Privacy Policy

Parent Account and Registration Data:

When you create a Helmit account, we collect personal data about you, the parent or guardian. This includes your name, email address, and phone number provided during registration. This information is necessary to set up your account, identify you as the account holder, and communicate with you.

Child Profile Data:

You can create a profile for each child you are monitoring. We record which social media platforms (e.g. WhatsApp, Instagram, Discord, Snapchat, YouTube, TikTok, etc.) you have connected for each child and the connection status (e.g. connected or not connected).

Social Media and Communications Data (Monitored Content):

Once you connect a child's social media or messaging accounts through Helmit, the app will retrieve content from those accounts for monitoring purposes. This can include the text of messages and chat conversations, images, videos, or other media shared, audio recordings or voice notes, and files or links sent or received. All raw social media content and communications are stored locally on the parent's device and not transmitted to Helmit's servers for analysis. The Helmit App uses an on-device engine to analyze this data for potential risks (see "Analysis and Alerts" below). Important: Because this data may include personal information about your child and others (such as the child's friends who are chat participants), it should be handled carefully. Helmit does not sell or share the content of your child's communications with any third-party for their own use, and we do not ourselves ever see or upload this content to our servers. It remains on your device unless you choose to share it (for example, if you include a snippet in a feedback submission to us, as described later).

Analysis and Alert Data:

Helmit uses artificial intelligence (AI) models running locally on your device to analyze your child's monitored communications in real time. The purpose of this analysis is to detect potential dangers or policy violations such as cyberbullying, hate speech, online grooming, explicit or inappropriate content, self-harm or mental health risks, and other threats to the child's well-being. When the AI analysis finds something that matches the defined threat categories, the Helmit App will generate an alert for you. The collection of alert data enables the Helmit App to present you with a concise report of issues needing your attention. Alerts are stored on your device. You have the ability to delete alerts from the app interface (for example, after resolving an issue, you can remove that alert record).

App Usage and Analytics Data:

In order to improve the Helmit App and ensure it is working properly, we collect certain usage analytics and technical information. This includes event logs and metrics about how you use the app. We also collect basic device information such as your device's operating system. These data help us provide technical support and understand the context of any issues. Analytics data is focused on app performance and feature usage; it does not include the content of your child's messages.

Sources of Data:

The parent account data is provided directly by you during registration. Usage data is collected automatically by the app's analytics component. If you provide feedback or contact support, we may also collect any additional information you choose to share at that time (such as screenshots or descriptions of a problem).

Providing and Improving the Service:

First and foremost, we process all categories of data listed above to operate Helmit and deliver its features to you. This includes using parent account data to create and authenticate your account, and using child profile and social media data to perform the monitoring and alert functions as described. The legal basis for these processing activities is the performance of a contract – when you accept our Terms of Service and use Helmit, we enter into a contract to provide you with the parental control service, and we must process certain data to fulfill that contract (Art. 6(1)(b) GDPR). We also process data to maintain and improve the Service – this may be based on our legitimate interests (Art. 6(1)(f) GDPR) in ensuring our app is effective, safe, and user-friendly.

Threat Detection and Alerts:

A core purpose of Helmit is to detect potential dangers to your child and notify you. We use the child's social media communications data to algorithmically determine if any content is harmful or falls into risk categories (cyberbullying, etc.), and we generate alert notifications for the parent based on this analysis. The purpose is to empower you to protect your child from online harms. Under GDPR, this processing of the child's data is based on the parent's legitimate interest in safeguarding the child's welfare, combined with the parent's capacity as legal guardian to consent on the child's behalf where consent is required.

Account Management and User Communications:

We use your account data (name, email, phone) to manage our relationship with you as a customer. This includes sending administrative emails or messages related to your use of Helmit, such as verification emails, password resets, service updates, and important security or privacy notices. We may also use your contact information to respond to support requests or inquiries you send us. The legal basis for these communications is performance of contract (to keep you informed about the service you are using) or compliance with legal obligations.

Notifications (Email/SMS Alerts):

If you enable email or SMS notifications for alerts, we will use your provided email address and/or phone number to send you alert summaries when a high-severity issue is detected. This processing (sending you alerts) is part of delivering the service you signed up for (contractual necessity) and/or based on your consent/choice since you choose whether to enable such notifications. If you prefer not to receive notifications through a certain channel, you can disable them in the app settings at any time.

Analytics and Improvement:

We use the app usage and analytics data to understand how Helmit is used and to improve performance and features. For instance, we analyze which features are most popular or where users encounter difficulties, so we can enhance the user experience. This processing is based on our legitimate interest in improving our product and ensuring a high-quality user experience (Art. 6(1)(f) GDPR).

