Privacy Policy

2.1 Information You Provide Directly

When you register for an account or use the Service, you may provide:

• Account Information: Name, email address, phone number, business name, business address, and job title
• Billing Information: Payment card details, billing address (processed by our third-party payment processor; we do not store full payment card numbers)
• Communications: Messages, support requests, and feedback you send to us

2.2 Financial Information from Third-Party Integrations

When you connect your accounting software (such as QuickBooks, Xero, or similar platforms) to Helcyon, we receive read-only access to certain financial data, including:

• Transaction history
• Account balances
• Invoices and bills
• Vendor and customer information
• Chart of accounts
• Financial reports and summaries

2.3 Information Collected Automatically

When you access the Service, we automatically collect:

• Device Information: IP address, browser type, operating system, device identifiers
• Usage Data: Pages viewed, features used, time spent on the Service, referring URLs
• Log Data: Server logs, error reports, and diagnostic information
• Cookies and Similar Technologies: See Section 9 for details

2.4 Information from Third Parties

We may receive information from:

• Accounting Software Providers: Data accessed through authorized integrations
• Payment Processors: Confirmation of successful payments
• Analytics Providers: Aggregated usage statistics

To Provide the Service

• Generate financial diagnostics and reports
• Monitor your business vital signs (Cash Pulse, Revenue Blood Pressure, Customer Heartbeat, Margin Temperature, Growth Oxygen)
• Detect anomalies and potential fraud indicators
• Send alerts and notifications
• Provide customer support

To Improve the Service

• Analyze usage patterns to enhance features
• Debug and fix technical issues
• Develop new products and services

To Communicate with You

• Send service-related emails (alerts, reports, updates)
• Respond to inquiries and support requests
• Send marketing communications (with your consent, where required)

To Process Payments

• Process subscription fees
• Manage billing and invoicing

To Comply with Legal Obligations

• Respond to legal process (subpoenas, court orders)
• Cooperate with law enforcement
• Enforce our Terms of Service

5.1 Service Providers

We share information with third-party vendors who perform services on our behalf, including:

• Cloud Infrastructure: Amazon Web Services (AWS) for hosting and data storage
• Payment Processing: For billing
• Email Services: For sending transactional emails and notifications
• Analytics: For understanding Service usage

All service providers are contractually obligated to use your information only to provide services to us, maintain confidentiality and security, and comply with applicable data protection laws.

5.2 Legal Requirements

We may disclose your information if required by law or if we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights, prevent wrongdoing, or protect personal safety.

5.3 Business Transfers

If Helcyon is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice of any change in ownership.

5.4 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

Encryption

• At Rest: All data is encrypted using 256-bit AES encryption
• In Transit: All data transmissions use TLS 1.3 encryption
• Backups: All database backups are encrypted

Infrastructure

• Hosted on Amazon Web Services (AWS) in US-based data centers
• SOC 2 Type II certification in progress
• Real-time threat monitoring and intrusion detection
• DDoS protection
• Automated daily backups with 30-day retention

Access Controls

• Role-based access controls
• Multi-factor authentication available
• Principle of least privilege for all Helcyon personnel
• Background checks for all employees with data access
• Complete audit trail of all data access

Incident Response

If a security incident occurs that affects your data, we will notify affected users within 72 hours of discovery with a clear explanation of what happened, what data was affected, and the steps we are taking.

7.1 Active Accounts

We retain your information for as long as your account is active and as needed to provide the Service.

7.2 After Cancellation

When you cancel your account:

• Your data will be permanently deleted within 30 days
• You may request immediate deletion at any time
• We will confirm deletion within 7 business days of your request

7.3 Legal Requirements

We may retain certain information longer if required by law or for legitimate business purposes such as fraud prevention.

8.1 All Users

You have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Request your data in a portable format
• Restrict Processing: Request that we limit how we use your data
• Withdraw Consent: Withdraw consent for optional data processing
• Opt-Out of Marketing: Unsubscribe from marketing communications

To exercise these rights, contact us at support@helcyon.ai.

8.2 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about what personal information we collect and how we use it
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information. Helcyon does not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To submit a CCPA request, email support@helcyon.ai with the subject line "CCPA Request."

8.3 European Economic Area Residents (GDPR)

If you are in the EEA, you have additional rights under the General Data Protection Regulation (GDPR). We process your data based on contract performance, legitimate interests, consent, and legal obligation. Your data may be transferred to the United States using Standard Contractual Clauses. You have the right to lodge a complaint with a supervisory authority.

9.1 What We Use

We use cookies and similar technologies to:

• Essential Cookies: Enable core functionality (authentication, security)
• Analytics Cookies: Understand how users interact with the Service
• Preference Cookies: Remember your settings and preferences

9.2 Your Choices

You can control cookies through your browser settings. Note that disabling certain cookies may affect Service functionality.