Privacy Policy

Last updated: 27 September 2026

1. Who we are

Helpling.ai ("we", "us") is a trading name operated as a sole trader in the United Kingdom. We are the data controller for personal data processed through the Helpling.ai platform. Contact - privacy queries: privacy@helpling.ai

2. Data we collect

3. How & why we use your data (legal bases under UK GDPR)

• Provide the Service – create your account, give the Helpling assistant the business context it needs, generate content (Contract)
• Billing & fraud prevention – process payments, enforce usage limits (Legitimate interest / Contract)
• Product improvement – analyse aggregated usage, fix bugs (Legitimate interest)
• Support & comms – respond to tickets, send system emails (Legitimate interest)
• Marketing – send newsletters (only with your Consent; opt-out anytime)
• Compliance – record-keeping, tax, legal requests (Legal obligation)

4. How long we keep data

• Account & billing records – 7 years after account closure (statutory)
• User Content & models – deleted within 30 days of account deletion or on request
• Server logs – 90 days, unless required for security investigations

5. Sub-processors & data locations

Your data may be transferred outside the UK/EU. We rely on UK “adequacy decisions” or Standard Contractual Clauses (SCCs) where required.

• OpenAI (USA) – AI model hosting, content generation, and automated summarisation of business data including support conversation content (SCCs, UK Addendum)
• Supabase (EU / USA) – database, auth, storage (SCCs)
• Stripe (EU/USA) – payments (SCCs)
• Resend (USA) – transactional email (SCCs)
• Vercel (EU/USA) – application hosting (SCCs)

An up-to-date list is always available at helpling.ai/subprocessors.

OpenAI — support conversation processing

If you connect a customer support platform (e.g. Gmail, Gorgias, Zendesk), Helpling will retrieve your support conversations and send the message content to OpenAI to generate a short anonymised summary (topic, sentiment, and product mentions only). The full message body is not stored by Helpling — only the summary is retained. This processing is carried out under your instruction as part of the Helpling service (Contract legal basis, UK GDPR Article 6(1)(b)). You can disconnect your support platform at any time from the Integrations page.

Google API Services — Limited Use

When you connect a Google service (Search Console, Analytics, Google Ads, YouTube, or Google Merchant Center), Helpling reads performance and account data from Google APIs on your behalf. The following applies to all Google user data processed by Helpling:

• Data accessed: Search Console query/impression/click/ranking data; GA4 session/traffic/conversion data; Google Ads campaign/keyword/cost/conversion data; YouTube channel/video/engagement metrics; Merchant Center product listing status.
• Data use: Solely to generate recommendations and insights within your private Helpling.ai dashboard. Used for no other purpose.
• Data transfer: Never sold, rented, or shared with third parties. Raw Google API data is not passed to OpenAI or any AI service — only server-generated anonymised summaries are used when producing recommendations.
• Data retention: Statistics retained on a rolling 25-month basis with automated nightly cleanup. All integration data deleted within 30 days of account deletion.
• Disconnection: You can disconnect any Google integration at any time from the Integrations settings page. Historical synced data can be deleted on request to privacy@helpling.ai.

Limited Use statement: The use of raw or derived user data received from Google APIs (including Search Console, Analytics, Ads, YouTube, and Merchant Center APIs) will adhere to the Google User Data Policy, including the Limited Use requirements.

Shopify — Store data

When you connect your Shopify store (either from the Helpling.ai website or by installing the Helpling.ai app from within Shopify Admin), Helpling reads store data from the Shopify Admin API on your behalf.

