Skip to main content

Privacy Policy

Last Updated: May 1, 2026

This Privacy Policy describes how Helms Deep AI LLC ("Company," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information in connection with our websites, hosted software platform, AI-enabled features, and advisory and professional services (collectively, the "Services").

Overview

Helms Deep AI LLC offers a hosted software platform that helps organizations structure goals, track execution, and generate AI-assisted summaries and recommendations. We also provide related onboarding, implementation, training, and advisory services.

1. Scope

This Privacy Policy applies to personal information processed by Company in connection with:

  • our public-facing websites and online properties;
  • requests for demos, sales inquiries, events, webinars, newsletters, and marketing activities;
  • customer and prospect communications;
  • the Helm AI OKR platform and related user accounts;
  • AI-enabled product features;
  • support, onboarding, implementation, training, and advisory services;
  • vendor, partner, and business relationship management; and
  • any other interactions that link to or reference this Privacy Policy.

This Privacy Policy does not apply to:

  • information processed solely on behalf of a customer under a separate data processing agreement or master services agreement, except to the extent required by applicable law;
  • third-party websites, services, or applications that are not controlled by Company; or
  • employment-related personal information of Company personnel, job applicants, or contractors, which may be covered by separate notices.

2. Roles and Relationship to Customer Data

Because Company offers a hosted SaaS platform designed for internal business use, our privacy role depends on the context in which personal information is processed.

2.1 Company as controller or business

Company generally acts as a controller or equivalent legal role under applicable privacy law when we process personal information for our own purposes, such as to:

  • operate and improve our website;
  • manage sales, marketing, and business development;
  • administer contracts and billing;
  • maintain security and fraud prevention controls;
  • manage vendor and business relationships; and
  • comply with legal obligations.

2.2 Company as processor or service provider

When a customer uses the platform and submits or makes available personal information through its tenant, workspace, account, or implementation environment, Company may act as a processor, service provider, or equivalent role on that customer's behalf.

In that context:

  • the customer determines the purposes for which customer data is collected and used;
  • the customer controls user provisioning, permissions, and administrative settings;
  • Company processes the relevant personal information under the customer's instructions and the parties' contract; and
  • data subject requests relating to customer-controlled data may need to be directed to the relevant customer.

2.3 Organizational accounts

If you access the Services through an employer or other organization, that organization may:

  • control your account;
  • access or export certain account data and content;
  • manage permissions and retention settings; and
  • instruct Company regarding the processing of data within the customer environment.

Individuals with questions about customer-controlled data should contact the relevant customer organization first.

3. Categories of Personal Information We Collect

We may collect the following categories of personal information, depending on how you interact with us and the Services.

3.1 Information you provide directly

We may collect information that you submit to us directly, including:

  • name, business email address, phone number, job title, employer, and other professional contact details;
  • account registration information and authentication credentials, such as username and password or single sign-on identifiers;
  • profile information, including department, manager, team, office location, role, profile photo, or similar business profile details;
  • communications you send to us, including emails, support requests, chat messages, meeting notes, and survey responses;
  • information submitted in demo requests, contact forms, webinar registrations, waitlists, event sign-ups, or newsletter subscriptions;
  • billing, payment, invoicing, and contract administration information;
  • information shared during onboarding, implementation, support, training, advisory, or consulting engagements; and
  • any other information you choose to provide.

3.2 Information collected automatically

When you visit our websites or use the Services, we may automatically collect certain technical and usage information, such as:

  • IP address;
  • browser type and version;
  • device identifiers;
  • operating system and platform information;
  • referral URLs and pages visited;
  • date and time of access;
  • log files and diagnostic data;
  • feature usage, clickstream, session, and interaction data;
  • approximate location derived from IP address; and
  • cookie, pixel, local storage, and similar technology data.

