Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including your name, email address, company name, and any data you enter into HelmBill — time entries, client records, projects, invoices, expenses, and files you upload such as receipts and avatars. HelmBill is free and we never collect payment or billing information.

We also automatically collect certain information when you use our service, including your IP address, browser type, operating system, device information, and usage patterns through cookies and similar technologies.

2. How We Use Your Information

• Provide, maintain, and improve the HelmBill service
• Send the invoice emails you create or schedule to your clients
• Send technical notices, updates, security alerts, and support messages
• Respond to your comments, questions, and support requests
• Monitor and analyze aggregate usage to improve the product
• Detect and prevent abuse of the service

3. Data Storage and Security

Your data is stored on secure servers with encryption at rest (AES-256) and in transit (TLS 1.3). We implement row-level security to ensure your data is isolated from other users, and validate all input at both the application and database layer. See our security page for details.

4. Data Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties. Your data is processed only by the service providers that run the platform: Vercel (hosting), Supabase (database, authentication, and file storage), Resend (delivery of the invoice emails you send), and Google Analytics and Vercel Analytics (aggregate, anonymized usage measurement on the marketing site). Each processes data only to the extent necessary to perform its service. There are no payment processors because we never collect payment information.

5. Your Rights

You have the right to:

• Access, update, or delete your personal information at any time
• Export all your data (time entries, invoices, client records) in CSV or PDF format
• Request a complete copy of all data we hold about you
• Opt out of non-essential communications
• Close your account and have your data permanently deleted within 30 days

6. Data Retention

We retain your account data for as long as your account is active. When you delete your account, we permanently remove all personal data within 30 days, except where we are legally required to retain certain records (e.g., financial transactions for tax compliance).

7. Contact Us

If you have any questions about this Privacy Policy, please reach out via the contact page.