Privacy Policy

1. Data Controller

The data controller for personal data processed through Helpio is:

Helpio AB, company reg. no. 559582-5125, email: privacy@helpio.nu.

2. Our role: controller and processor

Helpio acts in two capacities:

• Controller for data about our own account, contact and billing contacts, and website visitors.
• Processor for the personal data you enter and process in the platform ("Customer Data"). There you are the controller, and Helpio processes the data on your instructions under a data processing agreement (see section 7).

3. Personal Data We Collect

3.1 Account & contact information

• Name, email address, company name
• Phone number (if provided)
• Billing information (company name, address, VAT number)

3.2 Usage data

• IP address, browser type, device type
• Pages visited, features used, timestamps
• Aggregated analytics data

3.3 Customer Data and support data

• Content you and your users enter into the platform (CRM, tickets, invoices, projects, etc.)
• Ticket and chat content and attachments
• Knowledge base interactions

4. Purpose & Legal Basis

Processing of Customer Data is carried out on your instructions as controller and governed by the data processing agreement.

5. Data Storage & Infrastructure

Personal data is processed within the EU/EEA. Our primary infrastructure is Scaleway (Iliad Group, France), an EU-owned cloud provider. Some sub-processors we use (see section 7) have parent companies outside the EU but process the data in EU regions. For such processing we apply appropriate safeguards – the EU-US Data Privacy Framework and/or standard contractual clauses – together with data processing agreements.

6. Data Retention

• Account data: for the duration of the account plus 30 days after deletion
• Billing data: 7 years as required by the Swedish Accounting Act
• Customer Data and support data: for the duration of the customer relationship, then deleted or returned within 90 days per the agreement
• Usage analytics: aggregated and anonymized within 26 months

7. Sub-processors & Data Sharing

We never sell personal data. We use the following sub-processors, all processing within the EU/EEA and bound by data processing agreements under GDPR Art. 28:

Business customers can enter into a data processing agreement (DPA) with us; contact privacy@helpio.nu.

8. Your Rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and to withdraw consent (Art. 7(3)). Contact privacy@helpio.nu and we will respond without undue delay and within one month. Where a request concerns Customer Data, we refer it to the customer who is the controller.

9. Cookies

We use only strictly necessary cookies. We do not use advertising or tracking cookies. Any analytics are privacy-friendly and anonymized.

10. AI features

The platform may include AI assistance (e.g. suggestions and summaries). The AI does not make decisions with legal or similarly significant effects solely by automated means; a human makes decisions. Customer Data is not used to train third-party providers' models without a legal basis and contractual cover. The AI features are provided by Google Cloud (Vertex AI) in the EU, using Anthropic's Claude models. Personal data in free text is pseudonymised before it is sent. A workspace can turn off all AI under Settings → AI → AI Features, and nothing is then sent to the AI provider.

11. Security Measures

We implement appropriate technical and organizational measures and operate an information security management system (targeting ISO/IEC 27001). These include encryption in transit (TLS) and at rest, role-based access control with central identity management and MFA, access logging, secure development with vulnerability scanning, and incident response procedures.

12. Personal Data Breaches

For breaches concerning data for which we are controller, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where required. Where we act as processor, we notify the affected customer without undue delay.

13. Supervisory Authority

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se.

14. Mobile Apps (Google Play and App Store)

When you use our mobile apps (iOS/Android) we may process the same categories of data as via the web, plus device information and app-specific identifiers required for functionality, security and support. The apps request only the permissions needed for the features you use (e.g. notifications, camera or file access for uploads), and you can manage permissions in your device settings. We show no advertising and use no cross-app or cross-site tracking for advertising. Any third-party SDKs are limited to what is needed to operate the Service and are disclosed in the app's data-safety information on each platform (Google Play Data safety and Apple App Privacy). The Service is intended for businesses and is not directed to children; we do not knowingly collect data from children under 13.

15. Account and Data Deletion

You can request deletion of your account and personal data at any time, including from the mobile app. Request deletion under account settings in the Service or by emailing privacy@helpio.nu. We delete or anonymize your personal data within 90 days, except data we are legally required to retain (e.g. billing records under the Swedish Accounting Act). A request can be made even without the app installed by contacting us at the address above.

16. Changes to This Policy

We may update this policy. Material changes will be communicated via email or a notice on our website. Continued use after changes constitutes acceptance.

17. Google user data (Gmail, Google Calendar and Google Drive)

When you or your organisation connect a Google account to Helpio, Helpio uses Google data only for the features you have turned on:

• Gmail (gmail.readonly, gmail.send): Helpio reads messages in a connected support inbox and turns them into tickets, and reads mail in a connected personal mailbox to show correspondence with customers and contacts already in the CRM as activities on the customer. The user chooses which mail is read and who can see it. Helpio sends mail from the account only when a user clicks Send.
• Google Calendar (calendar.events): meetings booked in Helpio are created as events in the user's calendar, and changes to those events are read back so the meeting in Helpio stays correct.
• Google Drive (drive.file): when a workspace chooses Google Drive as its file storage, Helpio creates a root folder and a folder per customer in the connected account's Drive, saves uploaded documents and the PDFs Helpio produces there, shows those files in Helpio and moves a file to the Drive trash when the user deletes it. Helpio reaches only the files and folders it has created itself, not the rest of your Drive.
• The email address of the connected account (userinfo.email), to show which account is connected.

Storage. Google data that Helpio stores, such as email content in tickets and activities, calendar events and references to files, is stored encrypted within the EU (see section 5). Access tokens are stored encrypted. Files in Google Drive stay in your own Drive.

Sharing. We never sell Google data and do not share it with anyone, except with the sub-processors in section 7 to the extent needed to provide the features, with your explicit consent, or when required by law.

No advertising and no AI training. Google data is not used for advertising, not used to build user profiles, and not used to train or improve generalised AI models. No one at Helpio reads your Google data, except with your explicit consent for a specific matter (for example support), to investigate security incidents or abuse, or when required by law.

Limited Use. Helpio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can disconnect the account in Helpio at any time (Settings → Email, Profile → Personal email or Settings → File storage) or revoke access at myaccount.google.com/permissions. Helpio then stops fetching data from the account. Data already stored is deleted according to sections 6 and 15, or earlier on request to privacy@helpio.nu.

18. Contact

Questions about this policy or data protection: privacy@helpio.nu.