Legal

Privacy Policy (Helplexa)

Last updated: 28th October 2026

This Privacy Policy explains how Help Technologies Limited (company number 16794762), trading as Helplexa (“we”, “us”, “our”) collects and uses personal data when you use our website, applications, and chat/helpdesk services (the “Services”).

We aim to follow UK data protection law, including the UK GDPR and the Data Protection Act 2018.

1. Who we are

Data controller
Help Technologies Limited
Trading as
Helplexa
Registered office
71-75, Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Privacy contact
[email protected]

2. Personal data we collect

#

We may collect the following categories:

A) Account and customer admin data (Business Customers / Agents)

  • Name, email, company name, role/title (optional)
  • Login credentials (hashed), authentication events
  • Billing/contact details, invoice details
  • Support requests and communications

B) End User chat/helpdesk data

  • Chat messages and conversation transcripts
  • End User-provided identifiers (e.g., name/email if the offline form or “require name” is enabled)
  • Attachments and metadata (if you enable it)
  • When Helplexa Calls is used, live microphone audio and, for video calls, camera video are processed to connect participants through Daily. Helplexa Calls does not provide call recording or transcription.
  • Helplexa retains call activity and usage records, including the initiating agent, conversation and call identifiers, participant roles, join/leave times, duration and allowance usage, for conversation history, service operation and allowance accounting. These records are separate from the live audio/video.

C) Technical and usage data

  • IP address, device/browser info, referral URL, pages where the widget loads
  • Event logs (timestamps, feature usage, performance/error logs)
  • Cookie identifiers (where used)

D) Integration data

  • When you connect a third-party platform (such as Wix, WooCommerce, Instagram, Facebook Messenger, WhatsApp, or Slack), we access, receive, process, and send data through that platform as authorised by you during integration setup and use
  • We do not access or store customer, order, or payment data from connected platforms unless explicitly stated
  • OAuth access and refresh tokens from connected platforms, stored securely and used to perform authorised integration actions on your behalf
  • For Slack, workspace and channel identifiers, channel names, Slack user identifiers, names and verified email addresses used for account linking, interaction and event payloads, message timestamps, and private handling-session identifiers
  • When you choose to use Slack collaboration, the Helplexa conversation summary, customer messages, internal notes, assignment and status information may be sent to Slack. Messages submitted through an authorised Slack handling session may be received by Helplexa and delivered to the customer

E) Knowledge data

  • Knowledge-base names and settings, article titles and content, categories, uploaded images, publication settings, and author or editor activity
  • Article feedback, including helpful or not-helpful responses, optional comments, and a pseudonymous visitor identifier used to prevent duplicate feedback
  • Public articles may be accessible to anyone and may appear in search engines where the Customer enables search indexing

2A. Account identity and workspace membership

#

A Helplexa user account may be connected to more than one workspace. Account identity data, such as a user's login email address and profile name, is associated with the user account and may be used across workspaces that the user creates, joins, or is invited to.

Workspace membership data, such as the workspace a user belongs to, their role, teams, notification settings, working hours, and workspace-specific access, is processed in relation to that workspace.

Workspace Owners and authorised users may manage workspace membership and workspace-specific settings. They cannot directly change another user's global Helplexa login email address. If a workspace needs someone to use a different email address, the workspace may invite the new email address and remove the old workspace membership when appropriate.

2B. AI agents and knowledge sources

#

Where AI agents are available and enabled, we process customer questions, relevant conversation history, the business's agent settings and instructions, and relevant excerpts from its selected knowledge sources to generate responses. Where a business enables earlier conversation history as a source, relevant excerpts from those conversations may also be used. These inputs and generated outputs may contain personal data.

For selected public website sources, we retain extracted page text and source URLs, together with indexing and refresh information. We index this information so agents can retrieve relevant content. We do not retain the crawled page's HTML, JavaScript or images as agent website-source content. Public availability does not mean that personal data may be used without a lawful basis.

Relevant request content may be sent to third-party AI providers, including OpenAI, for response generation or embeddings. We also record agent activity, testing activity, usage, outcomes, errors and cost information to operate the feature, support businesses, manage allowances and prevent abuse. Provider processing may take place outside the UK or EU; section 6 applies to international transfers.

AI-generated responses and inferences may be inaccurate, including when they concern an individual. Businesses must review their sources and agent behaviour, correct known inaccuracies and provide appropriate human oversight. If a response contains inaccurate personal data about you, contact the business operating the widget or [email protected] to exercise your rights. The AI limitations in our Terms do not remove obligations under data protection law.