• Data accessed: Order IDs, order totals, and order counts; product and collection information (titles, descriptions, prices, stock levels, images, tags); blog and blog post content; and an internal Shopify customer identifier plus that customer's lifetime order count, used only to distinguish new from returning customers in your order statistics. We do not access customer names, email addresses, phone numbers, or physical addresses, and this identifier is never combined with, or used to look up, any of those details.
• Data use: Solely to generate recommendations and insights within your private Helpling.ai dashboard and through the Ask Helpling assistant. Used for no other purpose.
• Data transfer: Never sold, rented, or shared with third parties. Raw Shopify order data is not passed to OpenAI or any AI service — only server-generated aggregated summaries (for example, total revenue or order counts) are used when producing recommendations.
• Data retention: Order statistics are retained for up to 60 months on a rolling basis, with automated nightly cleanup, to support multi-year seasonal comparisons. Helpling can only read the most recent 60 days of a store's orders when it is first connected, so your history builds up gradually from the day you connect. Per-order line-item data (which includes the internal customer identifier described above) is retained for a shorter rolling 25 months. All integration data is deleted within 30 days of account deletion.
• Disconnection: You can disconnect Shopify at any time by uninstalling the Helpling.ai app from your Shopify Admin (Settings → Apps and sales channels). Historical synced data can be deleted on request to privacy@helpling.ai.

Our use of data accessed through Shopify APIs complies with the Shopify API License and Terms of Use, including Shopify's requirements for apps that request access to protected customer data.

Meta (Facebook & Instagram & Meta Ads) — Page, Instagram and Ads data

When you connect your Facebook Page, Instagram account, or Meta Ads account, Helpling reads performance data from Meta's APIs on your behalf, using Facebook Login. Facebook Login is used only to grant this read access — it is not used to sign in to Helpling.ai itself, which has its own separate email/password login.

• Data accessed: Facebook Page posts and their performance (reach, views, likes, comments, shares); Instagram Business account media and their performance (reach, views, likes, comments, shares, saves); Meta Ads campaign performance (spend, reach, clicks, conversions). If your Page is owned by a Meta Business Portfolio, Helpling also reads the list of Business Portfolios and Pages you manage, solely to locate that Page.
• Data use: Solely to generate recommendations and insights within your private Helpling.ai dashboard. Used for no other purpose. Helpling never posts, comments, replies to messages, or manages ads on your behalf.
• Data transfer: Never sold, rented, or shared with third parties. Raw Meta API data is not passed to OpenAI or any AI service — only server-generated aggregated summaries are used when producing recommendations.
• Data retention: Post and campaign performance statistics are retained for up to 25 months on a rolling basis, with automated nightly cleanup, the same as our other integrations. All integration data is deleted within 30 days of account deletion, or sooner on request.
• Disconnection: You can disconnect Facebook & Instagram or Meta Ads at any time from the Integrations settings page — this also revokes Helpling's access directly with Meta. Historical synced data can be deleted on request to privacy@helpling.ai.

Our use of data accessed through Meta's APIs complies with the Meta Platform Terms and Developer Policies.

6. Security measures

• All traffic encrypted in transit (TLS 1.3)
• Data encrypted at rest (AES-256) in Supabase
• Row-level security to isolate each tenant’s data
• Regular penetration tests & vendor audits
• Staff access limited by role and logged

7. Cookies & analytics

We use essential cookies for login and CSRF protection. Optional analytics cookies (Plausible Analytics) are used only with consent. See our separate Cookie Policy.

8. Your rights

You can exercise these rights at privacy@helpling.ai:

• Access – receive a copy of personal data we hold about you
• Rectification – correct incomplete or inaccurate data
• Erasure – request deletion (the “right to be forgotten”)
• Restriction – pause processing while a dispute is resolved
• Portability – obtain data in a machine-readable format
• Objection – object to processing based on legitimate interests
• Withdraw consent – for marketing at any time
• Lodge a complaint – with the UK ICO (ico.org.uk)

9. Children

The Service is not intended for children under 16. We do not knowingly process their data.

10. Changes to this policy

We may update this Privacy Policy to reflect legal or operational changes. We will notify you of significant changes via email or in-app notice.

11. Privacy in a nutshell

Your data is kept separate. Your business data is isolated from every other Helpling.ai customer's data; no other customer can read it.OpenAI can’t recycle your data. We disable OpenAI’s data-sharing toggle (see below) so your prompts and model outputs are not used to improve OpenAI’s public models. Prompts are sent with the OpenAI-Data-Usage-Opt-Out flag, so they are excluded from OpenAI’s model-improvement programme.

12. Contact

Dan Rowland
Helpling.ai
Email: privacy@helpling.ai
Tel: +44 113 8730 688
1 Highfield Gardens, Dewsbury, West Yorkshire. WF12 0SE.