Privacy Policy

How Heli HQ handles personal data, including data from connected Google services and Meta. Version 7, 25 October 2026. This English version applies to customers and users outside the Netherlands; for customers in the Netherlands the Dutch version applies.

1. Who we are

Heli HQ, Papaverweg 34, 1032 KJ Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 96162996 ("Heli HQ", "we", "us"). We are the controller for the personal data described in this policy. For any privacy question or request, email info@heli-hq.com.

This policy is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the privacy laws of US states such as the California Consumer Privacy Act (CCPA, as amended by the CPRA), to the extent those laws apply to us.

2. Two roles: controller and processor

Heli HQ processes personal data in two roles.

• Data about you as a customer of Heli HQ: your account, your payments, your use of the Service and the integrations you switch on. We are the controller for this data, and this policy is about it.
• Data you put into Heli HQ about your own leads, clients and staff, or that reaches Heli HQ through integrations you switch on. For this data you are the controller and we are your processor (under US state laws: your service provider). We use it only to provide the Service to you, never for our own purposes. The terms are set out in the Data Processing Agreement.

Are you a lead or client of a business that uses Heli HQ and do you have a question about your data? Please contact that business first. We help the business handle your request, and if you contact us we will forward your request to them.

3. The data we process about you

• Account data: name, business name, email address, a hashed password, your role in the workspace, your language, country, currency and time zone, and your preferences. If you sign in with Google, we receive your name, email address and profile picture from Google. We never receive your Google password.
• Business data: your business name, address, company registration number and VAT or tax number, for invoicing.
• Payment data: your payments to Heli HQ are handled by Stripe (and, for older subscriptions, by Mollie). We do not see full card or account numbers. We receive from the payment provider whether a payment succeeded, the payment method type, the status of your mandate or subscription and your invoice details.
• Usage data: technical logs (IP address, browser type, time, pages requested) and which features you use. We use these to run, secure, fix and improve the Service.
• Messages: emails and support requests you send us, and the questions and instructions you give to the Heli HQ AI assistant, by text or by voice.
• Device data for the app: if you allow notifications in the Heli HQ app, we store a push token for your device so we can send you notifications.
• Data from integrations: if you switch on an integration (for example Google, Meta, Microsoft Clarity, your own Stripe or Mollie account, or your accounting software), we receive the data that integration needs. Sections 5 to 8 explain this.

4. Why we use your data and on what legal basis

Under the GDPR and UK GDPR we rely on the following legal bases:

• Providing the Service, your account, the integrations you switch on and invoicing: performance of a contract (Article 6(1)(b)).
• Security, detecting and preventing abuse and fraud, fixing problems and improving the Service: legitimate interests (Article 6(1)(f)). Our interest is a secure and well-working service; we use no more data than necessary.
• Keeping invoices and accounting records: legal obligation (Article 6(1)(c); Dutch tax law requires us to keep them for seven years).
• Emails about new features and changes to the Service to existing customers: legitimate interests. You can unsubscribe at the bottom of every such email; messages that are needed for the Service (such as an invoice or a security notice) will continue.
• Integrations with Google services: consent (Article 6(1)(a)), which you give on Google's consent screen and can withdraw at any time.

We do not use your data for advertising, we do not sell it, and we do not share it with anyone who wants to use it for their own purposes.

5. Data from Google services

You can connect Heli HQ to your Google account. This is optional: Heli HQ works without it. When you connect, Google asks your consent for exactly the parts you switch on. We never ask for more access than the feature you use needs.

How we use Google data. We use data from Google services only to provide the feature you switched on, as listed in the table above. We do not use it for advertising, we do not sell it, and we do not use it to train or improve AI models. Heli HQ staff do not read this data unless you explicitly ask us to (for example in a support request), it is necessary for security or to investigate abuse, or the law requires it.

How we store Google data. We store the access tokens for your Google account encrypted in our database at Supabase, in a data centre in Frankfurt, Germany. We store events from your calendar only as far as needed for the feature to work, for example the appointment in your Heli HQ calendar.

Who we share Google data with. Only with the parties needed to run the Service (our hosting and database providers, see section 11), or when the law requires it. We never transfer Google data to third parties for their own purposes.

