Privacy policy
Last updated: 4 November 2026 · helq
This policy explains what personal data helq ("we") processes when you visit this website, when you use helq as a customer, and when you write to a shop through a helq chat. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
helq, [email protected], is the controller for the data described in sections 3 and 4.
For the data of a shop's website visitors (section 5) the shop that installed the chat is the controller and we act as its processor under a data processing agreement. Questions about a specific shop's chat go to that shop.
2. Principles
- We collect only what the service needs to work. There is no advertising tracking on this website and none in the chat.
- Card details never reach our servers; Stripe handles them.
- Mailbox credentials a shop gives us for tickets are stored encrypted.
- You can see, export, correct and delete your data; the paths are in section 9.
3. Visiting this website
Server logs. Our hosting provider records each request with the IP address, time, requested page, browser type and referring page, to run and secure the service. Logs are kept for a short period defined by the provider and then deleted.
Cookies. We set only cookies the site needs: a session cookie, a CSRF protection cookie, and your language choice. Your light/dark preference is stored in your browser only. There are no third-party or advertising cookies, so we do not show a cookie banner.
Visitor statistics. To know how many people see this website and sign up, we store an event with a salted hash of the session, the page, the language and, if present, the referring site and campaign parameters. We do not store your IP address or your user agent in these statistics, and known crawlers are excluded.
Fonts. The pages load typefaces from Google Fonts; your browser sends its IP address to Google to fetch them. Google's privacy policy applies to that request.
Legal basis. Our legitimate interest in running, securing and improving the website (GDPR art. 6(1)(f); FADP art. 31).
4. Using helq as a customer
When you create an account we process your name, email address, password (as a hash), language, the company name, your role in the team, the settings you make, the conversations your team handles and the messages you write. We send transactional emails: account verification, invitations, password reset, notifications about unanswered conversations and billing.
Billing. Subscriptions are processed by Stripe. Stripe receives your name, email, company and card details and provides us with the subscription status and invoices. We never see the full card number. Stripe acts as an independent controller for payment data; see Stripe's privacy policy.
Mailboxes. If you connect your own email account for tickets, we store the server names, usernames and passwords encrypted and use them only to send ticket emails from your address and to read replies in the folder you chose.
Support chat. The chat inside the app is our own helq widget; writing to us there is processed like any other conversation, with your name and email prefilled.
Legal basis. Performance of the contract with you (GDPR art. 6(1)(b)), our legitimate interests in security and in improving the product, and legal obligations such as bookkeeping.
5. Writing to a shop through the chat
When you use a chat or leave a ticket on a shop's website, the shop is the controller and we process the data on its behalf. We process the messages you write, the name and email address you choose to give, the language of the page, the page you are on, the time, and an anonymous visitor token stored in your browser so the conversation can continue after a reload. The shop's team sees this in its inbox. If the shop answers a ticket, the email comes from the shop's own address.
The shop decides how long conversations are kept and can export or erase your data; contact the shop for that. We delete the data when the shop asks us to or when its account ends.
6. Who else sees data (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Railway, Inc. | Hosting of the application, database and backups | USA (data centre region as configured) |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription payments, invoices | Ireland / USA |
| Transactional email provider | Delivery of the emails we send you (verification, invitations, notifications) | As configured by the operator |
| Google LLC | Web fonts on the public pages | USA |
| Functional Software, Inc. (Sentry) | Error reporting, when enabled | USA |
Where data leaves Switzerland or the EU/EEA, we rely on the EU–US Data Privacy Framework (and the Swiss–US extension) where the provider is certified, or on standard contractual clauses recognised by the Federal Data Protection and Information Commissioner.
7. How long we keep data
- Account data: for the life of the account and 30 days after it ends, then deleted. Invoices and bookkeeping records: 10 years, as the law requires.
- Conversations and visitor data of a shop: as set by the shop in its retention settings, or until the shop deletes them or its account ends.
- Website statistics events: 12 months.
- Server logs: the retention period of the hosting provider.
8. Security
Connections are encrypted with TLS. Passwords are stored as salted hashes, mailbox credentials encrypted at rest. Access to production systems is limited to the people who run the service and protected by two-factor authentication. Backups are taken daily and stored encrypted.
9. Your rights
You can ask us for information about the data we hold about you, have it corrected or deleted, receive a copy in a machine-readable format, and object to processing based on our legitimate interests. Customers can export and erase their own data and that of their visitors from inside the app. For everything else, write to [email protected]. You may also complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local supervisory authority.
10. Changes
We update this policy when the service or the law changes. The date at the top shows the current version; material changes are announced to customers by email.