Privacy Policy

1. Who is responsible for your data?

HelpCenter.io is operated by HelpCenter Solutions Ltd., registered in Bulgaria with company number 205107652 and VAT number BG205107652. Our postal address is Cherno more, Detelina 2, 8115 Burgas, Bulgaria. Contact us at office@helpcenter.io about this policy or your personal data.

We are the controller for personal data used to manage our website, customer relationships, accounts, billing, and our own communications and security.

When a customer uses HelpCenter.io to process personal data in their help center, we generally act as their processor, following their instructions. The customer determines the purpose and lawful basis, publishes their own privacy notice, and handles requests from their visitors and users. Contact that organisation first about data in its help center; we can help identify the responsible customer. Our data protection information explains how to arrange a Data Processing Agreement (DPA). This policy does not replace a DPA.

2. Information we process

• Account and contact information: name, email, authentication information, team membership, permissions, and information you provide about your organisation.
• Subscription and billing information: plan, payment status, billing contact, address, tax information, invoices, and payment-provider identifiers. Payment details are handled through our payment providers.
• Communications: enquiries, demo requests, support messages, and communication preferences.
• Service and security information: IP addresses, browser and device information, access times, technical logs, and activity needed to operate, troubleshoot, and protect the service.
• Website measurement: pages viewed, interactions, referring pages and campaign parameters, approximate country, device category, and browser identifiers. Some measurement is linked to an account and subscription activity, as described below.
• Google Analytics: user-level and event-level retention is configured to two months, with renewal on new user activity disabled. Google applies changes to these settings after 24 hours. Most standard aggregate reports are not covered by those user/event retention settings.
• Customer content: articles, attachments, author information, search queries, feedback, messages, and AI inputs and outputs where those features are used. We process this on behalf of the customer, except where a separate controller purpose described in this policy applies.

We receive information from you, through service use, from colleagues inviting you, from payment providers, and from integrations you or your organisation authorise. Connected services may provide content, profile details, and access tokens according to the permissions granted.

Migration requests submitted by agents. An automated agent acting on your behalf may give us your contact email address, source knowledge-base URLs and information about the requested migration. HelpCenter.io acts as controller for these enquiries. We use the email address only for our team to contact you about that request. It is not published with the help center or added to marketing lists because a migration was requested. Access within HelpCenter.io is restricted to authorised staff; our hosting, communications and monitoring providers process it as necessary to support that work.

Contact and authentication information is needed to create and secure an account; billing information is needed for a paid subscription. Without required information, we may be unable to provide the requested service. Optional information and marketing choices are separate.

3. Purposes and legal bases

We assess legitimate interests against your rights and expectations. You may object to processing on that basis. Where we rely on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal. Accepting our Terms or reading this policy does not provide consent to optional tracking or marketing.

4. Website and widget measurement

Our own website analytics records visits, interactions, campaign sources, approximate country, and device category on our EU-hosted infrastructure. It uses random browser and session identifiers. When you register or sign in, we can associate visits with your account and use campaign and subscription information to understand acquisition and conversions. These identifiers are pseudonymous personal data, not anonymous data.

We do not store your IP address in our own marketing attribution records. Cookie-based website analytics and campaign/account attribution each require prior consent (Article 6(1)(a)). Website analytics alone excludes campaign parameters and account/revenue joins. Functional separately controls our internal help-widget usage analytics. Proactive prompts, contextual article suggestions and requested help remain available without this choice. Signing up, buying or accepting the Terms does not grant these purposes.

Use Cookie settings to reject optional cookie-based tracking or change your purposes. Choices last 180 days. Our optional marketing and widget measurement honour Do Not Track and Global Privacy Control. You can also turn off our own website analytics and explicitly request erasure. Withdrawal prevents future capture and pending writes for this marketing measurement; deletion also covers derived attribution and conversion history for a linked account. Necessary billing records remain separate.

With your Functional consent (Article 6(1)(a)), our marketing-site help widget records content and interaction data, including searches, article views, reading time, ratings and prompt interactions, to understand content usefulness and widget effectiveness. Its own measurement runs on our EU infrastructure. Proactive assistance and contextual suggestions work independently of this choice, using visible page text and current-page interaction signals to offer relevant help. Without Functional, prompt state stays in memory for that page, stored visitor history is not read and prompt statistics are not reported. Withdrawing Functional stops optional usage analytics while assistance remains available. Session and journey markers can link interactions. The analytics pipeline truncates IP addresses and also derives IP/browser hashes and visitor markers; these records are pseudonymous rather than necessarily anonymous. IP information is also used to identify malicious traffic. Where reputation screening is enabled, full IP addresses may be held temporarily for review and checked with a security reputation provider. Contact office@helpcenter.io about this processing or to exercise your rights.

We also use Google Analytics on the public website and blog, only after you accept Website analytics. Google receives pseudonymous browser identifiers, device information, pages and interactions, and your network address when your browser connects. We do not send your HelpCenter.io account ID, email or subscription revenue to Google. Google signals and advertising personalization are disabled. Account screens and draft previews are excluded. Google may process information outside the EU: see Google’s Privacy Policy and its international transfer information. Google Tag Manager containers, Hotjar, Pingdom browser measurement and the Capterra signup conversion pixel remain disabled. Our Cookie Policy lists the current purposes, storage and controls.

