Privacy Policy

1Who we are

Helpawy is run by an independent operator based in Texas, United States. It is not a company. In this policy, “Helpawy”, “we” and “us” mean Helpawy and its operator. Helpawy lets business owners create AI agents that answer their customers’ questions using the owner’s own website, documents and written answers.

Questions about this policy or your data: privacy@helpawy.com.

2Owners, visitors and our role

Owners are the people who sign up for Helpawy and build agents. For owners’ account information, we decide how it’s used and are responsible for it.

Visitors are people who talk to an owner’s agent, on the owner’s website or through a share link. Visitors never have a Helpawy account. For visitor conversations we act on the owner’s behalf, as their service provider: the owner decides why the conversations exist, and we process them only to provide the service to that owner. This includes details visitors enter in an agent’s forms, and leads: details a visitor who wants to buy or book shares so the business can get back to them. The business decides what its agent asks for and is responsible for how it uses the answers, including whether it sends marketing to visitors who agreed to it. If you’re a visitor, contact the business you were talking to first; you can also reach us at privacy@helpawy.com.

3What we collect

• Account information: your email address, name, and a salted hash of your password (never the password itself). If you sign in with Google, we receive your name, email address and whether Google has verified it.
• Billing details: if you buy a plan, your name, billing address, payment details and, if you add one, your tax ID. Stripe collects and holds these; we keep only Stripe’s reference to your customer record and your plan’s status. Card details never reach our servers.
• Your workspace content: the websites you ask us to read and the pages we capture from them, documents you upload, the answers you write, and your agent settings (such as its name and greeting).
• Visitor conversations: the messages visitors send to an agent and the agent’s replies, with timestamps. A conversation may contain whatever a visitor chooses to type. If the business turns on a form in its agent, visitors may also be asked for details such as their name, email address or phone number. The agent may also fill in a form from what the visitor wrote in the conversation, for the visitor to check and send. These details are stored with the conversation, including what the agent filled in when the visitor doesn’t send it.
• Leads: when a visitor wants to buy or book and shares how to reach them, the agent records their name, email address or phone number, what they want, their answers to the business’s questions and, if the business asks, whether they’d like its offers by email (with the question they answered). The business can add notes, a status and who on its team follows up. A lead is kept separately from the conversation it came from, so the business keeps it if it deletes the conversation.
• Your chats with Helpawy: what you ask Helpawy, the assistant in your admin app, its replies, the changes it makes for you, and a short description of the screen you were on when you asked.
• Notification recipients: email addresses you add to receive notifications from your workspace.
• People you invite: the email address you enter, who sent the invite and when, so we can email them a link to join your workspace. If they never join, it’s deleted with your workspace.
• Technical information: IP address, browser type, and error and performance diagnostics, used to keep the service secure and working.

4How we use it

• To provide Helpawy: reading your sources, running your agents and showing you your conversations.
• To send emails you need: verification and password-reset codes, invitations to a workspace when a member of it invites you, important service notices, and the notifications you choose, to you and to the people you add. New lead emails include what the visitor wants and how to reach them, so you can reply; when a lead is assigned to someone on your team, they get an email about it.
• To send your leads to another service, only if you set this up: an owner can give an agent a webhook address (for example, an automation tool or a CRM). We then post each new or updated lead to that address on the owner’s instruction. That service is the owner’s choice and works for the owner, not for us.
• To keep the service secure, prevent abuse and fix problems.
• To understand how Helpawy is used and to find problems: our website and app (including share links, but never an agent’s widget on a business’s website) send Microsoft Azure’s Application Insights the pages viewed, time on page, the site that linked to us (its name only), campaign tags, browser, operating system, device type, language, time zone, approximate location (country and city, worked out from the IP address, which isn’t stored), errors in the page and how fast it loads. Addresses are sent without their query strings, so codes in links never leave your browser. If you accept cookies, an anonymous visitor and session id are added, so we can count returning visitors and visits. Our server adds completed sign-ups, visitor conversations per workspace and plan changes. None of this includes names, email addresses or anything visitors type, and it’s never used for advertising.
• To support you and keep the service secure: our support staff can see your account details, your team, your settings and your usage, but not your documents, the text of your pages and answers, your visitors’ conversations, form answers or leads, or your chats with Helpawy. Every action they take on an account is logged with a reason.
• To meet legal obligations.

We never sell personal data and never use it for advertising. We don’t send marketing emails without your permission.

5How answers are generated

When a visitor asks a question, the agent looks up the relevant parts of the owner’s pages, documents and written answers and uses an AI model to write an answer from them. Agents answer only from the owner’s sources, and visitors aren’t shown which page an answer came from.

If the owner’s website is an online store and they turn on live products, the agent also looks up prices, options and stock in that store’s public catalog when a visitor asks about a product. Only the search words are sent to the store, never the visitor’s message, and nothing from the catalog is kept except the product cards shown in the conversation. If the owner also turns on Add to cart, a visitor can add a product from a card to their cart on the owner’s site: their browser does it directly with the store, as the store’s own pages do, and Helpawy only notes which product was added, so the owner can see it in the conversation.

Helpawy, the assistant in the admin app, uses the same AI provider to understand what you ask and to make the changes you ask for, with your permission and as you, in your own workspace. For Insights, the same provider groups similar visitor questions into topics, so you can see what people ask. Nothing extra is stored for this.