3. How we use personal data (purposes)

#

We use personal data to:

  • provide and operate the Services (including chat delivery, ticketing, notifications and enabled AI agent responses and knowledge retrieval)
  • authenticate users and secure accounts
  • provide customer support and respond to enquiries
  • process payments and manage subscriptions
  • monitor performance, prevent abuse, and maintain security
  • improve our Services (analytics and feature improvements)
  • comply with legal obligations and enforce our Terms

4. Lawful bases for processing

#

Depending on context, we process personal data under:

Contract
To provide the Services you request.
Legitimate interests
Security, fraud prevention, reliability improvements, basic analytics.
Consent
Certain cookies/marketing where required.
Legal obligation
Tax, accounting, lawful requests.

5. Sharing personal data

#

We may share personal data with:

  • hosting and infrastructure providers (our servers are hosted in the EU)
  • AI providers, including OpenAI — to process relevant inputs for enabled AI responses and knowledge embeddings
  • Stripe — payment processing
  • Mailtrap — transactional email delivery
  • Sentry — error monitoring and performance logging
  • Daily — voice/video infrastructure when Helplexa Calls is used. Daily processes live media and connection data, including IP addresses, call/session identifiers and the participant identifiers and role labels supplied by Helplexa. See Daily’s data processing information.
  • Slack — when a Business Customer enables the Slack integration and its authorised users choose to share or handle Helplexa conversations there
  • professional advisers (legal, accounting) where necessary
  • authorities where required by law or to protect rights/safety
  • business customers (your organisation) when End Users contact you via your widget

We do not sell personal data.

6. International transfers

#

Some of our third-party service providers process personal data outside the UK, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK ICO, or we rely on the provider's own UK GDPR-compliant transfer mechanisms. Providers include Stripe (payment processing) and Sentry (error monitoring), both of which maintain UK/EU data processing agreements. If a Business Customer enables Slack, information sent to Slack is processed according to that organisation's Slack configuration, agreement, and data-residency settings. Slack may process or store data in the United States or other countries. Helplexa Calls uses Daily infrastructure, which may process call and connection data outside the UK and EU, including in the United States; the safeguards described above also apply to these transfers.

7. Data retention

#

We keep personal data only as long as necessary for the purposes described:

Chat / transcripts
Retained according to the Customer's Plan — 30 days on the Free plan, 90 days on the Starter plan — after which conversation data is deleted or anonymised automatically.
Account data
Retained for the duration of your account. Following account closure, personal data is deleted within 30 days except where legal retention obligations apply.
Billing records
Typically retained for 6 years (or as required by tax/accounting law).
Integration credentials and third-party copies
When an integration is disconnected, we delete or revoke its access credentials promptly, subject to the third party's technical processes. Content already sent to Slack or another third-party platform may remain there under that organisation's retention settings and must be managed through the third party's own controls.
Knowledge content
Knowledge content is managed by the Customer and remains available while the Customer keeps it and its Plan includes Knowledge. Moving to a Plan without Knowledge permanently deletes the workspace's knowledge bases, articles, categories, and associated uploaded assets. Search engines may retain cached copies of previously public content outside our control.
Security logs
Retained for up to 90 days for fraud prevention and platform integrity purposes.

8. Security

#

We use reasonable security measures designed to protect personal data (access controls, least-privilege practices, encryption where appropriate, monitoring). No method of transmission or storage is completely secure.

9. Cookies and similar technologies

#

We may use cookies and similar technologies:

  • strictly necessary cookies for core functionality (e.g., sessions, security)
  • analytics cookies to understand usage and improve performance (where enabled)
  • preference cookies to remember settings

Where required by law, we will request consent for non-essential cookies and allow you to change preferences.

10. Your rights

#

Depending on your location and applicable law, you may have rights to:

  • access your personal data
  • correct inaccurate data
  • delete data (where applicable)
  • restrict or object to processing
  • data portability
  • withdraw consent (where processing is based on consent)

To exercise rights, contact: [email protected]

11. Complaints

#

If you are unhappy with how we handle your personal data, we would ask that you contact us first at [email protected] so we can try to resolve your concern. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Business customers using the widget (important)

#

When an End User chats with a business using Helplexa, that business may be a separate data controller for End User personal data collected via the widget. Businesses are responsible for providing their own privacy information to End Users where required, including explaining enabled AI processing, the sources they select, their lawful basis and how End Users can contact a person or exercise their data protection rights. Businesses must ensure they are authorised to provide personal data through knowledge sources and agent instructions. We process End User conversation and agent-source data on the business's behalf to provide enabled features; our own account, billing, security and service-administration processing remains subject to this policy.

13. Children

#

Our Services are not intended for children under 16. If you believe a child has provided personal data, please contact us at [email protected] and we will take steps to delete it promptly.

14. Changes to this policy

#

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last updated" date. Where changes are material, we will take reasonable steps to notify you, such as via email or an in-app notice.

15. Contact

#
Privacy enquiries
[email protected]
Registered address
Help Technologies Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

© 2026 Help Technologies Limited (trading as Helplexa)

Back to top