Privacy policy

• Sign-in details. Your email address. If you sign in with Google, also your name and profile photo from Google. Sign-in links are emailed through Resend.
• Your store link and store check results. If you give us your store link, Helix reads your public home page, one product page, your public product list, cart endpoint and robots.txt. It keeps the results and the fix list.
• Business numbers you enter. Daily sales, orders, ad spend, costs, prices, product and stock details, suppliers, goals and anything you upload by CSV.
• Onboarding answers. Your country, revenue band and answers to the quick questions.
• Progress. Lessons, cards and tasks you finish, plans, approvals and a log of actions in your account.
• Meta data, only if you connect Meta. See below.
• Shopify data, only if you connect Shopify. See below.
• Google Ads data, only if you connect Google Ads. See below.
• What you ask the AI helper. If you use an AI feature, the question you type or the data it summarises, and the answer. See below.
• Messages you send us. If you use the contact form: your name, email address, topic and message. If you are signed in, also your account ID and plan.
• Members group. On a paid plan, we keep a list of members to let into, or remove from, our private Facebook group. This holds your name, email address and plan status.
• Community posts and requests. Wins you share on the Wins wall (with your first name), and store review requests you send us (your store link, your note and your email address, sent to our support inbox).
• Billing status. Your plan and your Stripe customer and subscription IDs. We never see or store your card number.
• Basic technical data. Our hosting provider processes IP addresses and request logs to deliver and protect the site.

We do not ask for sensitive information (such as health, religion or political views). Please do not enter it. You can use the public lessons without giving us anything.

If you choose to connect Meta, you sign in with Facebook Login for Business and grant permissions on Meta's own screen. Helix then reads:

• your Facebook user ID and name,
• the ad accounts, Facebook Pages (and any linked Instagram account) and pixels you can access, so you can pick which ones to use,
• campaign results (spend, sales, cost per sale and similar insights), once a day.

When you ask it to, Helix creates new campaigns in your ad account as paused drafts. It never switches on spend or changes live budgets.

Your Meta access token is encrypted (AES-256-GCM) before it is stored. It lasts about 60 days, then Meta asks you to reconnect. Disconnect any time under Connections in Helix: we remove our access at Meta and delete the token and synced data. You can also remove Helix in Facebook under Business Integrations, and Meta tells us to delete your data.

Meta Platform Terms. We use Meta data only to show you your own results and build drafts you asked for. We do not sell it, license it, share it with advertisers or data brokers, use it to build profiles of people, or use it for any purpose other than providing Helix to you.

If you choose to connect Shopify, you approve Helix on Shopify's own screen. Helix asks only for read access to orders, products and inventory. Once a day it reads, for your store only: order dates, totals, discounts, refunds and line items (product name, SKU, quantity, price), product unit costs, product counts and stock levels. It turns these into daily totals and product lines in your dashboard. Helix does not store customer names, emails, phone numbers or addresses, and it never changes anything in your store.

Your Shopify access token is encrypted (AES-256-GCM) before it is stored. Disconnect any time under Connections: we remove our access at Shopify and delete the token and the product lines that came from Shopify. Uninstalling Helix in your Shopify admin does the same. We also handle Shopify's privacy requests (customer data requests, customer erasure and shop erasure).

Google sign-in is optional. If you use it, Helix receives only your basic profile (email address, name and photo) to create and sign in to your account.

If you choose to connect Google Ads, you sign in on Google's own screen and grant the Google Ads permission. Helix then reads the Google Ads accounts you can access (so you can pick one) and, once a day, campaign results for that account: campaign names and status, spend, clicks, impressions, conversions and conversion value. When you approve it in Helix, Helix creates a new Search campaign and budget in that account, always paused. It never switches on spend or changes live budgets. The Google refresh token is encrypted (AES-256-GCM) before it is stored. Disconnect any time under Connections: we revoke our access at Google and delete the token and synced data. You can also remove Helix in your Google Account under Third-party connections.

Google API Services User Data Policy. Helix's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We use it only to sign you in and to show you your own ad results and build drafts you asked for, never for advertising, never sell it, never use it to train AI models, and do not let people read it except with your permission, for security, or where the law requires.

