Privacy Policy

Who We Are

Helm is operated by HELM, a commercial establishment registered in the Commercial Register, Zahle, Lebanon, under No. 4014899, with its registered office at Baalbek, Al-Saadeh, Property No. 160, Lebanon. We decide how and why the personal data described in this policy is used, and we are responsible for it. When a business uses Helm for its own website or its own customers, that business decides how its customers' and visitors' data is used and is responsible for it; we hold and handle that data on its behalf and on its instructions. If you are a customer of such a business, contact the business first, and we will help it answer.

You can contact us about privacy matters at: contact@usehelm.host

What Data We Collect

Account and contact data — When you enquire about or subscribe to Helm, we collect your name, email address, and business name. For website build projects, we may also collect your website URL and brief description of your requirements.

Billing data — Payment is processed by Stripe, a third-party payment processor. We do not store your card details. We retain records of transaction amounts, dates, and subscription status.

Dashboard usage data — When you use your Helm dashboard, we log activity such as content edits, publish actions, and logins. This is used to provide version history, the activity log in your dashboard, and to improve the service.

Your website content — Text, images, and other media you upload or edit through the dashboard is stored on our servers so it can be delivered to your live website.

Conversations with Helm AI on our homepage — Helm AI, the guide on usehelm.host, asks a few questions to suggest a setup and a price. We keep the answers you choose (the kind of business, whether you have a website and its address if you give it, the tools you use today and what you want to improve), the setup it suggested, and the country your request came from as Cloudflare reports it. If you type a message, we keep what you typed and what the guide replied. If you leave a name, email address or phone number to be contacted, we keep those too; that is optional. We do not store your IP address with any of it.

Visits to our websites — When you visit usehelm.host, our documentation, the changelog, the status page, the partner portal, the website builder or your dashboard, we record the visit as described under "Our own websites" in section 6.

Your website's visitors — If analytics is on for your website, we record visits to it, as described under "Website analytics" in section 6. We show those figures to you. We also look at them ourselves, in our own admin panel, across all the sites we host, so that we can check analytics is working and understand how Helm is used. That includes, for example, totals and comparisons between sites, live visitor counts, and each site's pages, sources, campaign tags, countries, devices, browsers, events and behaviour. Section 4 explains how responsibility for this data is shared.

Technical data — We may collect IP addresses and browser information in server logs for security and abuse prevention purposes. This data is not linked to your account for marketing purposes.

How We Use Your Data

We use your data to:

• Set up and operate your Helm dashboard and provide the service
• Process your subscription payments and manage your billing
• Communicate with you about your account, support queries, and service updates
• Answer what you ask Helm AI on our homepage, suggest a setup, and, if you leave your details, follow up with you
• Maintain version history and activity logs within your dashboard
• Understand how our own sites are used, such as which pages are read and where people stop, so we can improve them
• Provide analytics about your own website to you, on your instructions
• Comply with legal obligations
• Investigate and prevent security incidents or misuse of the service

We do not use your data for advertising, and we do not sell or share your personal data with third parties for their marketing purposes.

Why We Process Your Data

We process your personal data for the following reasons:

• Contract — processing necessary to provide the service you have signed up for, or to answer you before you sign up, such as when you ask Helm AI on our homepage which setup fits your business
• Legitimate interests — for security logging, abuse prevention, and service improvement, including counting visits to our own sites. Our interest is knowing which pages people read and where they stop, so we can make Helm better. We keep what that involves small: no IP address is stored, and no name or account is attached to a visit, although a dashboard page's address can show which business it belongs to or which record is being viewed (section 6). You can switch it off at any time (section 9)
• Legal obligation — where we are required to process data by law

Helm is run from Lebanon, so Lebanese law applies to how we handle your data: Law No. 81/2018 on Electronic Transactions and Personal Data. We process your data only for the purposes set out in section 3, on the grounds above.

Analytics on your own website works differently. It is switched on by you, or by us on your behalf. For your use of it, you are responsible for your visitors' data and the legal basis for it is yours, and we record and show it to you on your behalf. Where we use the same figures ourselves, as described in section 2, we rely on our legitimate interest in running and improving Helm. A visitor to your website who has a question about their data should contact you, and we will help you answer it.

