, error information, and audit and security records. These help us understand use, troubleshoot problems, and protect the service.

Requested features may send relevant information to the AI provider, subject to the source-specific limits in this policy. See Manage connections for access controls and what happens when you disconnect.

Google and Microsoft sign-in identify you and help manage account access.

Provider Information and purpose
Google Supplies your name, email, profile, and sign-in details.
Microsoft Supplies your name, work email, profile, and sign-in details.

Signing in does not by itself grant access to mailboxes or files. Those connections are enabled separately.

File access depends on the connection:

Provider Information and purpose
Google Drive Read permission covers file names and contents, including shared files and personal files in a work account. We read files to answer requested chat questions.
Microsoft OneDrive Access covers file names, contents, and metadata across files the account can open, including shared files and files in SharePoint or Teams sites. Files shared later are included. We retrieve relevant files for requested assistant tasks.

File metadata can include file names, author identities, and site, library, or drive names.

Mailbox access depends on the connection:

Provider Information and purpose
Gmail Read permission covers the whole mailbox: subjects, senders, bodies, and attachments, including old or personal mail. We read mail to answer requested chat questions.
Outlook Read permission covers mailbox subjects, senders, message bodies, and attachments. We retrieve relevant mail for requested assistant tasks.

The information we receive depends on the source and permissions:

Provider Information and purpose
Sage Ingestion can include financial and payroll records, including deductions, employee Social Security numbers, vendor tax identifiers, and bank account and routing details.
QuickBooks Online Supplies the connected company’s chart of accounts, customers, vendors, invoices, bills, journal entries, payments, and reports, within the authorized accounting permissions. We read them when someone in your treasury pulls them into a workbook for accounting or financial analysis. A QuickBooks Online accounting connection does not itself grant payroll access.
Xero, where offered and enabled Selected accounting features may read accounts, contacts, transactions, invoices, bills, payments, or reports for instructed accounting and workbook tasks. These are illustrative categories; access depends on the feature and granted permissions.

Mail, files, and uploads may incidentally contain any of these categories.

To remove an in-app connection, select Disconnect for Gmail, Google Drive, Outlook, OneDrive, or a QuickBooks Online company in Helmstead Integrations, if your role allows it.

Review sign-in and data permissions separately using the Google access controls and Microsoft access controls.

You can also disconnect Helmstead in QuickBooks Online’s app-management or My Integration area.

For Xero, review or revoke access in your organization’s connected-app settings. Ask your organization’s administrator or contact us if you need help.

To remove Helmstead’s permission to access Google data:

  1. Open Google linked apps.
  2. Select Helmstead under “Access to your Google Account,” then select “See details.”
  3. Select “Remove access” and confirm.

“Stop using Sign in with Google” controls the sign-in link separately; stopping sign-in alone does not remove mailbox or file permissions. Google’s access guide explains both controls.

For a work or school account:

  1. Open Microsoft My Apps.
  2. Hover over Helmstead, open the three-dot menu, and select “Manage your application.”
  3. Select “Revoke Permissions” for permissions you granted.

Your administrator must remove grants made on your behalf. See Microsoft’s permissions guide. Where a feature supports a personal Microsoft account, use Microsoft account consent to manage its permissions.

Removing the local connection in Helmstead and revoking its Microsoft permissions are separate controls.

Disconnecting ends future use of that connection. For QuickBooks Online, we delete our stored connection credential and ask Intuit to revoke access. Intuit’s revocation may not take effect immediately, but that does not delay our duty to stop accessing and processing the affected QuickBooks data. Disconnecting does not delete your books in QuickBooks Online or records in the source service.

Copies already held in Helmstead, such as workbook entries or chat answers, follow our retention and deletion rules. These include the stricter Microsoft API deletion duties, which apply without a separate deletion request when their triggers occur, and the QuickBooks Online stop-processing and secure-deletion duties. For other copied records, you can request deletion through the same retention and deletion section.

The assistant uses prompts, meaning a user’s questions or instructions, and information it’s authorized to retrieve. This can include accounting records, workbook cells, emails, attachments, and file contents or details.

It produces outputs, such as answers, analysis, titles, and workbook changes. We also receive user feedback. Saved answers and results can contain personal information from the original records.

We currently don’t use Customer Content to train or fine-tune models. Training teaches a model from data. Fine-tuning adapts an existing model using more data.

