HelixOS Privacy Policy (Early Stage Draft)

Internal note: This is a practical startup draft for pilot use and is not legal advice. Counsel review is recommended before broad launch.

This Privacy Policy explains how DM Consulting Services LLC, d/b/a HelixOS ("HelixOS," "we," "us," "our") collects, uses, and shares information when you use HelixOS websites, apps, and related services.

1. Scope

This policy applies to helixos.io and HelixOS products/services that link to this policy.

2. Information We Collect

We may collect:

  • Account and contact data: name, email, company, role, phone, and account credentials.
  • Usage and activity data: interactions, feature usage, page views, event logs, and diagnostics.
  • Business operational data: data entered by users such as workflow, performance, and operational records.
  • Support and communications: messages, support tickets, meeting notes, and related correspondence.
  • Technical and device data: IP address, browser/device identifiers, approximate location, and performance data.
  • Future integrations data: information synced from third-party tools when integrations are enabled.

3. How We Use Information

We use data to:

  • provide, secure, and improve HelixOS;
  • authenticate users and manage access;
  • support AI-assisted workflows and recommendations;
  • detect abuse, fraud, security, and reliability issues;
  • communicate service updates and support responses;
  • generate de-identified/aggregated analytics and benchmarks.

AI features. HelixOS uses third-party AI providers (such as OpenAI) to power AI-assisted features. We do not use your business data to train third-party AI models for general use. AI providers process queries under their own terms, which generally prohibit training on API-submitted content. If we ever use your data to train or fine-tune our own models, we will update this policy and provide notice before doing so.

4. How We Share Information

We do not sell personal information. We may share information with:

  • cloud hosting, analytics, communication, and infrastructure providers;
  • professional advisors (legal, accounting, audit);
  • law enforcement or regulators when legally required;
  • transaction counterparties in a merger, financing, acquisition, or asset transfer.

Authorized partners. If you grant a partner organization access to your strand data (for example, an accounting firm through the Partner Portal), HelixOS will share the data categories you specifically authorize under your current access settings. Partner access is governed by role-based controls and your consent, and you may revoke it at any time through your account settings. Authorized partner sharing is not a "sale" or "sharing" of personal information for cross-context behavioral advertising purposes.

5. Data Retention

We retain information for as long as reasonably needed for product operation, legal obligations, dispute resolution, and enforcement. Retention may vary by data type and account status.

Partner-uploaded documents. When an authorized accounting partner uploads financial documents (such as bank statements) on your behalf for processing, raw uploaded files are deleted promptly after successful processing (target: within 24 hours). Structured data extracted from those documents is retained per your workspace settings. Audit records of document-processing actions are retained for up to 7 years to meet financial-data recordkeeping standards. If you revoke a partner's access, new access stops immediately; documents or exports already held by the partner outside HelixOS are governed by your agreement with them.

Consent records. Records of partner access authorizations you grant are retained for the duration of your account and for 3 years thereafter.

6. Security

We use reasonable administrative, technical, and organizational safeguards. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Cookies and Analytics

We may use cookies and similar technologies for authentication, session management, product analytics, and performance monitoring. You can control cookies through browser settings, though some features may be affected.

8. User Rights (Jurisdiction-Dependent)

Depending on your location, you may have rights to access, correct, delete, or export certain personal data, and to object to or restrict certain processing. To submit requests, contact us at privacy@helixos.io.

California residents (CCPA/CPRA). If you are a California resident, you have the right to: (a) know what categories of personal information we collect and how we use and share it; (b) request deletion of personal information we hold about you, subject to certain exceptions; (c) correct inaccurate personal information; (d) opt out of the sale or sharing of personal information for cross-context behavioral advertising — HelixOS does not sell or share personal information for this purpose; and (e) non-discrimination for exercising your rights. To submit a CCPA request, contact privacy@helixos.io. We will respond within 45 days.

9. Children's Privacy

HelixOS is not directed to children under 13, and we do not knowingly collect personal information from children.

10. International Data Transfers

Data may be processed in jurisdictions where HelixOS or its service providers operate. We use reasonable steps to protect transferred data.

11. Changes to This Policy

We may update this Privacy Policy over time. We will post the updated version with a new effective date and, where required, provide additional notice.

12. Contact Information

DM Consulting Services LLC, d/b/a HelixOS
Email: privacy@helixos.io
Mailing Address: Legalinc Corporate Services Inc., 131 Continental Dr Suite 305, Newark, DE 19713, US