Data Storage and Security

Your data is stored on servers in Falkenstein, Germany (European Union), operated by Hetzner Online GmbH. We administer it from Lebanon, and some of the service providers listed in section 7 process parts of it in other countries, including the United States. We take the following measures to protect your data:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Access restricted to authorised personnel only
• Regular backups with secure off-site storage
• Password hashing using modern cryptographic standards

No method of transmission or storage is 100% secure. If we become aware of a data breach that affects your data, we will notify you as required by applicable law.

Data Retention

We retain your personal data for as long as your subscription is active.

When your subscription ends, your data is not deleted automatically. We keep it so that you can still ask us for an export, and so that you can pick your account back up later without having lost your content. You can ask us to delete it at any time — email contact@usehelm.host — and we will do so within 10 days of your request. Deletion removes your account, your content, your uploaded files and any website we host for you.

Encrypted backups are kept on a rotating schedule: every nightly backup for 30 days, then one a week for 12 weeks, then one a month for about two years. Data removed from our live systems can therefore remain in a backup for up to 25 months, until the last backup holding it is deleted. We keep them this long so that a fault found late can still be recovered from. We restore from backups only for disaster recovery.

Billing records (transaction amounts and dates) may be retained for up to 7 years for accounting and legal compliance purposes. Card details are never stored by us.

Server security logs are retained for up to 90 days.

Helm AI on our homepage — What you type to the guide, and its replies, are deleted 90 days after the conversation starts. The rest of the conversation record (your answers on its buttons, the setup it suggested, your country, and any contact details you chose to leave) is kept as a record of your enquiry until you ask us to delete it.

Website analytics — When someone visits a site we host for a client, we record the visit: the page's full web address, where they came from, any campaign tags in the link, a rough location worked out from their IP address, the device, the browser, the window size and how long the page took to load. We also record what they do there: the links and buttons they click (labelled by their text), links they follow to other sites, how far down the page they scroll, how long they spend on the page and on each part of it, that a form was sent (not what was typed into it), and any other events the site's developer has set up. We add an identifier made each day from their IP address and browser with a random key that is destroyed when the day ends, so that several pages count as one visit rather than several, and so that afterwards the identifier cannot be rebuilt from an IP address and browser, by us or anyone. We do not store the IP address itself. If the visitor's browser sends Global Privacy Control, we do not record the visit at all. A client can also give its visitors a switch that stops their visits to its site being counted in that browser; the choice is kept in the visitor's browser and never sent to us. Separately, a random identifier is kept in the visitor's browser tab, in session storage rather than a cookie. It groups one visit's pages together and lasts until the tab is closed, although a browser that restores or duplicates a tab can carry it over. If the visitor signs in to an account on that site, the visit is recorded against their own customer record, and so are the pages they viewed earlier in the same tab before signing in. These records are currently kept indefinitely.

Our own websites — We count visits to our own sites in the same way: usehelm.host, our documentation, the changelog, the status page, the partner portal, the website builder and your dashboard. For each page we record the page's address (the site, the path and any campaign tags, but nothing else from the link), the site you came from, your country, your device and your browser, and a daily identifier made from your IP address and browser in the same way. In the project wizard and the website builder we also record which step you reached, so we can see where people stop. A step is recorded without your name, account, IP address or browser: only the step, whether you moved forward or back, which kind of project you chose in the wizard, the time, and the tab identifier our public sites use (section 8), which links it to that tab's page views on our public sites. We do not record your name, your email address or your account against these visits, and we do not store your IP address itself. A page's address can still point to a business or a record: a dashboard address usually carries the business's own domain, and addresses in the dashboard and the partner portal can include the reference of the record being viewed, such as a customer, a section of your site, a course or lesson, or a submission. On our public sites the daily identifier is shared, so on any one day your visits to two of them count as one visitor. Page views in the parts of our service you sign in to (the dashboard, the partner portal, and the website builder while you are signed in) use a different identifier, so a signed-in page view is not linked to your visits to our public sites by any identifier we keep. You can switch this counting off at usehelm.host/privacy/visits (section 8), and we do not count your visits at all if your browser sends Global Privacy Control. If you have a dashboard or partner portal account, you can also switch off counting of your own use in its Settings. That choice belongs to your account, so it applies on every device, and in the website builder when you sign in with the same account; pages you open before signing in, such as the sign-in page, are still counted. These records are currently kept indefinitely.

