Privacy notice

Who is the controller

Helix Platforms Ltd, company number 17032196, of Unit 2 Lions Barn, Langham Lane, Colchester, CO4 5HY, is the controller for account data, scan data and support messages. Email [email protected] for privacy requests and [email protected] for ordinary product questions. We are not VAT-registered. That fact is about tax, not about data protection.

If you upload a client list or scan a site on behalf of a client, you are responsible for having a lawful reason to share that information with us. We process it so we can provide the service you asked for.

Data we process

Account data includes your name, email address, a password hash, organisation membership, and billing status. We do not store your card number. Stripe does that as a separate controller for the payment and as our processor for the checkout.

Scan data includes the URL you submit, page addresses we fetch, issue text, scores, and optional screenshots of elements. We store a hash of the IP address to enforce the free-scan limit, not the raw address in the product database for ordinary reporting. Support emails and partner applications include whatever you type into the form.

If you accept optional analytics, Google Analytics receives usage data such as pages viewed and a client identifier. If you reject optional cookies, we do not load Google Analytics. Essential cookies still run, because the product cannot sign you in without them.

Why we use it, and the lawful basis

We process account and scan data to perform the contract: to run the scan you requested, to keep the history on a paid plan, and to send the messages that the product triggers, such as a finished report or a renewal receipt. The lawful basis is contract, UK GDPR Article 6(1)(b).

We use a hashed IP address and basic security logs to keep the service reliable and to enforce rate limits. The lawful basis is legitimate interests, Article 6(1)(f): running a shared scanner without it being abused. You can object to processing based on legitimate interests. We will stop unless we have a compelling reason to continue, such as an active security investigation.

Optional analytics runs only after you consent, Article 6(1)(a), and under PECR. You can withdraw consent by rejecting optional cookies. Withdrawal does not affect the scan you already asked for. We do not use your data to train a public model, and we do not sell personal data.

Processors

Railway hosts the application and the database. Stripe takes payments and stores the card. Resend sends product email, such as scan reports and account messages. Google Analytics is used only after you accept optional cookies. Each of those companies processes personal data on our instructions for the purpose named here.

Some of those processors may store or access data outside the United Kingdom. Where that happens, we rely on the transfer tool the processor makes available under UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email the privacy address if you want a description of the current arrangement for a named processor.

Retention and your rights

We keep account data while the account is open and for a short period afterwards so we can answer a billing question. Prospect report links are built to expire after 30 days. You can ask us to delete an account and its scans sooner by emailing the privacy address. We may keep a minimal record of a payment where tax or accounting rules require it.

You can ask for access, correction, erasure, restriction, or a copy of the data you provided, and you can object to processing based on legitimate interests. We will respond within one month, or tell you if we need longer. You can complain to the Information Commissioner's Office at ico.org.uk. We would like the chance to put a problem right first, so please email us before you do that.

Product email is sent because you asked for a scan, a statement, or an account message. You can use the unsubscribe or stop instruction in a marketing-style follow-up. Messages that exist only to complete a scan you requested are part of the service, not a separate mailing list.

Questions