5. Who receives personal data?

Authorised staff and service providers receive information needed for their work. Provider functions include hosting, payments, email delivery and customer communications, monitoring, and website measurement. These include AWS for core hosting, Braintree/PayPal for subscription payments, Loops for customer communications, and the measurement providers above. Providers may act as processors or as separate controllers for their own purposes, such as payment fraud prevention.

Customer-enabled integrations receive data needed for the connection you authorise. AI features process relevant content, questions, prompts, and outputs through the service configured for that feature. Contact us to confirm the processing arrangement for the AI features and integrations you plan to use.

We may disclose relevant information when legally required, to establish or defend legal claims, or as part of a business transfer subject to applicable data protection obligations. We do not sell personal data. We do not treat hashed email addresses or account-linked identifiers as anonymous information.

Content you publish publicly, including author details, can be viewed worldwide and indexed or copied by others. Customer administrators can access information within their authorised workspace. We do not publish your private support requests merely because you contacted us.

6. EU hosting and international transfers

Our core application and customer content are hosted on AWS in the European Union. Core hosting does not mean every external service, network, integration, or recipient operates exclusively in the EU. International access or processing may arise through those services, the recipients of your communications, or content you make public.

Transfers outside the European Economic Area require an applicable GDPR transfer mechanism. Depending on the recipient and circumstances, this may be a European Commission adequacy decision or appropriate safeguards such as the Commission's Standard Contractual Clauses, with the required assessment and supplementary measures. We do not rely on the former EU–US Privacy Shield.

Write to office@helpcenter.io for information about relevant recipients and locations, the transfer mechanism used, and a copy of applicable safeguards, subject to necessary redactions.

7. How long we retain information

• Account and support information: for the customer relationship and afterwards where needed to resolve outstanding requests, disputes, or legal obligations. Subscription cancellation is separate from account deletion.
• Migration enquiries: the contact email address and request details are kept while handling the enquiry and related follow-up, and afterwards where needed to resolve outstanding requests, disputes, or legal obligations. Automatic deletion is not currently enabled for these contact records. The seven-day expiry of an unclaimed help center and expiry of a migration status token 30 days after the request ends are separate from retention of these records; neither automatically deletes the contact email. Contact office@helpcenter.io to request deletion.
• Invoices and transaction records: accounting registers, financial statements and associated tax/audit records are retained for ten years from 1 January of the reporting period following the period they concern. Tax and VAT documents may require longer retention: the applicable period can run until five years after the limitation period for the related public liability expires. Required electronic records are preserved electronically. Relevant records may also be subject to a specific legal preservation requirement or legal claim. These obligations do not apply indiscriminately to customer help-center content or marketing history.
• Security and technical records: for the period needed to detect, investigate, and resolve security or service issues, including relevant legal claims or preservation requirements.
• Our website measurement: our retention policy sets a maximum of 13 months for raw events, sessions, linked visitors, touchpoints, attribution and conversion records, independently of an account’s lifetime. Existing records are covered by a reviewed cleanup during rollout. You can request deletion or object by contacting us. Minimal consent evidence is kept for up to 395 days from the choice, separately from browsing history.
• Google Analytics: user-level and event-level retention is configured to two months, with renewal on new user activity disabled. Google applies changes to these settings after 24 hours. Most standard aggregate reports are not covered by those user/event retention settings.
• Customer content: we remove customer content from our live customer databases within 30 days after a verified deletion request, subject to specific legal preservation obligations. Account closure or subscription cancellation is separate from a deletion request. The applicable backup lifecycle is separate; deleting live content does not mean every backup copy disappears immediately. Contact us for the backup arrangements relevant to your data.

Automated marketing-history deletion is not yet enabled during this rollout. The 13-month period is our retention policy; historical records may remain pending the reviewed cleanup. Contact office@helpcenter.io to request deletion. We will update this notice when the cleanup and daily enforcement are active.

Where information is retained for a legal obligation or claim after a deletion request, its use is restricted to that purpose. Contact us for the arrangements relevant to your data, including backups and providers.

8. Security

We use technical and organisational measures appropriate to processing risks, including authenticated access and permissions for customer workspaces. Customers should configure visibility and team access carefully and protect credentials. Contact us to discuss measures relevant to your deployment or report a suspected personal data incident.

9. Your rights and choices

Subject to the conditions in data protection law, you can request access, correction, deletion, restriction, and a portable copy of your data. You can object to processing based on legitimate interests. You have the right to object to direct marketing at any time, including related profiling. You can withdraw consent and unsubscribe from marketing emails using their unsubscribe link. Necessary account and service messages may still be sent.

Send requests to office@helpcenter.io. We may need proportionate information to verify identity. We respond without undue delay and normally within one month. For complex or numerous requests, the GDPR permits up to two additional months; we will explain an extension within the first month. Requests are normally free.

You can complain to the Bulgarian Commission for Personal Data Protection (CPDP), or the authority where you live or work or where an alleged infringement occurred. You need not contact us first. The EDPB directory lists the authorities.

For data in a customer's help center, that customer handles your request as controller and we assist with processing on their behalf. AI-generated support answers are content features; they are not intended to make decisions about individuals that produce legal or similarly significant effects.

10. Children and policy changes

HelpCenter.io is a business service and is not directed at children. Customers must assess their audiences and requirements applying to children's data in their help centers. Contact us if you believe a child has supplied personal data to us inappropriately.

The date above identifies this policy's version. We will give appropriate notice of material changes and obtain fresh consent where required. Continuing to use the service does not itself consent to a new processing purpose.