Security and Fraud Prevention:

We may process certain data as necessary to maintain the security of the Helmit App and our users. This can include using log information and identifiers to detect and prevent malicious activity, securing accounts (e.g., multi-factor authentication using your email or phone), and enforcing our Terms of Service. This processing is based on legitimate interests (protecting the service and our users) and compliance with legal obligations related to data security.

Legal Compliance:

Where required, we will process and/or disclose personal data to comply with legal obligations, law enforcement requests, or court orders. For example, if we are obliged to retain certain information for tax or accounting purposes, or if we must respond to a lawful request by authorities, we will do so. Such processing is based on Art. 6(1)(c) GDPR (legal obligation). We will notify you of any such disclosure when permitted by law.

Analytics Provider (PostHog):

We use PostHog, a product analytics service, to collect and analyze app usage data. Our PostHog instance is hosted in the European Union (https://eu.i.posthog.com), meaning usage data is sent to EU-based servers for processing, for GDPR compliance. PostHog acts as our data processor, and we have an agreement in place to ensure they protect the data.

SMS Notification Service (Infobip):

We integrate with Infobip to send SMS text messages to parents who opt to receive alerts via SMS. Infobip will receive the parent's phone number and the content of the alert notification (which, as described, contains a short alert summary). Infobip uses this information solely to transmit the SMS to you. If you disable SMS notifications, we stop sending your data to Infobip.

Email Delivery Service (Resend):

Similarly, we use a service called Resend to send email notifications and other service emails (including alert emails and feedback messages). If you opt to receive email alerts, Resend will process your email address and the content of the alert email (which might include the alert type, child name, and a brief description of the issue). Resend acts on our behalf to deliver these emails and does not use your information for any other purpose.

Cloud Database (Supabase):

The Helmit App primarily stores data locally on your device. However, we use Supabase for minimal data (registration info) and possibly to facilitate account login across devices or future sync features. We do not upload your child's communications, alerts, or other sensitive data to Supabase – it's mainly for account credentials. Supabase, as a processor, is obligated to protect your data and not to access it except as needed to maintain the service.

Legal and Safety Disclosures:

We may disclose certain data to third parties outside of our service providers if necessary to comply with a legal obligation, to protect our rights or the safety of users, or to enforce our terms. For instance, if we are compelled by a valid legal order to produce information (and such order is applicable to us), we will comply after verifying its legitimacy.

Local Data Storage:

Most of the data Helmit processes (including your child's monitored messages, alerts, and profiles) is stored locally on your device's storage in an application database. By keeping the sensitive data on your device, we limit exposure of that data to the cloud. You have full control over this data store: it resides with you, and if you wish to delete all such data, you can do so by deleting your account or uninstalling the app.

Security Measures:

Helmit takes the security of your data seriously. We have implemented a variety of technical and organizational measures to protect personal data against unauthorized access, alteration, loss, or misuse. These measures include access controls, encryption in transit, and secure coding practices:

• The communication between the Helmit App and any external service is encrypted via HTTPS/TLS.
• The local database is protected by the security of your device's user account.
• For the limited data that we do hold on our servers, we restrict access to that data to authorized personnel with a need to know.
• Our servers and third-party services employ industry-standard security practices (firewalls, encryption, monitoring, etc.).

Breach Notification:

In the unlikely event of a data breach affecting your personal data, we will act promptly to contain and investigate the issue. We will also notify you and the relevant authorities as required by law. If your email is on file, we will notify you electronically without undue delay, providing information on the nature of the breach and steps we are taking.

Retention Periods:

We will retain personal data only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. In practice, because Helmit is a user-installed app, much of the data (child communications, alerts, etc.) will reside on your device indefinitely until you choose to delete it.

Account Data:

We retain your account information while your Helmit account is active. If you choose to delete your Helmit account, we will delete your personal account data (name, email, phone) from our active databases. Generally, if you cancel your account, we aim to remove or anonymize your personal data from our systems within 30 days, except where retention is legally mandated.

Child Monitoring Data:

All message content and related data that you have collected via the Helmit App is stored locally and not on Helmit's servers. Thus, we do not have a separate retention policy for that data on our side – it remains under your control. Please note that if you uninstall the Helmit App without deleting your account or child profiles first, the data files on your device might remain in the system.

Your Deletion Rights:

You have the right to request deletion of your personal data (see "Your Rights" below). If you request that we delete data we hold on our servers (like your account information), we will do so (except to the extent we are required to keep it, as explained).