Privacy policy

We collect what we need to run your account and bill you for it, and nothing for marketing purposes. Your data stays in the EU. We do not sell it, we do not train models on it, and this website carries no advertising or third-party analytics.

The rest of this page is the same thing in more detail, because the detail matters.

Maxed Labs Ltd, a company registered in England and Wales, is the data controller for personal data about you as a Helm7 customer. Write to [email protected] about anything in this policy.

For the personal data inside your application (your users, their accounts, their files) you are the controller and we are your processor. We only act on your instructions, which in practice means running the operations you or your agents call.

• +Account data. Your name, your email address, your organisation name and, if you are on a paid plan, your billing address and VAT number.
• +Payment data. Handled by our payment provider. We store the last four digits and the card type so you can recognise it. We never see or store the full number.
• +Technical data. IP addresses, request ids, user agents, timestamps and error codes from API and dashboard requests. This is what makes it possible to answer “what happened to request req_8ac31f2e”.
• +Usage and metering data. How much compute, storage and bandwidth each resource used. This is what the invoice is built from.
• +Your content. Your repositories, container images, database contents, uploaded files and application logs. We store and run these. We do not read them except where you ask us to help with a specific problem, or where we have to in order to respond to a legal obligation or a live abuse report.
• +Support correspondence. Emails you send us, and our replies.

Application logs may contain personal data if your application writes it there. We redact things that look like secrets on a best-effort basis before logs leave the platform, which is a safety net rather than a guarantee.

• +To provide the service: running your resources, authenticating your keys, showing you your own data. Lawful basis: performance of our contract with you.
• +To bill you: metering, invoicing, tax records. Lawful basis: contract, and legal obligation for the records we must keep.
• +To keep the platform working and safe: debugging, capacity planning, detecting abuse. Lawful basis: our legitimate interest in running a service that stays up and is not used to harm people.
• +To contact you about the service: incidents, security issues, changes to these policies, and price changes under section 7 of the terms. Lawful basis: contract and legitimate interest.

We do not process your data for advertising, for profiling, or to train machine learning models. There is no lawful basis listed for those because we do not do them.

In the EU. Helm7 runs in two regions today: Falkenstein in Germany and Helsinki in Finland. There is no US region, so your application data does not leave the EU by default.

Some of the people we rely on for email, support and payments operate outside the EU. Where personal data reaches them, it is covered by the standard contractual clauses or an equivalent safeguard. This applies to account and billing data, not to your application data.

A short list, and no-one else:

• +Our infrastructure provider. The servers, storage and network in Falkenstein and Helsinki are Hetzner’s. Your data sits on their hardware, in the EU. Your account records are too: Helm7 itself runs on a Hetzner server in Nuremberg, Germany.
• +Our network provider. Cloudflare carries traffic to Helm7 and to your services, and keeps attacks off them. It sees requests as they pass; it stores none of your application data.
• +Our payment provider. Processes card payments and holds the card details we do not.
• +Our email provider. Delivers account, incident and billing email.
• +Law enforcement or a court, where we are legally required to. We will tell you unless we are legally forbidden from doing so.

We do not sell personal data, and we do not share it with advertisers or data brokers. If we ever add a processor that handles your application data, we will update this page before it starts.

• +Account data: while your account is open, then 30 days after it closes.
• +Your content: while the resource exists. Deleting a Product removes its resources; database backups taken beforehand are kept for 7 days and then deleted.
• +Technical logs: 30 days, then deleted.
• +Billing and tax records: six years, because we are legally required to keep them.
• +Support correspondence: two years.

This website sets no cookies for advertising and no third-party analytics. There is no consent banner because there is nothing to consent to.

The dashboard sets a session cookie so that signing in works, and a preference cookie if you override the light or dark theme. Both are strictly necessary for something you asked for.

Under UK and EU data protection law you can ask us to:

• +give you a copy of the personal data we hold about you;
• +correct it if it is wrong;
• +delete it, where we do not have to keep it;
• +export it in a portable format;
• +restrict or object to how we use it.

Email [email protected]. We will answer within 30 days, and it is free. We may ask you to confirm who you are first, which is a protection for you rather than an obstacle.

If you think we have got this wrong, you can complain to the Information Commissioner’s Office in the UK, or to your local supervisory authority in the EU. We would rather you came to us first, but you do not have to.

When an AI agent operates your account, its calls are recorded against the key it used and the member that key speaks as. That audit trail is part of the technical data described above, and it is kept for the same period.

An ephemeral workspace created with cloud_init has no email address attached to it, so there is usually no personal data to hold beyond the technical logs. If you later claim the workspace, account data starts at that point.

Helm7 is not for children. We do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

We will update this page when what we do changes. For anything material we will email the address on your account before it takes effect. The date at the top shows when it last changed.