3.3 Information received from customers, partners, and other third parties

We may receive personal information from third parties, including:

  • customer administrators and authorized users;
  • integration partners and collaboration tools;
  • identity providers and authentication providers;
  • payment processors;
  • marketing, analytics, and lead-generation providers;
  • publicly available professional sources; and
  • referral, reseller, implementation, or advisory partners.

3.4 Customer account and platform data

In connection with the hosted platform, we may process personal information and related business content uploaded to, stored in, or generated through customer environments, including:

  • user account and directory data;
  • organizational structure and reporting-line information;
  • OKRs, goals, initiatives, key results, milestones, status updates, and progress data;
  • comments, collaboration content, meeting notes, check-ins, and task-related information;
  • documents, attachments, and files submitted to the platform;
  • administrative records, audit trails, access logs, and system event data; and
  • prompts, inputs, outputs, and contextual data associated with AI-enabled features.

3.5 Sensitive data

Company does not intend for customers or users to submit to the Services any category of sensitive personal information unless expressly authorized in writing and supported by appropriate contractual, technical, and operational safeguards.

4. How We Use Personal Information

We may use personal information for the following purposes, as applicable:

  • to provide, operate, host, and maintain the Services;
  • to provision accounts and authenticate users;
  • to support customer onboarding, implementation, migration, configuration, training, and advisory services;
  • to process transactions, invoices, payments, and related commercial activities;
  • to respond to inquiries, requests, and support issues;
  • to communicate about the Services, updates, releases, maintenance, security notices, and administrative matters;
  • to personalize user experience and improve functionality;
  • to monitor service performance, analyze usage trends, and develop new features;
  • to detect, investigate, prevent, and remediate fraud, abuse, unauthorized access, or other harmful activity;
  • to enforce our contracts, policies, and terms;
  • to comply with legal obligations and respond to lawful requests;
  • to protect the rights, property, safety, and security of Company, customers, users, and others;
  • to conduct internal business operations, reporting, and planning; and
  • to market our Services where permitted by law.

Where required by applicable law, Company will rely on an appropriate legal basis for processing, such as performance of a contract, compliance with legal obligations, legitimate interests, or consent.

5. AI Features and Disclosures

Our Services may include AI-enabled or machine learning-enabled functionality designed to support OKR drafting, analysis, summarization, recommendations, workflow assistance, or related business use cases.

5.1 Categories of AI-related data processing

Depending on the feature, Company may process the following through AI-enabled functionality:

  • prompts, instructions, and questions submitted by users;
  • documents, records, notes, goals, and other customer content selected for analysis;
  • contextual account, workspace, team, or workflow data necessary to generate relevant outputs;
  • generated summaries, recommendations, drafts, or other outputs; and
  • usage and telemetry data necessary to operate, secure, and improve the feature.

5.2 AI service providers

Company may use one or more third-party vendors, hosted models, APIs, or infrastructure providers to deliver AI-enabled functionality. Those providers may process relevant data only:

  • as necessary to provide the requested feature;
  • under contractual confidentiality and data protection restrictions; and
  • subject to Company's approved security and privacy review process.

5.3 Model training and product improvement

Company does not use customer content submitted through the Services to train generalized public AI models.

5.4 Human review and accuracy

AI-generated outputs may be probabilistic and may not always be accurate, complete, or appropriate for a given business decision. Customers and users remain responsible for reviewing outputs before relying on them.

5.5 Customer responsibility for AI inputs

Customers should not submit to AI-enabled features any information that:

  • they are not authorized to disclose;
  • is subject to special legal restrictions unless expressly supported by contract; or
  • would violate applicable law, contractual obligations, or internal company policies.

6. Cookies and Similar Technologies

We and our service providers may use cookies and similar technologies on our websites and, where applicable, within the Services.

6.1 Categories of technologies used

These technologies may include:

  • browser cookies;
  • local storage;
  • session identifiers;
  • pixels and tags;
  • SDKs; and
  • similar analytics and diagnostic tools.

