Terms & Policies

This Privacy Policy explains how Helin ("Helin", "we", "us", "our") collects, uses, stores, and shares personal data when you use the Helin website, dashboard, and services at gethelin.com (the "Service"), or when you interact with a Helin-powered chat widget embedded on a customer's website.

Helin is an AI customer-support agent for SaaS companies. Our customers embed a Helin chat widget on their websites; the widget answers their visitors' questions using a knowledge base the customer provides.

If you do not agree with this policy, please do not use the Service.

Contact: support@gethelin.com. Helin is operated by Dede Wiranto, an individual sole proprietor based in Indonesia.

Helin handles personal data in two distinct capacities. Your rights and who you should contact depend on which group you fall into:

a) You are a Helin customer (or their team member), we are the data controller. If you create a Helin account, we decide how and why your data is processed, and this policy applies to you directly.

b) You are a visitor chatting with a Helin widget on someone else's website, we are a data processor. The company whose website you are visiting (our customer) is the data controller of your data. We process your chat messages and any details you submit on that company's behalf and under their instructions. Their privacy policy governs that processing; please direct privacy requests to them first. If you contact us directly, we will forward your request to the relevant customer where required.

3.1 From customers (account holders)

Sign in with Google: when you sign in with Google, we receive your name, email address, and profile picture from Google. We use this information solely to create and authenticate your account. We do not sell or share Google user data with third parties.

3.2 From end users (visitors chatting with the widget), processed on our customers' behalf

The widget does not use advertising trackers and does not build cross-site profiles of visitors.

We do not sell personal data. We do not use your knowledge base content or your visitors' conversations to train AI models, neither our own nor third parties'. Our AI subprocessors are contractually bound to the same restriction (API data is not used for model training).

When a visitor sends a message to a Helin widget:

1. The message is checked for safety and relevance, and rewritten for better search.
2. Relevant excerpts are retrieved from the customer's knowledge base (semantic search).
3. The message and those excerpts are sent to our AI subprocessors (OpenAI for answer generation; Voyage AI for search embeddings and reranking) solely to produce the answer.
4. The answer is generated strictly from the customer's knowledge base content.

Credit-card masking: before a visitor's message is stored, sent to our AI providers, or delivered to notification integrations, Helin automatically detects and masks any credit-card number in it, keeping only the last 4 digits. Full card numbers are never stored. (Email addresses and phone numbers are not masked, as customers need them to provide support and follow up on leads.)

AI subprocessors process this data under data processing agreements as processors; they do not use it for their own purposes or for model training.

AI limitations: answers are machine-generated and may occasionally be inaccurate or incomplete despite grounding safeguards. Conversations may be reviewed by the customer (the website owner) in their dashboard.

We share personal data only with service providers who help us run Helin, under data processing agreements:

Our AI providers (OpenAI, Voyage AI) do not use the data to train their models.

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you).

We will update this list before adding or replacing subprocessors and, where required, notify customers with an opportunity to object.

• Dashboard: we use strictly necessary cookies for authentication and session management (Supabase Auth). We do not use third-party advertising cookies.
• Widget: the widget stores a conversation identifier in the visitor's browser (local storage) so a conversation persists for up to 24 hours if they leave and return. This is strictly necessary for the chat function and is not used for tracking across sites.

We operate globally. Data may be processed in countries other than your own, including the United States (AI subprocessors) and Singapore (ap-southeast-1, our Supabase project region). Where data of EEA/UK/Swiss residents is transferred to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards in our subprocessor agreements.

Deletion runs automatically on a daily basis according to these rules:

Delete visitor data: customers can erase all data for a specific visitor at any time using the "Delete visitor data" button in the dashboard, which deletes that visitor's conversations, leads, and files. This supports the GDPR right to erasure.

Depending on where you live (e.g. GDPR in the EEA/UK, CCPA/CPRA in California, UU PDP in Indonesia), you may have the right to:

• Access the personal data we hold about you and receive a portable copy;
• Correct inaccurate data;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Withdraw consent at any time (where processing is based on consent);
• Opt out of sale/sharing of personal data (California; note: we do not sell or share personal data for cross-context advertising);
• Not be discriminated against for exercising these rights;
• Complain to your supervisory authority.

To exercise these rights, email support@gethelin.com. We respond within the timeframe required by applicable law (e.g. 30 days under GDPR, 45 days under CCPA). We may need to verify your identity first.

Widget visitors: because we act as a processor, please contact the website owner (our customer) first. They control your data. We support them in fulfilling your request.

We take commercially reasonable technical and organizational measures to protect personal data, including: encryption in transit (TLS) and at rest, row-level security isolating each workspace's data, access controls and least-privilege keys for internal systems, isolation of the widget from host websites, and hardening against common web attacks. No system is 100% secure; we will notify affected customers and authorities of personal data breaches as required by law.

The Service is a business tool and is not directed at children under 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect children's data. Customers are responsible for ensuring their own websites' compliance regarding minors.

We may update this policy from time to time. We will post the new version on this page with an updated "Last updated" date, and for material changes we will notify customers by email or in-app notice before the changes take effect.

Helin is operated by Dede Wiranto, an individual sole proprietor based in Indonesia.
Email: support@gethelin.com