Disconnecting and deletion. You can disconnect Google at any time under Integrations in your account, or at myaccount.google.com/permissions. When you disconnect, we delete the access tokens immediately. Data already in your Heli HQ account stays until you delete it or close your account. To have all data we received from Google deleted, email info@heli-hq.com; we will do so within thirty days.

Limited Use disclosure. Heli HQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Statistics of your own website (Microsoft Clarity)

If you connect your own website to Microsoft Clarity and switch that integration on in Heli HQ, we fetch the statistics of your website (visitor numbers, behaviour on your pages) and show them in Heli HQ. We only keep the summarised figures the screen needs. For this feature Microsoft is a provider with whom you share your own website data; Microsoft's terms also apply to your use of Clarity on your site.

7. Data from Meta (Facebook and Instagram)

You can connect Heli HQ to Meta. This is optional. When you connect, you sign in with Facebook and choose which Facebook pages and ad accounts Heli HQ may use.

We use data from Meta only for the features above, for your account. We do not sell it, do not use it for our own advertising and do not use it to train AI models. We store Meta access tokens encrypted. You are responsible for the leads that come in through your forms; Heli HQ processes them on your behalf (see section 2).

Having Meta data deleted. Disconnect under Integrations, Meta, Disconnect: we revoke access at Meta and delete the access tokens immediately. You can also remove Heli HQ in Facebook under Settings and privacy, Settings, Apps and websites (or Business integrations). Leads already in your pipeline you delete yourself in Heli HQ, one by one or all at once. To have everything we received through Meta deleted, email info@heli-hq.com; we do so within thirty days and confirm by email. If you filled in a lead form and want your data deleted, contact the business whose form you used, or email us and we will forward your request and help the business delete your data.

8. Other integrations you switch on

You can connect your own accounts at other services, such as Stripe or Mollie (to get paid by your clients), Jortt, Xero or QuickBooks (accounting), Klaviyo and Instantly (email marketing and outreach) and Fathom (meeting notes). We exchange with those services only the data the integration needs, on your instruction and for your account. You have your own agreement with those services, and their terms and privacy policies apply. You can disconnect any integration at any time; we then delete the access keys. Payments your clients make through your own Stripe or Mollie account go directly from your client to you: Heli HQ does not receive or hold that money.

9. Email sent on your behalf

Heli HQ can send emails on your behalf to your leads and clients (for example a booking confirmation, a reminder, an invoice or a document to sign). These emails are sent through Google Workspace from noreply@heli-hq.com, with your business name and branding and your own email address as the reply-to address. The content and recipients come from your account.

10. How long we keep data

• Account data and the content of your account: as long as your account exists. You can export everything at any time under Settings, Export everything. If you delete your workspace, it is no longer accessible immediately, so please export first. We permanently erase what remains no later than thirty days later, including from backups within their cycle of at most thirty days.
• What you delete yourself (such as a lead, client or file): thirty more days, then we erase it permanently. If you sent a client an invoice, we anonymise that client and keep the invoice, so you can meet your tax record-keeping obligations.
• Invoices and accounting records: seven years, because of Dutch tax law.
• Technical logs: as long as our providers (Vercel, Supabase) keep them by default; our own error logs are deleted after ninety days.
• Access tokens for integrations: until you disconnect or close your account.
• Support messages: up to two years after the last contact.
• Conversations with the AI assistant: as long as your account exists, so you can look back at them. You can delete conversations yourself.

11. Who we share data with

We do not sell personal data. We use the following providers to deliver the Service. Each of them is bound by a data processing agreement or their own data processing terms.

We also disclose data where the law requires it, for example at the request of a competent authority, or where necessary to establish or defend legal claims. If Heli HQ or its business is transferred to another party, your data may transfer with it; we will tell you in advance.

12. International transfers

Your data is stored in the European Union. Where a provider processes data outside the European Economic Area, the United Kingdom or Switzerland, or is based there, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, the UK Extension to it and the Swiss-US framework, where the provider is certified) or, where that does not apply, on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and supplementary measures where needed. You can ask us for a copy of the relevant safeguards.

13. The AI assistant and automated decisions

The Heli HQ AI assistant answers questions and carries out tasks based on the data in your account. To answer, we send your question and the relevant data from your account to Anthropic's AI model. The assistant does not take decisions with legal or similarly significant effects for you or your clients without a human looking at them: you can check and change everything it proposes before it is carried out, and you always send messages, documents and payments yourself. We do not use your data to train AI models.