Any future training would need a separate change, with clear notice beforehand, appropriate customer instructions or authorization, and consent where required. It could happen only where law and contracts allow it. Continuing to use Helmstead would not give that permission. No authorization or policy change can override Google’s, Intuit’s, Xero’s, or other applicable source-specific restrictions.

We don’t use Customer Content for advertising or for evaluation or benchmarking across customers. This includes customer financial records, files, prompts, and AI answers. This policy also gives no general permission for other model testing or reuse.

The selected provider is Amazon Bedrock from Amazon Web Services (AWS), or Microsoft Azure OpenAI. Requests don’t automatically switch to the other provider. The company that publishes a model isn’t necessarily a direct recipient when AWS or Microsoft hosts it.

  • AWS’s published commitments say AWS and third-party model providers don’t use Bedrock inputs or outputs for training.
  • Microsoft’s privacy documentation says inputs and outputs aren’t available to OpenAI or other customers. They aren’t used to train base or foundation models or improve Microsoft or third-party products without explicit permission or instruction.

“No training” doesn’t mean information is never stored or reviewed. Providers’ storage, logs, automated abuse checks, and authorized human review depend on the model, features, and settings. Providers can keep saved responses separately from Helmstead’s conversation history. These disclosures do not authorize processing that conflicts with Customer Content limits or source-specific restrictions.

AI answers can be wrong. Review them before relying on them, especially for decisions affecting people.

Our use and transfer of information received through Google APIs will adhere to the Google API Services User Data Policy and Google Workspace user data policy, including Limited Use requirements. These are mandatory rules for Google-connected features.

We will use Google data only for permitted features offered to users. Transfers to others must be allowed by Google: to provide or improve those features with the required user consent, protect security, or meet applicable law. A transfer as part of a merger, acquisition, or asset sale requires the user’s explicit consent in advance.

People may read Google data only in cases Google allows:

  • The user explicitly agrees to a person reading the specific content needed for support
  • Access is necessary for security, such as investigating a security bug or abuse
  • Access is necessary to comply with applicable law
  • The information is genuinely aggregated and anonymized and used only for internal operations allowed by Google

We will not sell Google data or use it for advertising of any kind or creditworthiness or lending decisions. We will not use it to create, train, or improve AI models beyond the specific user’s personalized model for a permitted feature. Our current no-training commitment still applies.

These restrictions also apply to information derived from Google data, including aggregated or anonymized forms.

Information accessed or obtained through Microsoft APIs, including Microsoft Graph, is subject to the Microsoft APIs terms. “Microsoft APIs Data” includes API-derived identity information, mail, files, and metadata, and any aggregated, anonymized, or derived forms, whether or not they identify a person.

We will:

  • Request only the minimum permissions and data needed for the intended feature, and never request, use, or make data available outside the customer’s expressly granted permissions.
  • Obtain all necessary consent before processing and additional consent if processing changes.
  • Keep copies up to date and reflect corrections, restrictions, and deletions made in the source data.
  • Delete all Microsoft APIs Data associated with a user when they abandon or uninstall Helmstead, close their Helmstead account, or abandon that account. This includes copies held by us or providers acting on our behalf. No separate deletion request is needed.

These deletion duties take priority over general history and backup retention. We may preserve specific information only where required by law, for the required purpose and duration.

We will not use or transfer Microsoft APIs Data for advertising or marketing. This includes identity information obtained through Microsoft APIs, even if it resembles a business contact record. Independently obtained business contacts may be used under the marketing rules below; we will not relabel API-derived information as independent contact data to bypass this restriction.

These rules concern Microsoft as a source of connected data. Microsoft Azure OpenAI hosting has separate terms. Sending Microsoft-source data to an AI provider does not remove its source-specific restrictions. See Microsoft access controls to revoke permissions.

“QuickBooks data” includes the User Data and Personal Information accessed through Intuit’s services, including company financial data that does not identify a person. We will follow Section 12.2 of the Intuit developer terms, dated 14 October 2025. These limits also cover copies and information derived from QuickBooks data.

Suverenum Inc. does not process QuickBooks User Data or Personal Information on Intuit’s behalf. We may process it on the customer organization’s instructions under its own data processing addendum with us. That does not make us Intuit’s processor or subprocessor. Our legal role depends on the actual processing purpose and applicable law, not a contract label.

We store, process, and use QuickBooks data only to provide Helmstead’s features to users, within their consent, Intuit’s permitted uses, and applicable law. Permissions remain tied to the connected company and customer organization; copying data or deriving new information does not create a new permission.

