helplexa

2. Personal data we collect

#

We may collect the following categories:

A) Account and customer admin data (Business Customers / Agents)

Name, email, company name, role/title (optional)
Login credentials (hashed), authentication events
Billing/contact details, invoice details
Support requests and communications

B) End User chat/helpdesk data

Chat messages and conversation transcripts
End User-provided identifiers (e.g., name/email if the offline form or “require name” is enabled)
Attachments and metadata (if you enable it)

C) Technical and usage data

IP address, device/browser info, referral URL, pages where the widget loads
Event logs (timestamps, feature usage, performance/error logs)
Cookie identifiers (where used)

D) Integration data

When you connect a third-party platform (such as Wix, WooCommerce, Instagram, Facebook Messenger, WhatsApp, or Slack), we access, receive, process, and send data through that platform as authorised by you during integration setup and use
We do not access or store customer, order, or payment data from connected platforms unless explicitly stated
OAuth access and refresh tokens from connected platforms, stored securely and used to perform authorised integration actions on your behalf
For Slack, workspace and channel identifiers, channel names, Slack user identifiers, names and verified email addresses used for account linking, interaction and event payloads, message timestamps, and private handling-session identifiers
When you choose to use Slack collaboration, the Helplexa conversation summary, customer messages, internal notes, assignment and status information may be sent to Slack. Messages submitted through an authorised Slack handling session may be received by Helplexa and delivered to the customer

E) Knowledge data

Knowledge-base names and settings, article titles and content, categories, uploaded images, publication settings, and author or editor activity
Article feedback, including helpful or not-helpful responses, optional comments, and a pseudonymous visitor identifier used to prevent duplicate feedback
Public articles may be accessible to anyone and may appear in search engines where the Customer enables search indexing

2A. Account identity and workspace membership

#

A Helplexa user account may be connected to more than one workspace. Account identity data, such as a user's login email address and profile name, is associated with the user account and may be used across workspaces that the user creates, joins, or is invited to.

Workspace membership data, such as the workspace a user belongs to, their role, teams, notification settings, working hours, and workspace-specific access, is processed in relation to that workspace.

Workspace Owners and authorised users may manage workspace membership and workspace-specific settings. They cannot directly change another user's global Helplexa login email address. If a workspace needs someone to use a different email address, the workspace may invite the new email address and remove the old workspace membership when appropriate.

3. How we use personal data (purposes)

#

We use personal data to:

provide and operate the Services (including chat delivery, ticketing, notifications)
authenticate users and secure accounts
provide customer support and respond to enquiries
process payments and manage subscriptions
monitor performance, prevent abuse, and maintain security
improve our Services (analytics and feature improvements)
comply with legal obligations and enforce our Terms

4. Lawful bases for processing

#

Depending on context, we process personal data under:

Contract

To provide the Services you request.

Legitimate interests

Security, fraud prevention, reliability improvements, basic analytics.

Consent

Certain cookies/marketing where required.

Legal obligation

Tax, accounting, lawful requests.

5. Sharing personal data

#

We may share personal data with:

hosting and infrastructure providers (our servers are hosted in the EU)
Stripe — payment processing
Mailtrap — transactional email delivery
Sentry — error monitoring and performance logging
Slack — when a Business Customer enables the Slack integration and its authorised users choose to share or handle Helplexa conversations there
professional advisers (legal, accounting) where necessary
authorities where required by law or to protect rights/safety
business customers (your organisation) when End Users contact you via your widget

We do not sell personal data.

6. International transfers

#

Some of our third-party service providers process personal data outside the UK, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK ICO, or we rely on the provider's own UK GDPR-compliant transfer mechanisms. Providers include Stripe (payment processing) and Sentry (error monitoring), both of which maintain UK/EU data processing agreements. If a Business Customer enables Slack, information sent to Slack is processed according to that organisation's Slack configuration, agreement, and data-residency settings. Slack may process or store data in the United States or other countries.

7. Data retention

#

We keep personal data only as long as necessary for the purposes described:

Chat / transcripts

Retained according to the Customer's Plan — 30 days on the Free plan, 90 days on the Starter plan — after which conversation data is deleted or anonymised automatically.

Account data

Retained for the duration of your account. Following account closure, personal data is deleted within 30 days except where legal retention obligations apply.

Billing records

Typically retained for 6 years (or as required by tax/accounting law).

Integration credentials and third-party copies

When an integration is disconnected, we delete or revoke its access credentials promptly, subject to the third party's technical processes. Content already sent to Slack or another third-party platform may remain there under that organisation's retention settings and must be managed through the third party's own controls.

Knowledge content

Knowledge content is managed by the Customer and remains available while the Customer keeps it and its Plan includes Knowledge. Moving to a Plan without Knowledge permanently deletes the workspace's knowledge bases, articles, categories, and associated uploaded assets. Search engines may retain cached copies of previously public content outside our control.

Security logs

Retained for up to 90 days for fraud prevention and platform integrity purposes.

8. Security

#

We use reasonable security measures designed to protect personal data (access controls, least-privilege practices, encryption where appropriate, monitoring). No method of transmission or storage is completely secure.

9. Cookies and similar technologies

#

We may use cookies and similar technologies:

strictly necessary cookies for core functionality (e.g., sessions, security)
analytics cookies to understand usage and improve performance (where enabled)
preference cookies to remember settings

Where required by law, we will request consent for non-essential cookies and allow you to change preferences.

10. Your rights

#

Depending on your location and applicable law, you may have rights to:

access your personal data
correct inaccurate data
delete data (where applicable)
restrict or object to processing
data portability
withdraw consent (where processing is based on consent)

To exercise rights, contact: legal@helplexa.com

11. Complaints

#

If you are unhappy with how we handle your personal data, we would ask that you contact us first at legal@helplexa.com so we can try to resolve your concern. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Business customers using the widget (important)

#

When an End User chats with a business using Helplexa, that business may be a separate data controller for End User personal data collected via the widget. Businesses are responsible for providing their own privacy information to End Users where required.

13. Children

#

Our Services are not intended for children under 16. If you believe a child has provided personal data, please contact us at legal@helplexa.com and we will take steps to delete it promptly.

14. Changes to this policy

#

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last updated" date. Where changes are material, we will take reasonable steps to notify you, such as via email or an in-app notice.

15. Contact

#

Privacy enquiries

legal@helplexa.com

Support

support@helplexa.com

Registered address

Help Technologies Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Privacy Policy (Helplexa)

1. Who we are

Contents