Privacy Policy

Helm is a product of PactAI, LLC, a limited liability company organized in Texas, United States. If you have questions about this policy or want to exercise any rights described here, contact us at admin@pactai.app.

We collect only what we need to run the Service:

• Account information — your name, email address, password (stored as a one-way hash), and company name.
• Content you upload — documents, spreadsheets, PDFs, images, transcripts, and any other files you or your teammates upload for analysis.
• Integration data — information pulled from services you connect (for example, Shopify orders and QuickBooks transactions). We only request the minimum permissions each integration allows.
• Conversation data — the questions you ask Helm and the answers generated in response.
• Usage and device data — pages visited, features used, browser type, IP address, and similar diagnostic information. We use Google Analytics (GA4) for aggregate usage metrics.

We do not knowingly collect information from children under 13, and Helm is not directed at children.

We use your information to:

• Provide and operate the Service, including analyzing your uploaded content and generating answers.
• Authenticate your account and keep your data secure.
• Communicate with you about your account, billing, and service updates.
• Improve the Service by understanding aggregate usage patterns.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do not use your uploaded content or conversations to train public AI models.

If you install Helm on your Shopify store, we process the following categories of personal data, for the purposes listed next to each. We only process what is needed to deliver the analytics and recommendations you asked for.

• Merchant (store owner and staff) data — name, email address, store name, myshopify domain, store currency, timezone, and plan. Purpose: to create and authenticate your Helm account, connect your store, provision your workspace, send account and weekly assessment emails, and provide support.
• Store customer data — customer identifier, order history, order totals, discounts used, products purchased, currency, and, where Shopify provides it, order-level city/region/country and the customer's name or email associated with an order. Purpose: to calculate business metrics such as repeat purchase rate, customer lifetime value, new vs. returning mix, margin by product, and discount effectiveness, and to answer the questions you ask Helm about your store.
• Order and transaction data — orders, line items, refunds, fulfillments, payment status, and taxes. Purpose: to produce revenue, profitability, inventory, and cash-flow analysis, and to generate your weekly Executive Business Assessment.
• Product and inventory data — products, variants, SKUs, costs, and stock levels. Purpose: to identify dead stock, margin issues, and reorder needs.
• Content and conversations you provide — files you upload and questions you ask Helm, which may contain personal data you choose to include. Purpose: to generate the answers, summaries, initiatives, and to-dos you request.
• Usage and device data — pages visited, features used, browser type, and IP address. Purpose: security, diagnostics, and aggregate product improvement.

How we process it. Store data is synced from Shopify over authenticated APIs and webhooks, stored in an encrypted database isolated per company, and queried read-only when you ask a question. Data may be sent to enterprise AI model providers solely to generate your answer; those providers are contractually prohibited from training on or retaining it. We do not sell personal data, we do not use store customer data for advertising, and we do not share one merchant's data with another merchant.

Legal bases (where GDPR/UK GDPR applies). We process merchant account data to perform our contract with you, store and customer data on the basis of our legitimate interest (and yours) in providing the analytics you requested, and usage data on the basis of legitimate interest in securing and improving the Service. Where you are a store customer, the merchant is the controller and Helm acts as a processor on the merchant's instructions.

Requests from store customers. Helm honors Shopify's mandatory privacy webhooks. When a merchant or their customer requests data access, redaction, or shop deletion through Shopify, we return or erase the corresponding records. Store customers should contact the merchant they purchased from; merchants can reach us at admin@pactai.app.

• Isolation between customers. Every company's data is separated in our database using row-level security rules that are enforced on every request. One customer cannot see another customer's files, chats, or numbers.
• Encryption in transit. All connections between your browser and Helm use HTTPS (TLS).
• Encryption at rest. Files and database contents are stored on encrypted infrastructure. Integration tokens (Shopify, QuickBooks) are additionally encrypted with AES-256 before being written to the database.
• Read-only AI access. When Helm analyzes your data to answer a question, it runs read-only queries. The AI cannot modify, delete, or export your data on its own.
• Server-side secrets. Integration credentials never reach your browser. They are stored as protected server environment variables.

We rely on a small number of vetted providers to operate the Service:

• Cloud infrastructure and database — hosts your data on managed, encrypted infrastructure.
• AI model providers — commercial, enterprise-grade endpoints that contractually do not train on or retain your inputs.
• Analytics — Google Analytics (GA4) for aggregate usage metrics only.
• Integration providers — third-party services you explicitly choose to connect (Shopify, QuickBooks, etc.).

For a current list of sub-processors, email admin@pactai.app.

If you connect a Google service, such as Google Analytics or Google Ads, Helm accesses only the Google user data necessary to provide the features you authorize.

Helm may share Google user data only with service providers that are necessary to operate the Service, including:

• Cloud infrastructure and database providers used to securely host and process your data.
• AI model providers used solely to generate analyses, summaries, recommendations, and answers requested through Helm.
• Technical service providers used for security, logging, monitoring, and application operations.

These service providers process Google user data only on our behalf and only as necessary to provide the Service. They are not permitted to use Google user data for their own advertising, marketing, or independent purposes.

We do not sell Google user data. We do not share Google user data with advertisers or data brokers. We do not use Google user data for targeted advertising. We do not use Google user data to train public or general-purpose AI models.

Google user data is not shared with other Helm customers or unrelated third parties.

We may disclose Google user data when required by applicable law, legal process, or a valid governmental request, or when necessary to protect the security, rights, or integrity of Helm and its users.

Users may disconnect their Google integration at any time. Disconnecting prevents Helm from obtaining new Google user data. Users may also request deletion of previously stored Google user data by contacting admin@pactai.app.

Helm's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We retain your data for as long as your account is active. If you cancel your subscription or close your account, uploaded files, chat history, and integration data are retained for a 90-day grace period to allow reactivation, and are then permanently deleted from active systems. Backups are overwritten on a rolling schedule after that.

You can request earlier deletion at any time by emailing admin@pactai.app. We will honor verified requests within 30 days.

• Access and correction. You can view and edit most account information from within the Service.
• Deletion. You can delete individual files and chats from within the Service, or request full-account deletion by email.
• Integration control. You can disconnect any integration at any time; revoking access in the third-party service (Shopify, QuickBooks) also cuts our access.
• Marketing email. You can unsubscribe from any non-essential email using the link at the bottom of the message.

Helm uses cookies and similar technologies to keep you signed in, remember preferences, and measure aggregate usage (via Google Analytics). You can control cookies through your browser settings; disabling essential cookies will prevent you from signing in.

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before the change takes effect.

Questions, requests, or complaints? Email admin@pactai.app.