We don’t sell QuickBooks data. We will make it available to third parties, including service providers and AI providers, only for uses that directly support or facilitate the user’s access to or use of Helmstead. Before sharing, we will require written agreements with data-protection and security terms at least as restrictive as Intuit’s terms and applicable law, and enforce those obligations. Consent cannot authorize a prohibited use.

We keep each customer organization’s QuickBooks data isolated within its workspace. We don’t share one customer’s QuickBooks data with another customer or use it for cross-customer insights, evaluation, or benchmarking. Authorized people in that customer’s workspace and permitted service providers access it to support that customer’s use of Helmstead, not to supply data to another customer. Our no-advertising and current no-training commitments also apply.

If a user revokes consent, disconnects QuickBooks Online, or terminates, deletes, or stops using Helmstead, we will immediately stop accessing and processing the affected company’s QuickBooks data. This includes copies and derived information in workbooks, edit and conversation history, AI results, and execution or recovery copies. We will require service providers processing that data for us to stop immediately too.

Ordinary history periods, the 30-day deletion-completion aim, backup schedules, or a continuing customer purpose do not postpone this stop. A delay in Intuit completing revocation does not extend our permission either.

Stopping access and processing is separate from securely deleting copies. Disconnecting does not mean every stored copy is instantly erased. We will securely delete QuickBooks data on a valid user request made directly to us or through Intuit where it handles that request. If you make a valid request through Intuit, you don’t need to repeat it with us. Deletion covers affected copies and derived information held by us and service providers acting for us.

Copies awaiting secure deletion stay protected and out of active use. The only exception to secure deletion is for specific records we must keep to meet recordkeeping obligations under applicable law. Those records stay protected and out of active use, with processing limited to the legally required purpose and duration. We will securely delete them when the obligation ends.

Where a Xero connection is offered and enabled, we will use its data only for selected features within the granted permissions and use cases approved by Xero, under the Xero developer terms. “Xero API Data” includes information accessed, received, transmitted, or generated through the platform’s APIs, in raw or processed form. These restrictions cover that data and its derivatives, whether or not they identify a person.

  • We will not use Xero API Data to train, fine-tune, adapt, or enhance any AI model.
  • We will not pass Xero API Data to another third party, including an AI provider, without the associated user’s consent, or for any purpose or activity that conflicts with Xero’s terms. Consent cannot authorize a prohibited use. AI inference must also comply with Xero’s approved-use-case and data-use requirements; choosing an AI provider is not blanket permission for inference.
  • We will not sell user data or aggregate and supply user data or Xero API Data to another app or third party.

Cookies are small records stored by your browser. Local storage and similar browser databases can keep preferences, identifiers, or recovery data on your device. Pixels and similar tools can send information about a page visit or event to a provider.

We use these technologies for the following purposes:

Category Purpose
Sign-in and security Maintain sessions, recognize an authenticated browser, and protect access
Preferences and recovery Remember your website language for 365 days after each language choice and keep device-local workbook autosave recovery data
Analytics Understand page visits and feature use, diagnose problems, and measure website interactions
Advertising Measure campaigns and conversions, recognize browsers or devices, and help show relevant ads

We use PostHog for analytics on our own website, helmstead.co, and application, app.helmstead.co:

  • Website analytics automatically capture clicks and create heatmaps showing page interactions. These features are off in the application.
  • Session replay, which records visits for playback, is off on both.
  • A shared analytics cookie on helmstead.co and its subdomains can link website visits with signed-in application activity and the user’s organization. Its identifiers are pseudonymous: they replace names but can still be linked to a person.

We use Google Ads, Meta Ads, and LinkedIn Ads to reach prospective customers and measure advertising results. For advertising, we send marketing information in two forms:

  • Website and conversion events, including website activity and browser/device identifiers
  • Prospect and contact audiences that we upload or synchronize, such as email audiences, so the platforms can match marketing contacts to advertising audiences

These disclosures involve our marketing contacts and website/conversion events. Customer Content is excluded from advertising, including customer financial records, files, prompts, and AI answers. Google API data is also excluded from advertising, and Microsoft APIs Data is excluded from both advertising and marketing, including API-derived sign-in identities.

We treat these advertising disclosures as a sale or sharing wherever applicable privacy laws define them that way. This can apply even if we aren’t paid for the information.

Advertising providers may collect information about your activity over time and across other websites, apps, and services. They may match the events or contact information we provide with information they already hold, under their own privacy terms and applicable law.