6.2 Purposes of use

We may use these technologies to:

  • enable core website and platform functionality;
  • remember user preferences and settings;
  • maintain session integrity and security;
  • measure traffic and usage patterns;
  • troubleshoot and improve performance;
  • analyze marketing effectiveness; and
  • deliver lawful communications and content experiences.

6.3 Choices and controls

Users may be able to manage cookie preferences through:

  • browser settings;
  • cookie banners or preference centers, where implemented; and
  • applicable opt-out mechanisms required by law.

If you disable certain technologies, parts of the Services may not function properly.

  • Analytics providers: Sentry, Google Analytics
  • Advertising technologies used: None at this time

7. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients, subject to applicable law and contractual restrictions.

7.1 Service providers and subprocessors

We may disclose information to vendors and service providers that support our operations, such as providers of:

  • cloud hosting and infrastructure;
  • data storage and backup;
  • customer support and ticketing;
  • analytics and monitoring;
  • communications and email delivery;
  • billing and payment processing;
  • security and fraud prevention;
  • implementation, advisory, or operational support; and
  • AI-related services.

7.2 Affiliates and related entities

We may disclose information to our affiliates, parent entities, subsidiaries, or other related companies for internal administrative, security, operational, and business management purposes.

7.3 Integration partners and customer-directed disclosures

Where customers enable integrations or instruct us to connect with third-party applications or services, we may disclose relevant data as necessary to provide the requested integration or interoperability.

7.4 Professional advisors and transaction participants

We may disclose information to legal counsel, auditors, accountants, insurers, financing sources, investors, and transaction counterparties in connection with business operations, diligence, financing, or a merger, acquisition, reorganization, asset sale, or similar corporate transaction.

7.5 Legal and protective disclosures

We may disclose information where we believe in good faith that doing so is necessary to:

  • comply with applicable law, regulation, legal process, or lawful government request;
  • enforce our agreements or policies;
  • detect, prevent, or address fraud, security, or technical issues; or
  • protect the rights, property, safety, and security of Company, our customers, users, or others.

7.6 Sale or sharing statements

  • We do not sell personal information for monetary consideration.
  • We do not share personal information for cross-context behavioral advertising.
  • We may permit limited analytics or advertising technologies on our website, which may be considered "sharing" under certain U.S. state privacy laws.

8. Advisory and Professional Services

In addition to the hosted platform, Company may provide onboarding, implementation, enablement, training, consulting, strategic advisory, or related professional services.

In providing those services, Company may access or process customer information in order to:

  • configure or deploy the Services;
  • support change management and adoption efforts;
  • review customer workflows and account settings;
  • troubleshoot issues;
  • assist with data migration, imports, or integrations;
  • provide strategic recommendations; and
  • deliver training, reporting, and service communications.

Where Company accesses customer data in connection with professional services, it will do so subject to:

  • the applicable customer agreement;
  • confidentiality obligations;
  • documented internal access controls; and
  • applicable law.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

  • provide the Services;
  • maintain accounts and customer relationships;
  • perform our contractual obligations;
  • preserve security, backup, and business continuity records;
  • comply with legal, regulatory, tax, accounting, and reporting obligations;
  • resolve disputes; and
  • enforce our agreements.

Retention periods may vary depending on:

  • the type of information;
  • the nature of the customer relationship;
  • product configuration and customer instructions;
  • legal or contractual obligations; and
  • operational necessity.

Upon termination or expiration of customer services, Company may delete or return customer data in accordance with the applicable contract, subject to:

  • legal retention requirements;
  • backup and disaster recovery cycles;
  • security logging needs; and
  • limited archival copies retained for compliance or evidentiary purposes.

10. International Transfers

Company may process personal information in the United States and other countries where Company, its affiliates, or its service providers operate.

These jurisdictions may not provide the same level of data protection as the jurisdiction in which the personal information was originally collected. Where required by applicable law, Company will implement appropriate safeguards for cross-border transfers, which may include:

  • contractual transfer mechanisms;
  • data processing terms with transfer provisions;
  • risk assessments;
  • supplementary technical and organizational measures; and
  • other lawful transfer tools recognized under applicable law.

