Privacy policy

Helium is a brand of Oxpecker Technology Pvt. Ltd., a company registered in India, based in Janakpuri, New Delhi, India.

For the data described here we are the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the "controller" under the EU and UK GDPR, except where we say we act for a merchant or client (see Shopify app and Client content and data).

Questions or requests: hello@gethelium.co. Our Grievance Officer is listed at the end of this policy.

• Our website, gethelium.co, and its forms (free sample, book a call, launch-page enquiry)
• Our content and ads-management services for brands
• Our Shopify app, Helium AI: Analytics & CRO
• Emails, WhatsApp messages and calls between you and us

Websites and services of other companies that we link to or embed (for example a booking calendar) have their own privacy policies.

• Forms: your name, work email, WhatsApp or phone number, brand or company, store or product URL, monthly ad-spend or budget band, goals, launch dates, how you heard about us, and anything you write in a message field.
• Booking a call: the details you enter in the booking calendar (name, email, time, notes).
• Working with us: product photos, brand assets, logos, footage, briefs and feedback you send us, plus ad-account access you grant us.
• Billing: company name, billing address, GSTIN and the contact for invoices. Card and bank details are entered with our payment provider; we do not store full card numbers.
• Messages: what you send us by email, WhatsApp or other channels, and notes from our calls with you.

When you visit gethelium.co we and our analytics and advertising providers collect:

• device, browser, operating system, language and screen size
• IP address and an approximate location derived from it, and your browser's time zone (we use the time zone to decide whether to ask for cookie consent and which market's prices to show)
• pages viewed, links and buttons clicked, form starts and submissions, time on page, and the page you came from
• campaign parameters in the link you used (UTM tags) and ad click IDs (such as Google's gclid or Meta's fbclid)
• the source of your first visit, stored in your own browser so a later enquiry can be attributed to it

Most of this is collected with cookies and similar technologies. Our cookie policy lists each one and how to turn them off.

We use these tools on gethelium.co. Each one only runs if we have switched it on.

• PostHog (product analytics): page views, clicks and form events, so we can see which pages work. PostHog also records sessions (how the page was scrolled and clicked) and heatmaps to help us fix confusing pages; anything typed into form fields is masked and not recorded.
• Google Analytics 4 (site analytics) and Google Ads (measuring which ads lead to enquiries, and remarketing).
• Meta pixel (measuring which Facebook and Instagram ads lead to enquiries and bookings, and building ad audiences).

When you submit a form or book a call, these tools receive an event saying that a lead or booking happened. We do not send your name, email or phone number to Google or Meta through the website.

Consent. If your browser's time zone is in the EU, EEA, UK or Switzerland, Google's advertising and analytics storage starts as "denied" (Google Consent Mode v2) and the Meta pixel does not load until you click Accept on our cookie banner. While consent is denied, Google may receive cookieless signals that it uses for aggregate measurement. Visitors elsewhere have these tools on by default. Wherever you are, you can change your choice at any time with Cookie settings in the footer of every page.

When you ask for a free sample we use the product link you give us to make sample images or videos. The request (including your name, email or WhatsApp number) goes to our own content engine, which makes the sample with AI models from third-party providers, such as OpenAI, Anthropic, Google and fal, some reached through Vercel AI Gateway. Request details held by the engine are deleted with the job, within 30 days.

We send the sample and follow-ups by email through Resend, and by WhatsApp from our WhatsApp Business number (WhatsApp is a Meta service). If you gave us a WhatsApp number we may message you about your sample and our services. Reply STOP on WhatsApp, or use the unsubscribe link in any marketing email, and we will stop.

Our booking calendar is provided by Cal.com or Calendly and is embedded on gethelium.co. What you type into it is collected by that provider under its own privacy policy and shared with us so we can hold the call. Calls usually take place on Google Meet or Zoom.

Merchants install our app from the Shopify App Store. With the permissions the merchant approves, the app can access:

• Store owner and staff: name, email, phone number and address of the store owner; email, IP address, browser and operating system of blog contributors
• Store data: products, inventory, collections, product tags, orders (fulfilments and returns, last 60 days of order history), discounts, customers and customer tags, store analytics and reports, Online Store pages, theme, script tags and checkout, metaobjects and cart transforms
• Storefront visitor data (through the app's web pixel and storefront features): browsing behaviour, device, browser, IP address, approximate location and a client ID cookie

Why. To provide the features the merchant uses: analytics and alerts, funnel and attribution reports, location- and intent-aware collection merchandising, product recommendations and cart widgets, bulk product edits, Meta and Google product feeds and custom labels, and AI agents that answer questions about the store. If the merchant connects Meta or Google Ads, we send product feeds, labels and audience signals to the merchant's own ad accounts at the merchant's instruction.

Our role. For data about a merchant's customers and storefront visitors we act as a processor / service provider for the merchant, who decides how that data is used and must give their shoppers their own privacy notice and collect any consent the law requires. Shoppers should send privacy requests to the merchant. For the merchant's own account and contact data we are the controller.

What we don't do. We do not sell store or shopper data, and we do not use one merchant's store data to serve another merchant.

