Privacy Policy

1. Two roles

For our website, early-access requests and accounts, we decide how personal information is used (we are the "controller"). For the content companies put into hlpr and the data hlpr reads from tools they connect, we process it on the company's behalf and on its instructions (we are a "processor" or "service provider"). If your information is in a company's hlpr workspace, that company decides how it is used; please contact them first.

2. What we collect

What you give us

• Early-access and trial forms: your name, work email, company, and optionally its website, your role, team size and anything you write to us.
• Your account: name, email address, a salted hash of your password (never the password itself), an encrypted two-factor secret, and your settings.
• Signing in with Google: if you choose it, Google tells us your name, email address, whether Google has verified that address, and your profile picture. We use them only to sign you in and to show who you are in hlpr. Signing in does not give us access to your Gmail, files, calendar or any other Google data.
• What you put into hlpr: register items, comments, decisions, files you upload, messages, meeting transcripts and the instructions you give seats.
• Live meetings: when you speak in a meeting, your audio is streamed to our speech-to-text provider to make a transcript. We keep the transcript, not the audio.

What connected tools share

When a company connects a tool, hlpr reads the data that company authorizes, which can include personal information about its customers, contacts or staff (for example names and email addresses in a CRM or mailbox). The same applies to events a company's own systems send to hlpr through a webhook (the company chooses what each event contains, and we keep up to 4 KB of details per event) and to answers from endpoints of its own API that it approves for hlpr to read (we keep up to 64 KB of each answer, the latest 200 answers per endpoint, and the numbers it picks to chart for 400 days). We use it only to provide the service to that company.

Meeting guests

A company can invite someone from outside it to one meeting by a private link. We keep the guest's name and email address, the time they agreed to being recorded, and what they say and type, written as a transcript, as part of that company's meeting record, and we process it on that company's behalf. The meeting includes AI participants, so what is said goes to the AI providers listed in this policy to run it. The link ends with the meeting. To ask about your data, contact the company that invited you, or privacy@hlpr.ai.

Google user data

When a company connects Google, its owner chooses which services hlpr may read: Google Analytics, Search Console, Calendar and Drive, and saving exports to Drive. hlpr reads only what those services return, only to give that company these features (seats' reports, meeting preparation, showing the connected calendar's events to that company's owners, checking it for clashes when a meeting is booked, and finding and reading the documents a question needs). It never sends, changes or deletes anything in them; the one thing it writes is a Google Doc a person asks to save, and it can reach only the files it creates.

hlpr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell Google user data, use it for advertising, or use it to train general-purpose AI or machine-learning models. It is passed only to the providers that run the service for that company (such as our AI provider, which does not train on it), and no person at hlpr reads it except with the company's permission, to investigate abuse or a security problem, or where the law requires. Google sign-in tokens are stored encrypted; disconnecting Google, or removing hlpr's access in your Google account, ends access at once.

What we collect automatically

• Server logs: IP address, browser type, pages and API addresses requested, and times, used to run, secure and debug the service.
• Meeting diagnostics: connection, microphone and playback events in live meetings, so problems can be found and fixed. Company owners can see them.
• Cookies: see section 7.

3. How we use it

• To provide hlpr: running your company's seats, meetings, drafts and connections.
• To keep it secure: sign-in, two-factor, rate limits and preventing abuse.
• To reply to early-access requests, decide who to let in, and send invitations and service messages.
• To understand how the website is used, with analytics cookies only if you accept them.
• To support you and improve the service, and to meet legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your data, or data from your connected tools, to train AI models.

4. AI processing

To do their work, seats send relevant parts of your company's data to AI model providers, mainly Anthropic, through their commercial APIs. These providers process it to return a result under their commercial terms, which do not allow them to train their models on it by default. Seats treat what they read as data, not as instructions.

5. Who we share it with

We share personal information only with:

• Service providers that run parts of hlpr for us, under contracts that limit them to that purpose:
  • DigitalOcean: hosting: application servers and database
  • Wasabi Technologies: file storage: documents you upload and seat pictures
  • Anthropic: aI models (Claude) that do the seats' thinking and writing
  • Deepgram: speech to text in live meetings
  • ElevenLabs: seat voices in live meetings
  • LiveKit: carrying people's voices between them in live meetings (not stored)
  • Google (Gemini API): generating seat pictures from your description
  • Resend: sending account emails: invitations, sign-in links and notices
  • Stripe: payments for hlpr plans (card details go to Stripe, never to hlpr)
  • Google Analytics, for website analytics, only if you accept analytics cookies
  • our email provider, to send invitations and service messages
• Tools a company connects, when a seat sends something there at that company's instruction (for example an email the company approved).
• Authorities, when the law requires it or to protect people's safety or our rights.
• A buyer or successor, if our business is sold or merged, with this policy continuing to apply.

The current list of sub-processors is in our Trust Center.

6. How long we keep it

• Account and company data: while the account or company is open. When a company's owner deletes the company, its data and stored files are deleted.
• The audit log keeps a short note of each change (what happened, when and by whom), including after a record is deleted, so the history of decisions survives.
• Early-access requests: as long as we need them to reply and decide, or until you ask us to delete them.
• Server logs: for a limited time, for security and debugging.
• Backups: deleted data can remain in our host's backups for up to four weeks until they are replaced.

7. Cookies

We use a small number of cookies and similar storage:

You can change your choice at any time with "Cookie settings" at the foot of any page. Analytics cookies are not used inside the signed-in app.

8. Your rights and choices

You can ask us to access, correct, export or delete your personal information, or to stop using it for a purpose, by writing to privacy@hlpr.ai. Depending on where you live (for example in the European Economic Area, the United Kingdom or California), you may have further rights, including to object to or restrict processing and to complain to a data protection authority. We will not treat you differently for using these rights. We may need to confirm your identity first. Where we process data for a company, we will pass your request to that company.

Where the law requires a legal basis, we rely on our contract with you (to provide the service), our legitimate interests (to secure and improve it and to reply to requests), your consent (analytics cookies) and legal obligations.

9. Where data is stored

hlpr is run from the United States, and personal information is stored and processed there. If you use hlpr from elsewhere, your information is transferred to the United States, with safeguards as required by law.

10. Security

We protect personal information with measures described in our Trust Center, including encryption in transit, encrypted connection keys, database-level separation between companies and two-factor sign-in. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires.

11. Children

hlpr is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

12. Changes

We will update this policy when what we do changes, change the date above and, for material changes, tell account owners before they take effect.

13. Contact

Questions or requests about your information: privacy@hlpr.ai, or write to: