Privacy Policy

1. Who is responsible for your data?

HelpCenter.io is operated by HelpCenter Solutions Ltd., registered in Bulgaria with company number 205107652 and VAT number BG205107652. Our postal address is Cherno more, Detelina 2, 8115 Burgas, Bulgaria. Contact us at office@helpcenter.io about this policy or your personal data.

We are the controller for personal data used to manage our website, customer relationships, accounts, billing, and our own communications and security.

When a customer uses HelpCenter.io to process personal data in their help centre, we generally act as their processor, following their instructions. The customer determines the purpose and lawful basis, publishes their own privacy notice, and handles requests from their visitors and users. Contact that organisation first about data in its help centre; we can help identify the responsible customer. Our data protection information explains how to arrange a Data Processing Agreement (DPA). This policy does not replace a DPA.

2. Information we process

• Account and contact information: name, email, authentication information, team membership, permissions, and information you provide about your organisation.
• Subscription and billing information: plan, payment status, billing contact, address, tax information, invoices, and payment-provider identifiers. Payment details are handled through our payment providers.
• Communications: enquiries, demo requests, support messages, and communication preferences.
• Service and security information: IP addresses, browser and device information, access times, technical logs, and activity needed to operate, troubleshoot, and protect the service.
• Website measurement: pages viewed, interactions, referring pages and campaign parameters, approximate country, device category, and browser identifiers. Some measurement is linked to an account and subscription activity, as described below.
• Google Analytics: user-level and event-level retention is configured to two months, with renewal on new user activity disabled. Google applies changes to these settings after 24 hours. Most standard aggregate reports are not covered by those user/event retention settings.
• Customer content: articles, attachments, author information, search queries, feedback, messages, and AI inputs and outputs where those features are used. We process this on behalf of the customer, except where a separate controller purpose described in this policy applies.

We receive information from you, through service use, from colleagues inviting you, from payment providers, and from integrations you or your organisation authorise. Connected services may provide content, profile details, and access tokens according to the permissions granted.

Contact and authentication information is needed to create and secure an account; billing information is needed for a paid subscription. Without required information, we may be unable to provide the requested service. Optional information and marketing choices are separate.

3. Purposes and legal bases

We assess legitimate interests against your rights and expectations. You may object to processing on that basis. Where we rely on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. Accepting our Terms or reading this policy does not provide consent to optional tracking or marketing.

4. Website analytics and tracking

Our own website analytics records visits, interactions, campaign sources, approximate country, and device category on our EU-hosted infrastructure. It uses random browser and session identifiers. When you register or sign in, we can associate visits with your account and use campaign and subscription information to understand acquisition and conversions. These identifiers are pseudonymous personal data, not anonymous data.

We do not store your IP address in our own marketing attribution records. Optional website analytics and campaign/account attribution each require prior consent (Article 6(1)(a)). Website analytics alone excludes campaign parameters and account/revenue joins. Signing up, buying or accepting the Terms does not grant either purpose.

Use Cookie settings to reject optional tracking or change your purposes. Choices last 180 days. Our own measurement honours Do Not Track and Global Privacy Control. You can also turn off our own website analytics and explicitly request erasure. Withdrawal prevents future capture and pending writes; deletion also covers derived attribution and conversion history for a linked account. Necessary billing records remain separate.

We also use Google Analytics on the public website and blog, only after you accept Website analytics. Google receives pseudonymous browser identifiers, device information, pages and interactions, and your network address when your browser connects. We do not send your HelpCenter.io account ID, email or subscription revenue to Google. Google signals and advertising personalization are disabled. Account screens and draft previews are excluded. Google may process information outside the EU: see Google’s Privacy Policy and its international transfer information. Google Tag Manager containers, Hotjar, Pingdom browser measurement and the Capterra signup conversion pixel remain disabled. Our Cookie Policy lists the current purposes, storage and controls.

5. Who receives personal data?

Authorised staff and service providers receive information needed for their work. Provider functions include hosting, payments, email delivery and customer communications, monitoring, and website measurement. These include AWS for core hosting, Braintree/PayPal for subscription payments, Loops for customer communications, and the measurement providers above. Providers may act as processors or as separate controllers for their own purposes, such as payment fraud prevention.

Customer-enabled integrations receive data needed for the connection you authorise. AI features process relevant content, questions, prompts, and outputs through the service configured for that feature. Contact us to confirm the processing arrangement for the AI features and integrations you plan to use.

