Privacy Policy

Who we are

Helix CMO is the data controller for personal data collected through this website and the Helix product. Our registered office and contact details are available on request. You can reach our privacy team at hello@helixcmo.com.

If you are a Helix customer and use our platform to process personal data about your own contacts or website visitors, you are the controller for that data and Helix acts as a processor. The terms that apply are set out in our Data Processing Addendum.

What this policy covers

This policy applies to information we collect through our public marketing website, our free site-scan tool, our newsletter sign-up form, our contact form, and the Helix product itself. It does not apply to third-party websites or services that you reach through links from our site.

We process personal data only for the purposes described in this policy or as otherwise disclosed to you at the point of collection.

Information we collect on the website

When you use our free site-scan tool, we collect the domain you enter, the scan results we generate, the page that referred you, and any UTM parameters in the link you arrived through. If you provide an email address to receive a full report, we collect and store that email address.

When you contact us through our contact form, subscribe to our newsletter, or book a walkthrough, we collect the details you submit, such as your name, email address, company name, and message.

We use essential cookies to keep the site working, for example to carry your scan between the marketing site and the app. We load analytics and marketing scripts only where you have consented, and declining is a genuine option that we honour.

Information we collect in the product

When you create a Helix account, we collect your name, email address, company name, billing address, and payment information. We also collect workspace and site configuration data, including the domains you add and the integrations you connect.

When you authorise us to read data from connected services such as Google Search Console, Google Ads, Google Analytics 4, your CMS, your CRM, or your advertising accounts, we collect the data necessary to provide the service. This may include performance metrics, campaign data, content, keywords, conversion data, and contact records.

We keep a log of actions the Helix agent takes on your behalf, including content it publishes, changes it makes to connected accounts, and approvals or rejections you provide. This helps you review, audit, and reverse actions.

Where you enable visitor identification, we process data about visitors to your sites. The specifics of what is collected, how it is used, and how to opt out are set out in our Visitor Identification Disclosure.

How we use your information

We use personal data to provide, operate, and improve the Helix product and website; to process payments and manage subscriptions; to provide customer support; to send service-related communications and, where permitted, marketing communications; to maintain the security and integrity of our systems; and to comply with legal obligations.

We do not sell personal data. We do not use your business data, customer lists, or marketing content to train third-party artificial-intelligence models.

Legal bases for processing

We process personal data on the basis of performance of a contract with you, our legitimate interests in operating and improving our business, compliance with legal obligations, and, where required, your consent. You can withdraw consent at any time by contacting us.

Who we share data with

We share personal data with trusted sub-processors that help us deliver the service. These include hosting and infrastructure providers, payment processors, email delivery services, analytics providers, error-monitoring services, and the model providers we use to generate content and run visibility checks.

A current list of sub-processors is available on request and is referenced in our Data Processing Addendum. We require all sub-processors to handle personal data only on our instructions and to maintain appropriate security measures.

We may also disclose personal data if required by law, to enforce our terms, or to protect the rights, property, or safety of Helix, our users, or others.

International data transfers

Helix operates primarily in the United States and the United Kingdom. Your personal data may be transferred to and processed in countries other than the one in which you live. Where such transfers occur, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, together with supplementary technical and organisational measures where required.

Data retention

We keep account data for as long as your account is open, plus a limited period afterwards for legal, accounting, and fraud-prevention purposes. Marketing scan records are retained for 12 months. Analytics history in the product is retained for 90 days after cancellation unless you request earlier deletion. Visitor identification data is retained for the period you configure, up to a maximum of 24 months.

When personal data is no longer needed for the purposes for which it was collected, we delete or anonymise it, except where retention is required by law.

Security

We use encryption in transit and at rest, role-based access controls, least-privilege internal access, logging of administrative actions, and regular review of dependencies and access. Personnel with access to personal data are bound by confidentiality obligations.

No method of transmission or storage is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

Cookies and similar technologies

Our website uses cookies and similar technologies to operate the site, remember your preferences, and understand how visitors use our pages. Essential cookies are always active. Analytics and marketing cookies are loaded only with your consent.

You can manage your cookie preferences through the consent banner shown on your first visit, or by adjusting your browser settings. Blocking some cookies may affect the functionality of the site.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also have the right to withdraw consent and to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email us at hello@helixcmo.com. We will respond within 30 days, or sooner where required by law. We may need to verify your identity before fulfilling your request.

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the GDPR, including the right to object to processing based on legitimate interests and the right to lodge a complaint with your national data protection authority.

If you are a resident of California or another US state with a comprehensive privacy law, you may have rights to know what personal information we collect, to request deletion, and to opt out of certain sharing. We do not sell personal information as those laws define it.

Children's privacy

Helix is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe we have collected personal data from a child, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify account holders by email before the changes take effect and update the date at the top of this page. Your continued use of the website or product after the effective date constitutes acceptance of the revised policy.

Contact us

If you have any questions about this Privacy Policy or our data practices, please contact us at hello@helixcmo.com.