We also send newsletters. Necessary service messages, such as account or security notices, are separate from marketing.

You can opt out of targeted advertising or the sale or sharing of your information, stop newsletters and other marketing messages, or withdraw consent for optional tracking.

Use app settings or email us to make any of these choices. You don’t need an account or identity verification for advertising opt-outs.

Where law requires prior consent for optional tracking or marketing, we will obtain it before that activity. Calling analytics “first-party” does not remove that requirement. Where applicable law requires us to honor an opt-out preference signal, including Global Privacy Control (GPC), we will treat it as a valid opt-out for the browser or device and any associated profile to the extent the law requires. You don’t have to email us as an additional condition for a legally valid signal.

The older Do Not Track (DNT) browser setting is different from GPC. Our analytics setup does not use DNT to change tracking behavior. This does not change our obligations to honor legally recognized opt-out signals.

Depending on the services enabled, providers may include:

Purpose Providers
Hosting and storage AWS, Vercel, Neon
AI processing AWS, Microsoft
Analytics PostHog
Error diagnostics Sentry
Email and contact handling Resend
Demo booking and CRM HubSpot
Advertising and campaign measurement Google Ads, Meta Ads, LinkedIn Ads

Providers receive information relevant to their work. Users and customer-selected services receive information within their permissions and instructions. Connected services have their own privacy terms for their separate activities.

We may share necessary information with professional advisers, to meet valid legal requirements, address fraud or claims, or handle a business transaction such as an acquisition. Applicable restrictions and safeguards still apply, including the extra limits for Google, Microsoft API, QuickBooks Online, and Xero data.

A lawful basis is the legal reason for using personal information. Customers need a basis for their instructions to us. For our own uses covered by EU/European Economic Area (EEA) or UK law, the table below links each purpose to its legal basis:

  • Consent means freely agreeing to a specific use with enough information to understand it. It isn’t permission for every use.
  • Legitimate interests requires a business purpose that needs the information, balanced against your rights.
  • Contract applies where information is needed to carry out a contract with you personally, or take steps you request before entering one. A contract with your employer doesn’t automatically give us this basis for your information.
What we use information for Legal basis
Professional contacts, account records, and messages: administer accounts, maintain business relationships, and answer inquiries or support requests Legitimate interests in providing services to customer organizations and helping their contacts
If you contract with us personally: information needed to fulfill that contract or take steps you request toward it Contract, limited to the individual and necessary use described above
Account, audit, security, and error records: protect reliability and security Legitimate interests in preventing misuse and investigating incidents
Optional cookie-based analytics linking visits and account activity, and advertising tracking Consent where required. Legitimate interests cannot replace required cookie or tracking consent
Business marketing contacts: newsletters, outreach, and uploaded/synchronized advertising audiences Legitimate interests in promoting Helmstead only where marketing rules and the rights-balancing assessment allow it; otherwise consent is required
Demo bookings and CRM contact records: hold the meeting, follow up, and manage a prospective business relationship Legitimate interests in answering demo requests and managing prospective customer relationships. Contract only where you would become the customer yourself. You can object at any time
Records needed to meet a specific applicable legal duty Legal obligation
Records needed to bring or defend legal claims Legitimate interests in bringing or defending those claims

Usability analysis concerns service activity, not general reuse of Customer Content. Marketing is separate from information needed to operate an account.

The Microsoft API deletion duties and QuickBooks Online stop-processing and secure-deletion duties take priority over all general history, retention periods, completion aims, and backup handling below. Their narrowly defined legal-retention exceptions apply. Other applicable source-specific restrictions also continue to apply.

Retention depends on whether information is still needed for its purpose, the customer’s instructions, and any actual legal duty:

  • Customer records, files, and workbooks: while needed for the customer’s ongoing work and history, subject to its retention and deletion instructions.
  • Contact and support records: while needed to answer an inquiry, resolve an issue, or maintain the business relationship.
  • Demo bookings and CRM contacts: up to 24 months after our last contact, unless they become part of a customer relationship.
  • Marketing records: while needed for permitted communications or audience membership. After an opt-out, we may keep a minimal record of the choice to avoid contacting the person again.
  • Activity, error, and security records: according to their relevance to the stated analysis, troubleshooting, or investigation, including whether an issue remains open.