Third Parties

We work with a limited number of third-party services necessary to provide Helm:

• Hetzner Online GmbH — server infrastructure provider in Falkenstein, Germany, where your dashboard data is stored.
• Stripe — payment processing. Your payment data is governed by Stripe's privacy policy.
• Resend — delivers the email we send you (account setup, support replies, service notices). Resend receives your email address and the content of the message. Based in the United States. Email a business sends to its own customers from its own domain through Helm is sent from Resend's EU region, in Ireland; Resend keeps its records of that email, including logs and message details, in the United States.
• Cloudflare — used for DNS, website delivery, bot protection (Turnstile), hosting of this marketing site, and encrypted backup storage. Cloudflare may process IP addresses and request metadata in accordance with their privacy policy.
• Anthropic — used by the Helm AI website builder and by Helm AI, the guide on our homepage. When you generate a site, the description you write and any reference images, logos or brand materials you upload are sent to Anthropic to produce the result. When you type a message to the guide, your message, the earlier messages of that conversation and the answers you gave on its buttons are sent to Anthropic to write the reply; choosing an answer on a button sends nothing to Anthropic. Based in the United States.
• Namecheap — domain registration and renewal, if you buy a domain through Helm. As domain registration requires, they receive the registrant's name, address and email address.
• Sentry — error reporting, so we can diagnose faults. Reports include the URL, the type of error and a stack trace. Cookies, the request body, authorisation headers, API keys and query strings are removed before anything is sent.

Two points we want to be exact about, because they are commonly assumed. Our email is split — messages we send you are delivered through Resend, listed above, so they reach your inbox rather than your spam folder; that means Resend sees your address and the content of the message. Mail we receive is handled by our own server on our own infrastructure. And in the two places where we work out an approximate location — the analytics tool, where a client enables it, and the currency shown on this marketing site — both are worked out on our own server from a local database; no visitor IP address is sent to any third party for either.

Partners — Partners are independent developers who introduce businesses to Helm. If you send us an enquiry after following a partner's referral link, that partner can see your business name, your name, your email address and any notes you wrote, in their partner portal, so that they can follow up and be credited for the introduction.

We do not use analytics, advertising, or tracking third parties on the Helm platform itself. We do count visits to our own sites ourselves, on our own server; section 6 explains what that records.

Cookies and Local Storage

The Helm dashboard, the partner portal and the website builder use a sign-in cookie to keep you logged in. It lasts 12 hours from when you last used it, or 30 days in the partner portal if you choose to stay signed in. If you choose to trust a device after entering a two-step verification code, a second cookie remembers that device for 30 days so that you are not asked for a code every time. Staff accounts that a business sets up for its own premises use a separate sign-in cookie, which lasts 8 hours from when it was last used, and never more than 7 days after they sign in. These cookies are strictly necessary for the service to work and do not track you across other websites.

Apart from the referral cookie below, our own code on usehelm.host sets no advertising or analytics cookies, and no third-party cookies. The bot check on our forms, and on the first answer you give or message you type to Helm AI, is Cloudflare Turnstile, which runs in Cloudflare's own frame (see section 7), and Cloudflare's network may set its own security cookies.

If you arrive at usehelm.host through a partner's referral link (one with ?ref= in the address), we set a cookie called helm_ref that holds the partner's referral code for 90 days. If you then send us an enquiry, the code is sent with it so that the partner who introduced you is credited, and that partner can then see your business name, your name, your email address and any notes you wrote in the enquiry (see section 7). The cookie holds only the partner's code, nothing about you, and a newer referral link replaces it.