14. Cookies and local storage

heli-hq.com uses only functional cookies and local storage in your browser, for example to keep you signed in and remember your language and preferences. These do not require consent. We do not use advertising cookies or third-party tracking cookies. If we ever use analytics or other cookies that require consent, we will update this policy and ask for your consent first.

The WordPress plugin on our customers' websites. The plugin sets only the cookie heli_hq_bron (90 days), which remembers through which ad or site a visitor arrived, and only after the visitor has accepted marketing cookies; without consent it sets nothing. The plugin forwards form submissions to Heli HQ, but never fields with passwords, payment details, national identification numbers or health data. The website owner is responsible for the cookie banner and cookie notice on their site.

15. Security

All connections are encrypted (HTTPS). Passwords are stored hashed. Access tokens for integrations are stored encrypted. Every team member has their own sign-in, with a confirmation code by email on a new device. Access to data is limited, based on roles, to the people and systems that need it to provide the Service, and data of different customers is separated per workspace and enforced by the database. Data is stored in data centres in the European Union and backed up daily. No service can guarantee absolute security. If we discover a personal data breach that poses a risk to you, we inform you and, where the law requires it, the Dutch Data Protection Authority within 72 hours.

16. Children

The Service is meant for business use and is not directed at people under 18. We do not knowingly collect data from minors. If you believe we have data of a minor, email us and we will delete it.

17. Your rights (EEA, UK and Switzerland)

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests, including to direct marketing at any time. Where you gave consent, you can withdraw it at any time; this does not affect processing that took place before.

Much of this you can do yourself: change your account and business details under Settings, disconnect integrations under Integrations, export all your data at once under Settings, Export everything, and close your account from within your account (see Delete your account). For any other request, email info@heli-hq.com. We respond within one month. To make sure the request comes from you, we may ask you to sign in or confirm your identity in another way.

If you are unhappy with how we handle your data, we would like to hear it first. You also have the right to lodge a complaint with a supervisory authority: our lead authority is the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl); you may also contact the authority in the EU country where you live or work. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk), in Switzerland the Federal Data Protection and Information Commissioner.

18. Your rights under US state privacy laws

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas or Oregon) and that law applies to us, this section applies to you in addition to the rest of this policy.

• Categories we collect (in the past twelve months): identifiers (name, email address, IP address, account ID); customer records and commercial information (business details, subscription and payment history, without full card numbers); internet or other electronic network activity (usage logs); professional information (your business and role); audio, if you speak to the AI assistant (processed to turn it into text, not stored as recordings). We do not collect sensitive personal information other than your account password, which we use only to sign you in.
• Sources: you, your use of the Service, and the integrations you switch on.
• Purposes: as described in section 4.
• Disclosure: we disclose these categories for business purposes to the service providers in section 11. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling with legal or similarly significant effects. We have not done so in the past twelve months.
• Your rights: to know what personal information we collect, use and disclose; to access a copy; to correct it; to delete it; and not to be discriminated against for exercising these rights. Because we do not sell or share personal information or use sensitive personal information for other purposes, there is nothing to opt out of or limit.
• How to make a request: email info@heli-hq.com. We verify your identity by asking you to confirm from the email address of your account or to sign in. You may use an authorised agent; we may ask for proof of the authorisation and verify your identity directly with you. We respond within 45 days.
• Appeal: if we decline your request, you can appeal by replying to our decision. We respond to an appeal within 60 days. If you are not satisfied, you may contact the attorney general of your state.

Data about your own clients that you put into Heli HQ is handled by us as your service provider (see section 2): requests from your clients should go to you.

19. Other countries

If you use Heli HQ from another country (for example Canada, Australia or New Zealand), we handle your personal data as described in this policy and you have the rights described in section 17. Email us with any request or complaint; you may also contact your local privacy regulator.

20. Changes

We may update this policy, for example when the Service changes or the law requires it. The current version is always at heli-hq.com/privacy, with the version number and date at the top. We email customers in advance about important changes.

21. Language

This policy exists in English and Dutch. The English version applies to customers and users outside the Netherlands; the Dutch version applies in the Netherlands. Other language versions, where offered, are for convenience only.