Privacy Policy

1. Scope and service

Helix Work is a model-neutral AI agent workspace. It lets users connect AI models, MCP servers, plugins, files, repositories, browsers, terminals, and business tools so an agent can complete permission-aware tasks and return inspectable results.

This policy applies to information processed by Helix Work through helixwork.net, passport.helixwork.net, the Helix Work desktop application, and services that link to this policy. Third-party models and connected services have their own privacy practices.

2. Information we collect

• Account information: email address or mobile number when you provide one, a securely hashed password, display name, avatar, language, region, account status, and security timestamps.
• Social sign-in information: the identity provider, provider-specific user identifier, name, avatar, email address, and whether the provider reports that email as verified.
• Workspace content: prompts, instructions, messages, files, generated outputs, task history, and configuration that you choose to process through the service.
• Connected-service data: information requested from a plugin, MCP server, model provider, or business tool only when you connect it and authorize the relevant action.
• Technical and usage data: IP address, device and browser information, app version, feature interactions, performance data, crash reports, logs, and security events.
• Communications: messages and supporting information you send when requesting support, reporting a problem, or exercising a privacy right.

3. Google Sign-In and Google API data

When you choose Google Sign-In, Helix Work requests only the OpenID Connect scopes openid, email, and profile. We receive your Google account identifier, name, profile image, email address, and email verification status. We do not request Gmail, Drive, Calendar, Contacts, advertising, or other Google product data as part of sign-in.

We disclose Google Sign-In data only to service providers acting on our behalf when necessary to host and secure authentication, or when disclosure is legally required. Those providers are subject to confidentiality and security obligations. Authorized personnel may access this data only when needed for account support, security investigation, legal compliance, or service maintenance, using access controls appropriate to their role.

Helix Work does not use Google user data to train AI models, personalize AI models, generate content, advertise, or build marketing profiles. Google user data is never used to create, facilitate, or distribute non-consensual intimate imagery or any other sexually exploitative content.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

4. How we use information

• Provide authentication, accounts, workspaces, agent execution, integrations, and requested support.
• Route user-authorized requests to the models and tools the user selects and return their results.
• Protect accounts, investigate abuse, enforce permissions, and maintain service reliability.
• Measure performance, diagnose errors, and improve product usability and accessibility.
• Send transactional messages such as verification, security, service, and support notices.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, share it with data brokers, or use it for cross-context behavioral advertising.

5. AI models, plugins, and other third parties

Helix Work is model-neutral. When you select a model provider, plugin, MCP server, or connected business service, the information needed to perform your request is sent to that service under your direction. The third party may process that information under its own terms and privacy policy. Workspace administrators may also configure providers and control organization data.

We may use infrastructure, email, analytics, security, and support vendors that process information on our behalf under contractual confidentiality and security obligations. We may disclose information when required by law, to protect users or the service, or in connection with a corporate transaction subject to appropriate safeguards.

6. Retention and deletion

Account and linked-identity records are retained while your account remains active. If you unlink Google or another social provider, we remove that identity link when another usable sign-in method remains. Deleting your Helix Work account also removes the linked Google identifier and profile data from active systems. Residual copies may remain temporarily in encrypted backups until they expire through our backup cycle. Minimal security and fraud-prevention records may be kept longer when reasonably necessary to protect users, meet legal obligations, or resolve disputes.

Workspace content and task history are retained according to product settings and any organization agreement. Revoking Helix Work from your Google Account connections prevents future Google access but does not by itself delete your Helix Work account or information already provided during sign-in.

You may request account deletion by emailing privacy@helixwork.net. We will delete or de-identify information that is no longer required, subject to legal obligations, security needs, dispute resolution, backup cycles, and organization administrator controls.

7. Security

We use administrative and technical safeguards designed for the nature of the information, including transport encryption, access controls, credential hashing, scoped integrations, and monitoring. No online service can guarantee absolute security. You are responsible for protecting your credentials, reviewing requested permissions, and maintaining appropriate backups of important work.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of personal information. You may disconnect a linked provider through account settings when another sign-in method is available. You can also revoke Helix Work access from your Google Account connections.

To exercise a privacy right, contact privacy@helixwork.net. We may need to verify your identity before completing a request.

9. Children and international use

Helix Work is intended for business and professional use and is not directed to children. We do not knowingly collect personal information from children who cannot legally consent to its processing. Information may be processed in countries other than your own, with safeguards required by applicable law.

10. Changes and contact

We may update this policy as the service or applicable requirements change. We will post the revised policy here and update the effective date. Material changes may receive additional notice where appropriate.

Questions, complaints, and privacy requests can be sent to privacy@helixwork.net.