Privacy Policy

• Account identifiers — your work email, display name, and tenant role.
• Authentication metadata — magic-link tokens (single-use, 24-hour expiry), OAuth provider IDs if you use SSO, and last sign-in timestamps.
• Session devices — for each active sign-in we store your browser/operating-system (from the User-Agent) and a last-active time, shown only to you under Account → Security so you can recognise and revoke your own sessions. No IP or location is stored for this; the record is deleted when the session expires or is revoked.
• Tenant data — anything your HR team enters: employee records, projects and assignments, time-off, onboarding, reviews. Treated as your customer data.
• Audit log — actor, IP, action, target row id, timestamp. Required for GDPR Article 30 records of processing.
• Operational telemetry — error rates, request latency, feature state. Aggregated; not used to profile individuals.

• No session-replay, heatmap, or behaviour-recording tools. We use Vercel Analytics on our MARKETING pages only (cookieless, no cross-site identifier); it is switched off inside the application, so no URL containing an employee, candidate, or invoice identifier ever leaves your browser.
• No advertising trackers. We don't sell, share, or rent personal data — ever.
• No biometric data, no precise geolocation, no behavioural fingerprinting.

• Active tenant data — for the lifetime of your subscription.
• Backups — encrypted, 30 days rolling.
• Audit log — up to 7 years (statutory record-keeping in most EU jurisdictions).
• Magic-link tokens— deleted on use, or after 24 hours.
• Sessions — expire after 7 days.

• Supabase (Frankfurt, EU) — primary database + storage.
• Vercel (Frankfurt, EU) — application hosting + serverless functions.
• Resend (EU) — transactional email (magic links, invitations, notifications).
• Cloudflare — DNS and inbound email routing for our domain.
• Google — identity provider, only if you choose to sign in with Google SSO.
• Paddle (EU) — billing + VAT, activated only when paid plans launch and you choose to upgrade.
• OpenAI (US) — powers the optional AI features (see section 9). Only the specific fields needed for a given AI action are sent, under a no-training agreement (your data is not used to train models), and only when you invoke an AI feature.

Helia AI is assistive, not autonomous: it drafts and summarises to save time, and a person always reviews, edits, and owns the result. Helia AI never makes an automated decision about a person (no automated hiring, firing, rating, or pay decisions — GDPR Art. 22), and never takes an irreversible action on its own.

• What is sent:only the fields relevant to the feature you invoke (e.g. a growth plan sends the employee's grade criteria, goals, and pooled anonymous feedback). We never send salary/pay into AI prompts.
• Anonymity is preserved: AI summaries of anonymous feedback (e.g. eNPS) stay aggregate and never re-identify a respondent.
• Processor + no training: AI runs server-side via OpenAI under a no-training agreement; prompts are not used to train models.
• Optional: AI features run only when a permitted user clicks to use them; they can be left unused.

Full detail: How Helia AI works.

• TLS 1.2+ in transit; AES-256 disk-level encryption at rest.
• Row-level security on every table — tenants are isolated at the database layer, not just in the app.
• Sensitive fields (e.g. compensation, dependants) are restricted to HR/owner roles and every access is recorded in the audit log. Dedicated field-level encryption for salary and national-id is on our roadmap.
• Secret-scanning in CI, dependency monitoring, rate limiting, a locked-down Content-Security-Policy, and an internal security review. Independent penetration testing is planned as we grow.