Some features can use AI to write short text: a plain-English summary of your store check, ad copy drafts and answers to "I'm lost" questions. They only run when you press the button. Helix sends the request through the Vercel AI Gateway to the model provider (currently Google's Gemini models). We send only what the feature needs, such as your store link, store check findings, product name, plan and the question you typed. We do not send your email, name or tokens. Answers are cached so the same request is not sent twice, and each call is logged (feature, size and cost) to enforce monthly limits. We do not use your data to train AI models. Helix turns on the AI Gateway's "disallow prompt training" option, so requests only go to providers that do not use prompts or answers to train models; if none is available the request is not sent (Vercel). For Gemini the gateway uses Google Vertex AI or the Gemini API on Google's paid terms, under which Google does not use prompts or answers to improve its products but keeps them for a limited time to detect abuse and for legal reasons (Gemini API terms). The model provider handles each request under its own terms with Vercel. If AI is off or a limit is reached, Helix shows its standard advice instead.

• To provide Helix to you: your account, dashboard, lessons, store check and connections. GDPR basis: performance of our contract with you.
• To bill paid plans and keep tax records. Basis: contract and legal obligation.
• To keep Helix secure and prevent abuse. Basis: our legitimate interests in running a safe service.
• To send sign-in links and service emails (such as receipts and important changes). Basis: contract.
• Product emails (daily steps, event reminders, alerts, the weekly scorecard and win-back emails). We send these to account holders. In Australia this relies on consent inferred from your account under the Spam Act 2003. Elsewhere it relies on our legitimate interests. Every one has a one-click unsubscribe, and you can switch each type off in Settings.

We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising. Your data is only sent to an AI service when you press an AI button, as described above, and we never use it to train AI models. There are no analytics or advertising trackers on the site. We do not make automated decisions that have legal or similarly significant effects on you.

We only use what is needed to run the site:

• a session cookie that keeps you signed in (and related security cookies used by our sign-in system),
• short-lived security cookies during Meta, Shopify and Google Ads sign-in,
• your browser's local storage to remember lesson ticks and card positions on your device.

No tracking or advertising cookies, so there is no cookie banner. Clearing your browser data removes them; you will be signed out.

Your data is stored and processed by our providers, mainly in the United States. We take reasonable steps so these providers protect it to a standard similar to the privacy laws we follow. For data from the EEA or UK, we rely on our providers' data processing terms, including the European Commission's Standard Contractual Clauses and the UK Addendum, or the EU-US Data Privacy Framework where a provider is certified.

• Account data: while your account is open. When you delete your account, it is deleted from our database straight away.
• Meta data: until you disconnect Meta or delete your account. The token expires by itself after about 60 days.
• Shopify and Google Ads data: until you disconnect, uninstall or delete your account.
• AI answers and usage logs: until you delete your account.
• Wins and store review requests: until you delete your account or ask us to remove them. Copies of review emails stay in our support inbox for up to 2 years.
• Billing records: Stripe keeps its own payment records for as long as the law requires.
• Backups and logs: held by our providers and removed within their normal retention windows.

All traffic uses HTTPS. Meta, Shopify and Google tokens are encrypted. No system is perfectly secure; if a data breach is likely to cause you serious harm, we will tell you and the OAIC as the Notifiable Data Breaches scheme requires (and EEA/UK regulators where the GDPR requires).

• Access and export: Settings, then Download my data, gives you everything in one file.
• Correct: change your details and numbers in the app, or email us.
• Delete: Settings, then Delete my account. See data deletion for every option.
• EEA and UK: you can also object to or restrict our use of your data, ask for portability, withdraw consent, and complain to your local data protection authority (in the UK, the ICO).
• California (CCPA): you can ask to know what personal information we collect, use and disclose, ask us to delete or correct it, and you will not be treated differently for using these rights. We do not sell or share personal information, so there is nothing to opt out of. The categories we collect are listed above: identifiers, commercial information about your subscription, internet activity on Helix, and business data you enter.

Contact us through our contact page using your sign-in address to use any right. We may need to confirm it is you. We reply within 30 days (or sooner where the law requires).

Helix is for business owners aged 18 or over. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you think a child has given us data, email us and we will delete it.

Contact us through our contact page first and we will try to fix it. If you are not happy with our answer, you can complain to the privacy regulator where we operate or your local data protection authority.

If we change this policy we will update the date at the top, and email you before an important change takes effect.