Privacy Policy

Helixtop is business software. Companies use it to keep track of their customers, their quotations, their work and their money, and to send messages to their own customers over WhatsApp.

This policy explains what we hold and why. It is written to be read, not to be survived.

Who is responsible for what

Two different kinds of information pass through Helixtop, and it matters which is which.

• Information about the business using Helixtop — the company name, the people who sign in, their phone numbers and roles. We decide how this is handled, so we are responsible for it.
• Information about that business's own customers — names, phone numbers, addresses, orders, messages. That belongs to the business. They decide what to collect and how long to keep it; we only store and process it on their instructions. If you are one of their customers and want your details removed, ask them, and they can do it inside the product. If you ask us, we will pass it to them.

What we store

• Account details for the people who sign in: name, phone number, role, and a password that is stored only as a one-way hash.
• The business records they enter: customers, quotations, jobs, stock, bills and payments.
• WhatsApp conversations between the business and its own customers, so the business can see its own history.
• The permission a business grants us to send WhatsApp messages on their behalf, stored encrypted.
• Basic technical records — which endpoint was called, how long it took, and whether it failed. We do not log the contents of requests or messages.

What we do not do

• We do not sell your information, or anyone else's.
• We do not use one business's data to serve another. Every record is scoped to the business that owns it, and that is enforced in the software, not by policy alone.
• We do not read a business's customer messages except when they ask us to help with a specific problem.
• We do not use your data to train models belonging to us or to anyone else.
• We do not run advertising trackers on the product.

WhatsApp

When a business connects WhatsApp, they authorise us through Meta's own sign-up window. We never see their Meta password. What we receive is a permission scoped to their WhatsApp Business Account, which we store encrypted and use only to send and receive that business's messages.

Messages sent through WhatsApp also pass through Meta, and Meta's own terms and privacy policy apply to them. A business can withdraw our permission at any time from their Meta Business settings, or by disconnecting inside Helixtop. Either stops us immediately.

Who else sees it

We share information only with the services needed to run the product:

• Meta, to deliver WhatsApp messages.
• Our hosting and database provider, which stores the data.
• Telecom and payment providers, where a business uses calling or online payment.

We will also disclose information if the law requires it. If that happens and we are permitted to tell the affected business, we will.

Where it is kept, and for how long

Data is stored on servers we control. We keep a business's records for as long as they are a customer. If they leave, they can export everything first, and we delete their data within 90 days of the account closing unless we are required to keep something longer.

Some things are removed sooner because they are only useful while fresh — location pings and call recordings are cleared on a schedule rather than kept indefinitely.

Getting your data removed

If you signed in to Helixtop and want your account deleted, ask the business that gave you the login, or write to us and we will act on it.

If you connected WhatsApp through Meta and want that permission destroyed, you can request deletion through Meta, and we act on it automatically: the stored permission is destroyed and the connection stops working. Meta will give you a reference you can use to check.

Security

Passwords are hashed. WhatsApp permissions and other credentials are encrypted before they are stored. Access to production data is limited to the people who need it to run the service. No system is perfect, and we would rather say that than claim otherwise.

Children

Helixtop is for businesses. It is not intended for anyone under 18.

Changes

If we change this policy in a way that matters, we will tell the businesses using Helixtop rather than quietly changing the date at the top.

Contact

Write to us at info@helixtop.com with anything about this policy, and we will reply.