Where it is processed. App data is processed on cloud infrastructure from Railway and Amazon Web Services, which may be outside India. The app's AI features send only the store data needed for a task to AI model providers such as OpenAI, Anthropic and Google, under terms that do not allow them to train on it.

Billing. App subscriptions are billed by Shopify in USD; we do not receive card details.

Shopify privacy requests. We handle Shopify's mandatory privacy webhooks:

• customers/data_request: when a shopper asks a merchant for their data, we give the merchant the data the app holds about that shopper
• customers/redact: we delete that shopper's data held by the app
• shop/redact: Shopify sends this 48 hours after a merchant uninstalls the app; we then delete that store's data

We act on these requests within 30 days, and deleted data drops out of backups as they rotate.

When a brand hires us for content or ads management, the product material, brand assets and ad-account data they give us are used only to deliver that work. Where that includes personal data of the brand's own customers (for example in ad accounts or customer lists), we process it on the brand's behalf and under its instructions, and the brand's own privacy policy applies to those people.

We do not publish a client's material, or the content we make for them, as our own work without their permission.

• to make samples and content, run ads and provide the Shopify app
• to reply to enquiries, arrange calls and send information you asked for
• to send marketing about our services, which you can opt out of at any time
• to measure and improve the website, our ads and our services
• to bill, keep accounts and meet legal and tax obligations
• to keep our systems secure and prevent fraud and abuse

Legal bases (EU/UK GDPR): performing a contract or steps before one (samples, services, the app); our legitimate interests (replying to business enquiries, B2B marketing, improving our services, security), balanced against your rights; your consent (non-essential cookies and pixels where consent is required, and where we ask for it); and legal obligations (tax and accounting).

India (DPDP Act): we process personal data on the basis of your consent, given for example when you submit a form, or for the legitimate uses the Act allows, such as a purpose for which you voluntarily gave us the data.

We do not sell personal data. We share it only with providers that help us run Helium, under contracts that limit their use of it, and only as much as they need:

• Hosting and infrastructure: Vercel (website), Railway and Amazon Web Services (content engine and Shopify app)
• Forms and lead records: Getform / Forminit, and Google Workspace (email, Sheets, Meet)
• Analytics and advertising: PostHog, Google (Analytics, Ads) and Meta (pixel)
• Messaging and email: WhatsApp (Meta) and Resend
• Scheduling: Cal.com or Calendly
• AI models: the providers used to make content and run the app's AI features (see above)
• Payments: Razorpay and Stripe for invoices, and Shopify Billing for the app
• Shopify, for everything related to the app

We may also share data with professional advisers, with a buyer or investor as part of a merger, financing or sale of our business (under confidentiality), and with authorities when the law requires it or to protect our rights, our users or the public.

We are based in India and several of our providers process data in other countries, including the United States. Where EU or UK law applies, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK addendum) offered by our providers. Contact us for a copy of the relevant safeguards.

• Leads and enquiries (forms, sample requests, booking details): 24 months after our last contact, then deleted or anonymised
• Client and billing records: for the length of our contract, then as long as Indian tax and company law requires
• Free-sample request data in our content engine: deleted with the job, within 30 days
• Analytics data: kept under each provider's retention settings (Google Analytics: 14 months)
• Shopify app data: deleted after uninstall as described above

When you close an account with us, we delete or anonymise your personal data within six months, unless the law requires us to keep it longer.

We use reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and least-privilege access to client accounts. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data we will notify you and the authorities where the law requires.

Wherever you are, you can ask us to:

• give you access to, or a copy of, the personal data we hold about you
• correct, complete or update it
• delete it
• stop sending you marketing, or withdraw a consent you gave (this does not affect what we did before)

India (DPDP Act, 2023): you also have the right to a summary of your data and the processing, to grievance redressal through our Grievance Officer, and to nominate someone to exercise your rights if you die or become incapable. If you are not satisfied with our response you may complain to the Data Protection Board of India.

EU, EEA and UK (GDPR / UK GDPR): you also have the right to restrict or object to processing (including objecting to direct marketing at any time), to data portability, and to complain to your data protection authority (in the UK, the Information Commissioner's Office). We reply within one month.

To use any of these rights, email hello@gethelium.co. We may need to verify your identity first. For data our Shopify app holds about a store's shoppers, please contact the store, which will contact us.

Our website, services and app are for businesses and are not directed at children. We do not knowingly collect personal data of anyone under 18. If you think we have, contact us and we will delete it.

We will update this policy when our services, providers or the law change. The date at the top shows when it last changed. If a change is material we will tell clients and app merchants by email or in the app before it applies.

Under the Information Technology Act, 2000, its rules and the DPDP Act, our Grievance Officer is:

• Name: Sidharth Sahni
• Designation: Co-founder
• Email: hello@gethelium.co (subject: Grievance)
• Address: Oxpecker Technology Pvt. Ltd., Janakpuri, New Delhi, India

We acknowledge grievances promptly and resolve them within 30 days, or sooner where the law requires. For anything else: hello@gethelium.co.