Privacy Policy

1. Information we collect

We collect information you provide directly, information collected automatically, and information from your use of the Service:

• Account information — name, business email, company name, and billing details you provide when you sign up.
• Content data — emails, files, messages, and documents you or your organization store or transmit through the Service.
• Usage data — log files, device identifiers, IP address, browser type, and pages visited, collected automatically as you use the Service.
• Device management data — for organizations that enroll devices, configuration, compliance status, and location data needed to enforce policy or remote wipe.

Mobile app. If you use the Helios mobile app, we additionally process: a device-generated public key and a push token, used solely to deliver notifications through infrastructure we operate ourselves (not a third-party push relay), while notifications are still delivered to your device the way every app's are, through Apple's or Google's own platform service; your app credential, stored only on your device in its hardware-backed keychain, never on our servers. Push notification content is encrypted to a key held only on your device, so that neither Apple, Google, nor the notification relay can read it. Content displayed inside the app — including icons and maps in your organization's intranet — may load directly from third-party services (Iconify, OpenStreetMap) in your device's browser context; see our mobile privacy label for details.

2. How we use information

We use collected information to:

• Provide, operate, and maintain the Service, including mail delivery, file sync, chat, meetings, and device management;
• Process transactions and send related billing information;
• Respond to support requests and communicate service updates;
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues;
• Comply with legal obligations.

3. Data ownership and control

Content you or your organization store in the Service — mailboxes, files, messages, and documents — belongs to you. We do not sell customer content or scan it for advertising purposes. Administrators of an organization's account can access, export, or delete their organization's data at any time.

4. Sharing and disclosure

We do not sell personal information. We may share information with:

• Service providers who perform functions on our behalf (e.g. payment processing, infrastructure hosting), under confidentiality obligations;
• Your organization's administrators, where you access the Service as part of an organization's account;
• Authorities, where required by law, regulation, or valid legal process;
• A successor entity, in connection with a merger, acquisition, or sale of assets.

4.1 AI assistance in support

When you contact support, an automated assistant built on Anthropic's Claude models reads your ticket and drafts a reply. Anthropic, PBC acts as a subprocessor for this purpose.

What is sent: the text of your ticket and its replies, its subject and category, and the tenant and service-tier identifiers needed to answer it. What is not sent: attachments, your files, mail, calendar or chat content, your password, and your payment details.

Your choices: an administrator of your organisation can turn the assistant off for your whole organisation, and you can send any individual ticket straight to a person. Certain categories always go to a person regardless of these settings.

Anthropic's handling of data sent to it is governed by its Commercial Terms of Service, which incorporate its Data Processing Addendum. We do not summarise those documents here; please read them.

5. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Upon account termination, content is deleted or anonymized within a commercially reasonable period, subject to backup and legal retention requirements.

6. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and regular security review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location, you may have the right to access, correct, export, or delete personal information, and to object to or restrict certain processing. To exercise these rights, contact us at the address below. Organization administrators can manage most of these controls directly within the workspace console.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Service is used. You can control cookies through your browser settings; disabling them may affect Service functionality.

9. International data transfers

Information may be processed in countries other than your own. Where required, we rely on appropriate safeguards, such as standard contractual clauses, to protect information transferred internationally.

10. Children's privacy

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy with a new "Last updated" date, or by direct notice to account administrators.

12. Contact us

Questions about this Privacy Policy can be sent to support@helioscloudsuite.com.