Privacy Policy
Last updated: March 1, 2026
HelixMind ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our web platform and CLI tool, in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.
1. Data Collection
1.1 Account Data
When you create an account on the HelixMind web platform, we collect the following information:
- Email address
- Name (if provided)
- Profile information from OAuth providers (GitHub) if you choose to authenticate via third-party services
1.2 Payment Data
Payment information (credit card numbers, billing addresses) is processed exclusively by our payment provider, Stripe. We do not store your full credit card details on our servers. We retain only a reference ID, card brand, and last four digits for display purposes in your dashboard.
1.3 Usage Data
We collect anonymized usage data to improve our services, including API call counts, feature usage statistics, and error reports. This data does not contain personally identifiable information.
1.4 CLI Data
The HelixMind CLI tool stores all data locally on your machine by default. Spiral memory, project context, and configuration files remain on your local file system and are never transmitted to our servers unless you explicitly enable Cloud Brain Sync (available on Pro and Team plans).
1.5 Cookies
We use essential cookies required for authentication and session management. We do not use third-party tracking cookies or advertising cookies. If we introduce analytics in the future, we will update this policy and request your consent.
2. How We Use Your Data
We process your personal data for the following purposes:
- Providing and maintaining your account and access to our services
- Processing subscription payments via Stripe
- Sending transactional emails (account verification, password resets, billing notifications) via Resend
- Providing customer support through our ticket system
- Improving our services based on anonymized usage patterns
- Ensuring platform security and preventing abuse
Legal basis: We process your data based on contractual necessity (providing the service you signed up for), legitimate interest (improving our services and preventing abuse), and consent (where explicitly given).
3. Data Storage and Security
Your account data is stored in a PostgreSQL database hosted on secure, encrypted infrastructure. We implement industry-standard security measures including:
- Encryption at rest and in transit (TLS 1.3)
- Secure password hashing (bcrypt)
- JWT-based authentication with appropriate expiration
- Regular security audits and dependency updates
Data is retained for as long as your account is active. Upon account deletion, your personal data is permanently removed within 30 days, except where retention is required by law (e.g., billing records for tax purposes).
4. Third-Party Services
We share data with the following third-party processors, solely for the purposes described:
- Stripe — Payment processing and subscription management
- Resend — Transactional email delivery
- GitHub — OAuth authentication (only if you choose GitHub login)
Each third-party processor operates under their own privacy policy and is bound by data processing agreements. We do not sell your personal data to any third party.
5. Your Rights (GDPR)
Under the GDPR, you have the following rights regarding your personal data:
- Right of Access — Request a copy of all personal data we hold about you
- Right to Rectification — Request correction of inaccurate data
- Right to Erasure — Request deletion of your personal data ("right to be forgotten")
- Right to Restriction — Request limitation of data processing
- Right to Data Portability — Receive your data in a structured, machine-readable format
- Right to Object — Object to processing based on legitimate interest
- Right to Withdraw Consent — Withdraw previously given consent at any time
You can exercise most of these rights directly through your dashboard settings (account export, account deletion). For other requests, please contact us at the address below.
6. Data Transfers
If your data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
7. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice on our platform. The "Last updated" date at the top of this page indicates the most recent revision.
8. Contact
For privacy inquiries, data access requests, or complaints, contact us at:
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in your EU member state of residence.
Email: [email protected]
Address:
HelixMind
[Street Address]
[City, Postal Code]
Germany