We may disclose relevant information when legally required, to establish or defend legal claims, or as part of a business transfer subject to applicable data protection obligations. We do not sell personal data. We do not treat hashed email addresses or account-linked identifiers as anonymous information.

Content you publish publicly, including author details, can be viewed worldwide and indexed or copied by others. Customer administrators can access information within their authorised workspace. We do not publish your private support requests merely because you contacted us.

6. EU hosting and international transfers

Our core application and customer content are hosted on AWS in the European Union. Core hosting does not mean every external service, network, integration, or recipient operates exclusively in the EU. International access or processing may arise through those services, the recipients of your communications, or content you make public.

Transfers outside the European Economic Area require an applicable GDPR transfer mechanism. Depending on the recipient and circumstances, this may be a European Commission adequacy decision or appropriate safeguards such as the Commission's Standard Contractual Clauses, with the required assessment and supplementary measures. We do not rely on the former EU–US Privacy Shield.

Write to office@helpcenter.io for information about relevant recipients and locations, the transfer mechanism used, and a copy of applicable safeguards, subject to necessary redactions.

7. How long we retain information

• Account and support information: for the customer relationship and afterwards where needed to resolve outstanding requests, disputes, or legal obligations. Subscription cancellation is separate from account deletion.
• Invoices and transaction records: accounting registers, financial statements and associated tax/audit records are retained for ten years from 1 January of the reporting period following the period they concern. Tax and VAT documents may require longer retention: the applicable period can run until five years after the limitation period for the related public liability expires. Required electronic records are preserved electronically. Relevant records may also be subject to a specific legal preservation requirement or legal claim. These obligations do not apply indiscriminately to customer help-centre content or marketing history.
• Security and technical records: for the period needed to detect, investigate, and resolve security or service issues, including relevant legal claims or preservation requirements.
• Our website measurement: our retention policy sets a maximum of 13 months for raw events, sessions, linked visitors, touchpoints, attribution and conversion records, independently of an account’s lifetime. Existing records are covered by a reviewed cleanup during rollout. You can request deletion or object by contacting us. Minimal consent evidence is kept for up to 395 days from the choice, separately from browsing history.
• Google Analytics: user-level and event-level retention is configured to two months, with renewal on new user activity disabled. Google applies changes to these settings after 24 hours. Most standard aggregate reports are not covered by those user/event retention settings.
• Customer content: we remove customer content from our live customer databases within 30 days after a verified deletion request, subject to specific legal preservation obligations. Account closure or subscription cancellation is separate from a deletion request. The applicable backup lifecycle is separate; deleting live content does not mean every backup copy disappears immediately. Contact us for the backup arrangements relevant to your data.

Automated marketing-history deletion is not yet enabled during this rollout. The 13-month period is our retention policy; historical records may remain pending the reviewed cleanup. Contact office@helpcenter.io to request deletion. We will update this notice when the cleanup and daily enforcement are active.

Where information is retained for a legal obligation or claim after a deletion request, its use is restricted to that purpose. Contact us for the arrangements relevant to your data, including backups and providers.

8. Security

We use technical and organisational measures appropriate to processing risks, including authenticated access and permissions for customer workspaces. Customers should configure visibility and team access carefully and protect credentials. Contact us to discuss measures relevant to your deployment or report a suspected personal data incident.

9. Your rights and choices

Subject to the conditions in data protection law, you can request access, correction, deletion, restriction, and a portable copy of your data. You can object to processing based on legitimate interests. You have the right to object to direct marketing at any time, including related profiling. You can withdraw consent and unsubscribe from marketing emails using their unsubscribe link. Necessary account and service messages may still be sent.

Send requests to office@helpcenter.io. We may need proportionate information to verify identity. We respond without undue delay and normally within one month. For complex or numerous requests, the GDPR permits up to two additional months; we will explain an extension within the first month. Requests are normally free.

You can complain to the Bulgarian Commission for Personal Data Protection (CPDP), or the authority where you live or work or where an alleged infringement occurred. You need not contact us first. The EDPB directory lists the authorities.

For data in a customer's help centre, that customer handles your request as controller and we assist with processing on their behalf. AI-generated support answers are content features; they are not intended to make decisions about individuals that produce legal or similarly significant effects.

10. Children and policy changes

HelpCenter.io is a business service and is not directed at children. Customers must assess their audiences and requirements applying to children's data in their help centres. Contact us if you believe a child has supplied personal data to us inappropriately.

The date above identifies this policy's version. We will give appropriate notice of material changes and obtain fresh consent where required. Continuing to use the service does not itself consent to a new processing purpose.