Helm
Legal

Privacy Policy

Last updated: 2026-07-27

1. What we collect

We collect the minimum data needed to provide the Service:

  • Your email address (for authentication and account communication)
  • Your dealership name and configuration (tax rate, fees, staff)
  • Data you enter into the app: inventory, customers, deals, service tickets, parts, rentals, journal entries
  • Usage analytics (page views, feature usage — anonymized)
  • Server logs (IP address, timestamp, request URL — retained 30 days for security)

2. How we use it

Solely to operate the Service, respond to support requests, and improve the product. We do not sell your data. We do not share it with advertisers.

3. Third-party processors

To run Helm, we send data to these processors:

  • Supabase — database, authentication, file storage (US region)
  • Vercel — hosting, edge network (US region)
  • Anthropic — AI processing (Service Advisor, PDF extraction). Data sent to Anthropic is NOT retained for training per their API terms.
  • Stripe — payment processing (when you use the Payments module)
  • Resend — transactional email delivery

4. Your customer data

When you enter customer data into Helm (names, emails, phone numbers), you are the data controller. You are responsible for having lawful basis under GDPR/CCPA/etc. to process that data. Helm acts as your data processor under a Data Processing Addendum (available on request).

5. Data retention & deletion

We keep your data as long as your account is active. On cancellation, we delete all your data within 30 days. You can export your general ledger to CSV from Accounting at any time, and request a full export of your account by contacting us.

6. Security

All connections use HTTPS. Database rows are protected by Row Level Security scoped to your dealership — nobody outside your dealership can read your data via the API, not even other Helm customers. Magic-link sign-in is the default, and in that flow there is no password at all. Where a password is provisioned for an account, it is stored by Supabase Auth as a salted hash that Helm itself never receives or sees.

7. Your rights

You may request: (a) a copy of your data, (b) deletion of your data, (c) correction of inaccurate data. Email hi@helmdealer.com.

8. Changes

We will notify you of material changes by email at least 14 days before they take effect.

9. Contact

Data protection questions: hi@helmdealer.com