This Privacy Policy explains how Helen's Foundry, Inc. ("Helen's Foundry," "we," "us") collects, uses, and shares information when you use Helen's Foundry, our strategic-context platform for teams building with AI agents (the "Service"). By using the Service you agree to the practices described here.
Information we collect
We collect the following categories of information:
- Account information. When you sign in we receive your email address and basic profile details (such as your name and avatar) from the provider you sign in with, Google or GitHub. We do not store passwords.
- Workspace content. The strategic artifacts you create (missions, visions, strategies, goals, personas, tickets, comments, links between artifacts, and related metadata), and the workspaces and team memberships you set up.
- Integration data. If you connect Helen's Foundry to GitHub, our GitHub App receives pull-request and issue metadata (titles, diffs, and check status) for the repositories you authorize, so we can post alignment checks. If you connect other tools, such as Jira, Linear, Slack, Notion, Zendesk, or Canny, we read the items the connected account can see (for example issues, tickets, pages, and messages) so they can appear as evidence in your workspace. If you connect an AI agent over our MCP endpoint, we process the requests that agent makes on your behalf.
- Billing information. When a workspace admin subscribes a workspace to a paid plan, they enter payment details on pages hosted by our payment processor, Stripe. Stripe collects the payment method and the billing contact details entered there, such as name, email address, and billing address. We do not receive or store full card numbers. We keep the workspace's Stripe customer and subscription identifiers, its plan, subscription status, and billing periods, and a record of the credits the workspace uses, with the type and time of each billable operation.
- Usage and technical data. Pages viewed, interactions with Service features, session replay data, server and request logs, IP address, browser type, timestamps, and error diagnostics, used to operate, secure, analyze, improve, and debug the Service.
How we use information
- To provide, maintain, and improve the Service and its features.
- To power AI features (including Helen and agent-facing tools) that read your workspace to answer questions, surface drift, and check work against intent.
- To bill workspaces on paid plans, manage their subscriptions, and measure the credits they use.
- To authenticate you, secure your account, and prevent abuse.
- To respond to support requests and communicate about the Service.
- To comply with legal obligations and enforce our Terms.
AI processing
Helen's Foundry's AI features send relevant artifact content to a third-party AI model provider to generate responses. We do not sell your content, and we do not use it to train our own models. Content processed by third-party model providers is handled under their applicable terms, which prohibit using business/API inputs to train their public models. AI outputs can be inaccurate, so review them before relying on them.
To monitor the quality of AI features, we record the model, operation, timing, and usage of AI requests. A workspace admin can turn this off with Contribute telemetry in workspace settings. We record prompts and model outputs only when a workspace admin turns on Contribute workspace content, which is off by default.
Cookies and sessions
We use strictly-necessary cookies to keep you signed in and to secure your session. We do not use third-party advertising cookies.
Service providers and subprocessors
We share information with vendors who process it on our behalf to run the Service, under contractual confidentiality and security obligations:
- Cloudflare: Application hosting, object storage, database connection pooling, and edge delivery. Data categories: Account information, workspace content, integration data, usage and technical data.
- PlanetScale: Relational database, including accounts and sign-in sessions. Data categories: Account information, session and authentication data, workspace content and related metadata.
- Google Cloud: Hosting for background processing, including AI features and integration sync. Data categories: Workspace content, integration data, usage and technical data.
- Inngest: Background job scheduling and execution. Data categories: User and workspace identifiers, job inputs and results, which can include workspace content and integration data.
- Upstash: Short-lived caching and job coordination. Data categories: Cached workspace data, encrypted integration credentials.
- turbopuffer: Search index for finding related workspace content. Data categories: Embeddings derived from workspace content, identifiers and related metadata.
- OpenRouter: Model processing for Helen's Foundry's AI features. Data categories: Relevant artifact content, AI feature requests, model responses.
- TypeSafe AI: Decision-model processing for Helen's Foundry's AI features. Data categories: Relevant artifact content, AI feature requests, model decisions.
- OpenAI: Model processing and embeddings for Helen's Foundry's AI features. Data categories: Relevant artifact content, AI feature requests, model responses.
- GitHub: Source control integration for repositories you connect. Data categories: Connected repository pull-request and issue metadata, including titles, diffs, and check status.
- Resend: Transactional email delivery, such as workspace invitations. Data categories: Recipient email addresses, email content.
- Sentry: Error monitoring and diagnostics. Data categories: Usage and technical data, error diagnostics.
- PostHog: Product analytics, session replay, and error diagnostics. Data categories: User and workspace identifiers, product usage and technical data, session replay data, sanitized error diagnostics.
- Stripe: Payment processing, subscriptions, and invoicing for paid plans. Data categories: Workspace name and identifier, payment method details, billing contact details, such as name, email address, and billing address, subscription and invoice records.
We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger, acquisition, or sale of assets (with notice where required).
Data retention
We retain your information for as long as your account is active and as needed to provide the Service.
A workspace on a paid plan must cancel its plan in Billing before a workspace admin can delete it. When the workspace is deleted, we remove its subscription records, but we do not automatically erase its record of credit usage. Stripe keeps the workspace's customer, payment, and invoice records under its own privacy policy, including for tax and accounting purposes.
When a workspace admin deletes a workspace, we remove the workspace and its memberships immediately, so no one can open its content in the Service. We do not yet automatically erase all stored content for a deleted workspace, such as its artifacts, data from connected integrations, credit usage records, search indexes, and product analytics and session recordings. Data from a disconnected integration is also not automatically erased. To have this data permanently erased, email us at [email protected] and we will delete it, except where we must retain it to meet legal, security, or backup-rotation requirements.
Security
We protect data in transit with TLS. Every request for workspace content is authorized against your workspace membership before any query runs, so content is only accessible to its members, and stored third-party credentials are additionally encrypted. No method of transmission or storage is perfectly secure, but we work to safeguard your information and to address vulnerabilities promptly.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. To exercise these rights, email us at [email protected]. We will respond consistent with applicable law.
International transfers
We operate in the United States, and our providers may process data there and elsewhere. Where required, we rely on appropriate safeguards for cross-border transfers.
Children
Helen's Foundry is a workplace tool and is not directed to children. We do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy as the Service evolves. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you.
Contact
Questions about this policy? Email [email protected].