Our active-service schedule is:

History How long it stays
Main conversations Until the user deletes them
Workbook conversations Up to 5 years after the last message
Workbook edit history Up to 5 years after each edit; deletion is handled separately from conversation deletion

These 5-year periods are maximums, not minimum retention requirements or guarantees that all history will remain available. Valid deletion requests, account closure, service termination, and applicable source-specific limits take priority.

Device-local workbook recovery data expires 7 days after its last saved update. Expired recovery data is removed when the application next checks or cleans that browser store; expiry does not guarantee an immediate background purge while the application is closed. You can remove it by clearing Helmstead’s site data in that browser. Deleting server records does not by itself clear copies on your device.

Where durable workbook processing is enabled, execution inputs are cleared when the run ends and expire within 1 hour of acceptance. Replay copies expire 24 hours after the run ends, no later than 25 hours after acceptance. Access expiry and physical cleanup are separate; saved conversations and workbook history follow their own clocks above.

To request deletion, email privacy@helmstead.co and identify the account, organization, or records involved, if known. We’ll work with the responsible customer where its instructions are needed. For QuickBooks data, a valid request through Intuit is also accepted, without a repeat request to us, as described in the QuickBooks data limits.

We aim to complete deletion within 30 days after a valid, authorized deletion request or the end of the customer’s service, subject to applicable law and customer instructions. This is a completion aim, not an absolute guarantee or a rule deleting all records 30 days after collection. It includes addressing relevant copies held by providers on our behalf; backup expiry follows the lifecycle described below. This aim does not postpone source-specific stop-processing or deletion duties or require a separate request where those duties already apply.

Legal response deadlines apply independently of this aim and any identity checks. Verification must not restart those deadlines or leave a request on hold indefinitely.

We may need specific records for longer to meet an actual legal duty, investigate a security incident, or handle a legal claim. That does not allow unrelated uses. Accounting or audit records aren’t automatically exempt from deletion. Identifiers still count as personal information if they can be linked to someone. For QuickBooks data, only the legally required recordkeeping exception in the QuickBooks data limits applies.

Removing active records and expiring backup copies can take different amounts of time. Backup lifecycles depend on the recovery period they cover, their age, and their replacement by newer usable copies. We will keep deleted information in backups protected and out of normal use until those copies expire or are securely deleted under the applicable rotation schedule. Access is restricted to recovery or necessary legal preservation. If a backup is restored, we will reapply deletion instructions and source-specific processing restrictions before any permitted active use. Customer processing terms can set a specific maximum backup-expiry period.

We market Helmstead to US customers, many of them international businesses. Information may be handled in the United States and other countries where providers operate. US hosting doesn’t guarantee US-only support access, error logs, AI processing, or backups.

For transfers subject to EU/EEA or UK restrictions, we will use an applicable legal mechanism and the protections required for the information and recipient. These include:

  • An applicable adequacy arrangement, meaning legal recognition of sufficient protection for the covered destination or recipient
  • Appropriate contractual safeguards, such as EU Standard Contractual Clauses and the relevant UK Addendum or International Data Transfer Agreement, with required assessments and protections

We will assess the destination’s protections and apply supplementary measures where needed. For customer-directed processing, agreed processing locations and transfer terms govern our use of providers. We will not make a restricted transfer unless the required safeguards are in place.

Email privacy@helmstead.co to ask about transfers affecting your data or request details or copies of applicable safeguards.

The product includes access checks, controls that separate organizations’ data, and audit and security records to help protect information. No service can promise absolute security.

Use the contact details above for any request. Rights and exceptions depend on the law, the information, and our role.

Where these laws apply, you can ask to access, correct, or delete information, restrict its use, or receive a copy you can use with another service (portability). You can object to uses based on legitimate interests. If we rely on your consent, you can withdraw it without affecting earlier lawful use.

Where the law gives you rights concerning significant automated decisions, you can ask for information about the decision, human intervention, and a way to challenge it. If a customer makes the decision using Helmstead, we’ll help route your request to that organization.

You can object to direct marketing at any time. You can also complain to your data-protection authority, including the UK Information Commissioner’s Office.

EU GDPR requests generally require a response without undue delay and within 1 month. Any legally allowed extension needs a timely explanation. Other requests follow their applicable legal deadlines.

For UK data-protection complaints, we will acknowledge receipt within 30 days, investigate, and tell you the outcome without undue delay. This is separate from rights-response deadlines and the deletion-completion aim.