11. Security

Company maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.

These measures may include, as appropriate:

  • access controls and least-privilege permissions;
  • authentication and identity management controls;
  • encryption in transit and, where appropriate, at rest;
  • network security measures;
  • logging and monitoring;
  • vulnerability management;
  • incident response procedures;
  • personnel confidentiality obligations; and
  • vendor risk management processes.

However, no system can be guaranteed to be completely secure. Users and customers are responsible for maintaining the confidentiality of their credentials and using the Services in accordance with Company's security guidance.

security@helmapp.ai

12. Privacy Rights

Depending on where you reside and the context in which Company processes your personal information, you may have certain privacy rights under applicable law.

These rights may include the right to:

  • request access to personal information;
  • request correction of inaccurate information;
  • request deletion of personal information;
  • request a copy of certain information in a portable format;
  • object to or restrict certain processing;
  • withdraw consent where processing is based on consent;
  • opt out of certain marketing communications; and
  • appeal a denied privacy request, where applicable.

12.1 Customer-controlled data

If Company processes your personal information on behalf of a customer, Company may direct your request to the relevant customer, since that customer may be the party responsible for responding under applicable law.

12.2 Verification and limitations

Company may take reasonable steps to verify the identity of the requestor before responding to a privacy request and may limit or deny requests as permitted by law.

12.3 Submitting a request

Privacy requests may be submitted using the following method(s):

12.4 Sale or Disclosure of Data

We fully comply with the California Consumer Privacy Act. We do not currently disclose information to the organizations outside our own except where we may work with resellers to help us sell our software, and disclose your information to them if we believe you would be interested in hearing from them. In each case, the information we provide includes your name, email address, job title, office location, and company.

If you are a resident of California then you have the right to opt-out of this, because our sharing of data in this way may constitute a "sale" of your personal information under the California Consumer Privacy Act. If you wish to exercise this right, please contact us at privacy@helmapp.ai.

In order to fulfill our obligations under the California Consumer Privacy Act, we may take steps to verify your identity, and ensure that the request is valid, including where an authorized representative is making a request on your behalf. Please note where you have opted out of us sharing your information in this way, the service you receive will not be of an inferior quality or higher price, unless permitted by applicable law or where the services we provide to you rely on the sale of your personal information.

13. Marketing Communications

We may send marketing or promotional communications to individuals where permitted by applicable law.

You may opt out of marketing emails at any time by:

  • using the unsubscribe link in the email;
  • adjusting communication preferences where available; or
  • contacting us using the contact details below.

Even if you opt out of marketing communications, we may still send you non-promotional messages relating to:

  • your account;
  • the Services;
  • security notices;
  • billing and commercial administration; or
  • other transactional or operational matters.

14. Children

The Services are intended for business use and are not directed to children.

Company does not knowingly collect personal information directly from children under the age of 16 through the Services. If you believe a child has provided personal information to Company in violation of this section, please contact us so that we can investigate and take appropriate action.

15. Third-Party Services

The Services may contain links to, enable access to, or interoperate with third-party websites, applications, products, or services.

This Privacy Policy does not apply to third parties that Company does not own or control. Those third parties' collection, use, and disclosure practices are governed by their own privacy notices and terms.

Customers and users should review the privacy practices of any third-party service they choose to use in connection with the Services.

16. Changes to This Privacy Policy

Company may update this Privacy Policy from time to time to reflect changes in:

  • our Services;
  • our privacy and security practices;
  • legal or regulatory requirements; or
  • other operational developments.

When we update this Privacy Policy, we will revise the Last Updated date at the top of this document. Where required by applicable law, we will provide additional notice or obtain consent.

17. Contact Information

If you have questions about this Privacy Policy or Company's privacy practices, or if you wish to submit a privacy request, please contact:

privacy@helmapp.ai