For leads, the same provider reads an agent’s conversation to tell whether the visitor wants to buy or book, to note the contact details they shared, and to write a one-line summary of what they want, its key details and how ready to buy they seem. The business can change any of it.

Owners’ content, chats with Helpawy and visitor conversations are never used to train AI models, by us or by our AI provider. AI can make mistakes, so owners should keep their content accurate and review their agents’ answers.

6Who we share it with

We share personal data only with these service providers, only to run Helpawy, and under contracts that protect it:

• Microsoft Azure: Hosting, databases, file storage for uploaded documents, reading the text of scanned documents and of the website images you choose (Azure AI Document Intelligence), sending emails (Azure Communication Services), error and performance monitoring, and understanding how Helpawy is used (Application Insights). Our website sends Application Insights the pages you view, how long you stay, the site that sent you (its name only), campaign tags, your browser, operating system, device type, language and time zone, your approximate location (country and city, worked out from your IP address, which isn't stored), errors in the page and how fast it loads; and, only if you accept cookies, an anonymous visitor and session id. Our server adds sign-ups, visitor conversations per workspace and plan changes, without personal data.
• Azure OpenAI Service (Microsoft): Preparing your content so your agent can search it, generating your agent's answers from it, running Helpawy, the assistant in your admin app, organising your conversations into topics for your Insights, and finding leads in your agents' conversations (spotting visitors who want to buy or book, noting the contact details they share, and summarising what they want). Your content, prompts and answers are not used to train Microsoft's or OpenAI's models.
• Firecrawl: Reading the public pages of websites you connect, when we use their hosted service. It receives the page addresses and returns their text and visual style (colours and fonts).
• Google: Signing in with Google, only if you choose it. We receive your name, email address and whether Google has verified it.
• Stripe: Processing payments for paid plans, calculating sales tax and sending invoices. Stripe receives your name, email address, billing address, payment details and, if you add one, your tax ID. Card details go straight to Stripe and never reach our servers.

We may also disclose information if the law requires it, or to protect the rights and safety of our users or the public. If Helpawy is ever sold or merged, this policy will continue to apply to your data.

7Cookies and browser storage

We don’t use advertising cookies, and our website loads no third-party scripts. Analytics cookies are set only if you accept them, and you can change your answer at any time with Cookie settings at the bottom of our pages. We store only:

• helpawy.auth (cookie): Keeps an owner signed in. Essential; set only after you sign in.
• helpawy.site (browser session storage): Remembers the website you typed on our home page while you sign up. Cleared when you close the tab.
• helpawy.chat (browser session storage): Set by an agent's chat widget (on the business's website) or share link, only once the widget is used. Keeps the visitor's current conversation (its access token and the messages shown), and whether they closed the agent's pop-up message, while they move between pages. Cleared when the tab closes, which also ends the conversation.
• helpawy.consent (browser local storage): Remembers whether you accepted or declined our analytics cookies, so we don't ask on every visit. Set on our website (including share links) when you answer; change it with Cookie settings in the footer.
• ai_user (cookie): Application Insights (Microsoft Azure): a random id that lets us count returning visitors to our website and app. Set only if you accept cookies; kept up to a year. Never set by an agent's widget on a business's website.
• ai_session (cookie): Application Insights (Microsoft Azure): a random id for one visit, so we can count visits and how long they last. Set only if you accept cookies; expires after 30 minutes of inactivity (24 hours at most).

8How long we keep it

• Your account, workspace, sources and agents: While your account is active. Permanently erased 30 days after you delete your account.
• Visitor conversations, including details visitors enter in forms and what an agent fills in for them from the conversation (kept even if they don't send it): While your workspace is active, unless you delete them sooner. Permanently erased 30 days after you delete your account.
• Leads (visitors who want to buy or book, with the contact details they shared, what they want and your notes): Until you delete them, even if you delete their conversations. Deleted with the agent they came through. Permanently erased 30 days after you delete your account.
• Your chats with Helpawy (the admin app assistant): While your account is active, unless you delete them sooner. Permanently erased 30 days after you delete your account.
• Invoices and payment records: As long as tax and accounting law requires (usually up to 7 years), kept in Stripe.
• Logs and error diagnostics: 90 days.
• Backups: Roll off within 35 days.
• Records of actions our support staff take on your account: 12 months.

9Your choices and rights

Owners can delete conversations, sources, agents and their whole account. You can ask us at any time to access, correct, export or delete your personal data by writing to privacy@helpawy.com. We’ll respond within 30 days. Depending on where you live, you may also have the right to object to or restrict processing, and to complain to your local data protection authority.

10Security

All traffic to Helpawy is encrypted with HTTPS, passwords are stored only as salted hashes, and access to data is limited to what’s needed to run the service. No system is perfectly secure; if a breach affects your data, we’ll tell you as the law requires.

11Where data is processed

Helpawy is run from Texas, United States. Our service providers may process data in the United States and other countries. Where the law requires it, we use appropriate safeguards for international transfers.

12Children

Helpawy isn’t intended for anyone under 16, and we don’t knowingly collect their personal data. If you believe a child has given us personal data, contact privacy@helpawy.com and we’ll delete it.

13Changes to this policy

If we make a material change, we’ll email owners and update the date at the top of this page before the change takes effect.