Where the California Consumer Privacy Act applies, including to covered business-contact information, you can:

  • Ask what categories and specific information we hold, where it came from, why we use it, and who receives it
  • Get a copy or request corrections or deletion
  • Opt out of sale or sharing
  • Limit sensitive-information use where the law gives that right

We won’t unlawfully discriminate against you for using these rights. Advertising opt-outs don’t require an account or identity checks. An authorized agent can act for you, with proof of authority where allowed. See tracking and marketing choices for how to make a request.

The following map summarizes the current data flows described in this policy. Customer Content is normally handled on customer instructions and is excluded from advertising and cross-customer evaluation or benchmarking. Only our marketing-contact audiences and marketing website/conversion events are advertising-related disclosures.

In this table, “customer service recipients” means authorized customer users and the hosting, storage, connected-service, support, and selected AI providers needed for the requested feature. “Advertising” identifies disclosures to Google Ads, Meta Ads, and LinkedIn Ads for the two marketing flows above, including sale or sharing where the law defines them that way.

Information and California category Sources and purposes Recipients Advertising
Account names, work emails, organization membership, and roles — identifiers, customer-record information, and professional information Users, organizations, and sign-in services; access, account administration, and support Relevant identity, hosting, and email providers No
Marketing-contact emails and other contact details — identifiers and customer-record information Business contacts, forms, and introductions; newsletters and advertising audiences Email/contact providers; named ad platforms for contact audiences Yes, for marketing audiences
Website activity, conversions, and browser/device identifiers — identifiers and internet or electronic-network activity Marketing website visits and conversion events; analytics and campaign measurement PostHog, relevant hosting/diagnostic providers, and named ad platforms Yes, for marketing website/conversion events
Application activity and pseudonymous user/organization identifiers — identifiers and internet or electronic-network activity Application use; analytics, security, and troubleshooting, including linkage to website visits PostHog and relevant hosting/diagnostic providers No
Customer transactions, invoices, bank account/routing details, and vendor tax identifiers — customer-record information, identifiers, and commercial information Customers, Sage, QuickBooks, and files; instructed accounting and financial analysis Customer service recipients No
Employee identifiers, pay, payroll deductions, and employment records — identifiers, customer-record information, and professional or employment-related information Sage ingestion and customer-provided material, including uploads or connected mail/files containing these records; instructed accounting, payroll-related analysis, and workbook features Customer service recipients No
Files, workbooks, messages, attachments, prompts, AI answers, and metadata such as authors and site/library/drive names — identifiers, customer-record information, and categories reflected in the content Uploads, connected mailboxes/files, and assistant interactions; requested features, history, recovery, and support Customer service recipients No
Inferences about identifiable people, when produced — inferences Customer Content and requested AI analysis The same permitted recipients as the underlying Customer Content No
Social Security or other covered government identifiers, qualifying account credentials, private correspondence, and other covered sensitive content — sensitive personal information Sign-in/connection records, customer source systems, and uploads; access, security, and instructed features Providers needed for the function and authorized customer users where appropriate No

Categories overlap. For example, a Social Security number is both an identifier and sensitive personal information. A financial account or login combined with credentials that allow access can also be sensitive personal information under California law. Customer-provided material may contain protected-class information, biometric information, audio or visual material, education records, or other sensitive information. We handle that material as Customer Content, not as an advertising source.

Sensitive Customer Content is used for the customer’s instructed services and necessary protection of those services, not to build advertising profiles. You can request limits where California law gives that right. Retention periods and criteria are in how long we keep information.

We will not sell or share information we know belongs to someone under 16 without the authorization California law requires. Customer Content remains excluded from advertising regardless of age.

Covered access, deletion, and correction requests require acknowledgment within 10 business days and a response within 45 calendar days, with timely notice of any legally allowed extension. Covered sale/sharing opt-out and sensitive-information limitation requests must be handled as soon as feasible and no later than 15 business days.

We will review these California disclosures at least once every 12 months and update them as required by law.

Other US laws may give rights to access, correct, delete, or obtain a portable copy, and opt out of sale, targeted advertising, or certain profiling. Where you can appeal a decision, email privacy@helmstead.co with “Privacy appeal” and your request details.

People elsewhere, including Latin America and Asia, can use the same contact route for rights under local law. Coverage varies, including for business information and information we handle for customers.

Helmstead is for a professional business audience, not children. If customer records include a child’s information, we will handle requests according to our role, the customer’s instructions, and applicable law.

We will update the date and give notice of significant changes as required. New uses may need separate authorization or consent. Changing this policy does not supply that permission.