Privacy Policy

Last updated: 28 July 2026

1. Who we are

Helpling.ai ("we", "us") is a trading name operated as a sole trader in the United Kingdom. We are the data controller for personal data processed through the Helpling.ai platform. Contact - privacy queries: privacy@helpling.ai

2. Data we collect

3. How & why we use your data (legal bases under UK GDPR)

• Provide the Service – create your account, fine-tune your model, generate content (Contract)
• Billing & fraud prevention – process payments, enforce usage limits (Legitimate interest / Contract)
• Product improvement – analyse aggregated usage, fix bugs (Legitimate interest)
• Support & comms – respond to tickets, send system emails (Legitimate interest)
• Marketing – send newsletters (only with your Consent; opt-out anytime)
• Compliance – record-keeping, tax, legal requests (Legal obligation)

4. How long we keep data

• Account & billing records – 7 years after account closure (statutory)
• User Content & models – deleted within 30 days of account deletion or on request
• Server logs – 90 days, unless required for security investigations

5. Sub-processors & data locations

Your data may be transferred outside the UK/EU. We rely on UK “adequacy decisions” or Standard Contractual Clauses (SCCs) where required.

• OpenAI (USA) – AI model hosting, content generation, and automated summarisation of business data including support conversation content (SCCs, UK Addendum)
• Supabase (EU / USA) – database, auth, storage (SCCs)
• Stripe (EU/USA) – payments (SCCs)
• Resend (USA) – transactional email (SCCs)
• Vercel (EU/USA) – application hosting (SCCs)

An up-to-date list is always available at helpling.ai/subprocessors.

OpenAI — support conversation processing

If you connect a customer support platform (e.g. Gmail, Gorgias, Zendesk), Helpling will retrieve your support conversations and send the message content to OpenAI to generate a short anonymised summary (topic, sentiment, and product mentions only). The full message body is not stored by Helpling — only the summary is retained. This processing is carried out under your instruction as part of the Helpling service (Contract legal basis, UK GDPR Article 6(1)(b)). You can disconnect your support platform at any time from the Integrations page.

Google API Services — Limited Use

When you connect a Google service (Search Console, Analytics, Google Ads, YouTube, or Google Merchant Center), Helpling reads performance and account data from Google APIs on your behalf. The following applies to all Google user data processed by Helpling:

• Data accessed: Search Console query/impression/click/ranking data; GA4 session/traffic/conversion data; Google Ads campaign/keyword/cost/conversion data; YouTube channel/video/engagement metrics; Merchant Center product listing status.
• Data use: Solely to generate recommendations and insights within your private Helpling.ai dashboard. Used for no other purpose.
• Data transfer: Never sold, rented, or shared with third parties. Raw Google API data is not passed to OpenAI or any AI service — only server-generated anonymised summaries are used when producing recommendations.
• Data retention: Statistics retained on a rolling 25-month basis with automated nightly cleanup. All integration data deleted within 30 days of account deletion.
• Disconnection: You can disconnect any Google integration at any time from the Integrations settings page. Historical synced data can be deleted on request to privacy@helpling.ai.

Limited Use statement: The use of raw or derived user data received from Google APIs (including Search Console, Analytics, Ads, YouTube, and Merchant Center APIs) will adhere to the Google User Data Policy, including the Limited Use requirements.

6. Security measures

• All traffic encrypted in transit (TLS 1.3)
• Data encrypted at rest (AES-256) in Supabase
• Row-level security to isolate each tenant’s data
• Regular penetration tests & vendor audits
• Staff access limited by role and logged

7. Cookies & analytics

We use essential cookies for login and CSRF protection. Optional analytics cookies (Plausible Analytics) are used only with consent. See our separate Cookie Policy.

8. Your rights

You can exercise these rights at privacy@helpling.ai:

• Access – receive a copy of personal data we hold about you
• Rectification – correct incomplete or inaccurate data
• Erasure – request deletion (the “right to be forgotten”)
• Restriction – pause processing while a dispute is resolved
• Portability – obtain data in a machine-readable format
• Objection – object to processing based on legitimate interests
• Withdraw consent – for marketing at any time
• Lodge a complaint – with the UK ICO (ico.org.uk)

9. Children

The Service is not intended for children under 16. We do not knowingly process their data.

10. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. Significant changes will be notified via email or in-app notice at least 7 days before they take effect.

11. Privacy in a butshell

Your eyes only. Training files and fine-tuned models live in your private Supabase schema; no other Helpling.ai tenant (or Helpling staff) can read them without your permission. OpenAI can’t recycle your data.** We disable OpenAI’s data-sharing toggle (see below) so your prompts, training JSONL and model outputs are *not* used to improve OpenAI’s public models. Training files and prompts are sent with the OpenAI-Data-Usage-Opt-Out flag, so they are excluded from OpenAI’s model-improvement programme.

12. Contact

Dan Rowland
Helpling.ai
Email: privacy@helpling.ai
Tel: +44 113 8730 688
1 Highfield Gardens, Dewsbury, West Yorkshire. WF12 0SE.