The usehelm.host marketing website stores your detected currency preference (e.g. GBP, EUR, USD) in your browser's local storage so that prices are displayed consistently across visits. This preference is kept on your device, and is sent to us only with an enquiry or a deposit payment, so that we quote and charge you in that currency. Working it out in the first place takes a single request to our own server, which reads the approximate country from your IP address using a local database and returns only the currency; no IP address is sent to a third party for it. You can clear it at any time via your browser's storage settings.

Our own sites, the dashboard included, keep a random identifier in your browser's session storage, so that the pages of one visit are counted together. Our public sites use one, and page views in the parts of our service you sign in to use a separate one, so a tab in the website builder can hold both. The steps of the project wizard and the website builder always use the public one. Neither is a cookie, and each goes only to our own server with those visit records. Each lasts until you close the tab, although a browser that restores or duplicates a tab can carry it over. When you open your own website from your dashboard, or when we view your dashboard to support you, a flag kept in that tab's session storage stops its views being counted.

If you switch off visit counting at usehelm.host/privacy/visits, our server sets a cookie called helm_count_visits on usehelm.host and its subdomains: the documentation, the changelog, the status page, the partner portal, the website builder and the dashboard at dashboard.usehelm.host. It holds only that choice. Our pages check it and send nothing, and our server checks it and records nothing. It lasts 400 days, and while you keep visiting our sites it is renewed at most once a day; to know when it was last renewed, we keep that day's date in your browser's local storage. It does not reach a dashboard at a business's own domain. If your browser sends Global Privacy Control, we treat that as the same choice, on all our sites and on the sites we host for clients.

If you choose a light or dark appearance, or a language, on one of our sites, we remember the choice in a cookie (called helm-theme or helm-locale) shared across usehelm.host and its subdomains (on a dashboard at your own domain, it stays on that domain), and in your browser's local storage. Each holds only that choice, and the cookie lasts a year.

If you use Helm AI on usehelm.host, a random conversation identifier, a note that the conversation passed the bot check, and your answers so far are kept in your browser's session storage, so that a reload or another page of our site can bring you back to where you were. They are not cookies, and they last until you close the tab.

If you start the project form on usehelm.host, your answers so far are saved in your browser's local storage so that you can pick up where you left off. If you choose to pay a deposit, its reference and your email address are kept there too while the payment is in progress. They stay on your device, and anything older than seven days is no longer used and is deleted the next time the form is opened.

Your browser settings allow you to block or delete cookies and local storage, though doing so will affect your ability to stay logged into the dashboard.

Your Rights

Wherever you are, you have the following rights over the personal data we are responsible for (section 1):

• Access — you can request a copy of the personal data we hold about you
• Rectification — you can ask us to correct inaccurate data
• Erasure — you can ask us to delete your data (subject to legal obligations)
• Restriction — you can ask us to limit how we use your data in certain circumstances
• Portability — you can request your data in a structured, machine-readable format
• Objection — you can object to processing based on legitimate interests

Objecting to visit counting — You can stop us counting your visits to our sites at any time, without writing to us: use the switch at usehelm.host/privacy/visits, or turn on Global Privacy Control in your browser. From then on, we record nothing about your visits to the sites that choice covers (section 8 says which). For your own use of the dashboard or partner portal, you can also switch counting off in that account's Settings, and it then applies wherever you sign in (section 6). Since 28 September 2026 the identifier in each new visit record is made with a key destroyed at the end of that day, so it cannot be used to look up your visits from your IP address and browser. Records from before that date were made with a key we still hold. Until their identifiers are replaced in the same way, we could still match one of them to an IP address and browser. The records carry no name, account or IP address.

To exercise any of these rights, email us at contact@usehelm.host. We act on every request within 10 days, free of charge.

If you are not satisfied with our answer, Lebanese law (Law No. 81/2018) lets you apply to the competent courts, including the Judge of Urgent Matters. If you are in the European Union, you may also complain to your national data protection supervisory authority.

Children

Helm is a business service and is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email. The "Last updated" date at the top of this page reflects when the policy was last revised.

Your continued use of Helm after an update constitutes acceptance of the revised policy.