Privacy Policy

This policy explains what personal information HELIX Sensors Inc. collects through the Helix dashboard, why we collect it, who we share it with, and the choices and rights you have. We have tried to write it in plain language, and to describe only what the product actually does.

In short

• Helix is a business tool: your employer (our client) asks us to create your account. We collect the minimum needed to run it — your work email, an optional name, your role and company, and a password we never store in readable form. If you choose to, you can add a mobile number (kept for text-message alerts, which Helix does not send yet) and an authenticator for two-step sign-in; both are optional and both can be removed.
• Inside the app, we keep a notification inbox for the alerts you switch on, and a record of any announcement you hide. Both stay inside Helix: no third party receives them.
• If your company switches on the AI assistant and you use it, we save your chats with it to your account, until you delete them. They are private to you; Helix administrators may read one to support you, and we record each time they do. To answer, your questions and your company’s data are sent to the AI model provider we use (see the AI assistant).
• There are no advertising, analytics, or tracking technologies anywhere in the Helix dashboard, and we never sell personal information. Our public demo site counts page views so we know whether the demo is being used; it sets no cookies, tells us nothing that identifies anyone, and runs nowhere near your account (see the demo site below).
• We use two essential sign-in cookies — one that keeps you signed in, and one that exists for a few minutes only if your account uses two-step sign-in. Your browser also keeps a few things on your own device — your display preferences, remembered panel sizes, and (only while you are setting a password from an emailed link) that link’s one-time token. (Your preferences are separately saved to your account when you change them in Settings; that copy is described below.) The Cookie Policy lists every one by name.
• The sensor and scan data the dashboard displays is industrial telemetry (pipe wall-thickness measurements). The readings themselves contain no personal information and do not record who was present when a scan ran. Where someone changes how a scan is interpreted — calibrating a sensor, or moving where a scan sits on the pipe — we do record who did it; that is described below.

Who this policy covers

It covers everyone with a Helix account plus visitors to our public demo site (see the demo site below). It does not cover the industrial measurement data (that is governed by our service agreement with each client), and it does not cover your employer’s own privacy practices.

Personal information we collect

Your account

• Work email address — your sign-in identifier. We usually receive it from your employer when they ask us to set up your account.
• Name (optional) — a first and last name, if provided when your account was set up or when you completed your invitation. You can change it yourself in Settings.
• Mobile number (optional) — only if you enter one yourself in Settings. It is kept for one purpose: text-message alerts you switch on. Helix does not send text messages yet, so today nothing uses it — it is stored, and shown back to you in Settings. Leave it blank and nothing is affected; delete it at any time in the same place and it is erased from our records. We never use it for marketing, and we never share it for anyone else’s.
• Role and company — whether the account is a client or administrator account, and which client company it belongs to. This is what scopes you to your own company’s data.
• Password — never stored in readable form. We keep only a salted Argon2id hash, which is additionally encrypted with a separate server-held key.
• Authenticator secret (only if you use two-step sign-in) — the shared key your authenticator app derives its six-digit codes from, together with when you enabled it. It is stored encrypted with the same server-held key that protects passwords, and it can never be read back out of the product. Turning two-step sign-in off deletes it.
• Last active time — when you last used Helix, updated about once a minute; your company’s member list and Helix staff see it, and whether you are online.
• A revocation counter that lets you sign out of every device at once.
• Display preferences — theme, timezone, date and number formatting, and similar settings you choose in Settings.

Messages in the app

• Notifications about your alerts — when an alert you switched on crosses its limit, comes back inside it, or is reset, we write a message to your notification inbox (the bell): the sensor and site it is about, the reading and your limit, and when that reading was taken. We record when you read a message and when you hide it. Your inbox is only yours: no other account can open it through the product — not a colleague, and not an administrator.
• Announcements you hide — we show announcements in the app to groups of accounts, such as notice of planned maintenance. If you hide one, we record that you did and when, so it stays hidden on your other devices. When an announcement is aimed at particular people rather than at a company or a kind of account, the account identifiers it names are stored with it.

Security and operations

• IP address — used to limit repeated sign-in attempts and request rates. Held only in server memory until the server restarts; not written to our database. A throttled address can appear in server logs.
• Server logs — security-relevant events (a sign-in succeeding or failing, an account being created or deleted) are logged and can include your email address and account identifier. Logs are kept by our hosting providers (Railway and Vercel) and are subject to their privacy policies.
• One-time links — when you are invited or reset your password, we email you a one-time link. We store only a cryptographic hash of it, its expiry (30 minutes for a password reset; up to 30 days for an invitation), and when it was used.

Who did what

• The activity record — when someone changes how a company’s plant is set up or read, we record that it was them, when, and what it was before and after. That covers adding, editing, moving and deleting sites, gateways, sensors, pipe sections, assets and snapshots; moving, correcting or confirming where a sensor sits on the pipe; calibrating a sensor; running, adopting and deleting forecasts; POI reports; tickets, regions and runs; and changes to who has access (accounts, roles and permissions). Helix staff’s changes to your company are recorded the same way, as are Helix administrators’ announcements. Each entry keeps the person’s email address as written at the time so the record stays readable even if that account is later deleted; only its link to the account is removed. (Changes to people’s access made before this record existed show the email the account had when we moved them into it.) Your name is shown beside work you calibrated. These records exist so we can tell who changed a company’s plant and how its measurements are read; only Helix staff can read them. Your own alert settings, and resetting an alert, are not part of it.
• Announcement authorship — an announcement keeps the email address of the Helix administrator who wrote it, as written at the time, so it stays clear who said something even after that account is deleted.
• Ticket authorship — each ticket message and change keeps its author’s name (or the part of their email before the @) as written at the time, tagged if they are Helix staff, and everyone who can see the ticket sees it.

Content you provide

• POI reports — administrators can pin notes to a scan (a title, a comment, an optional PDF attachment such as an inspection report). We store this content as provided; if an author includes personal information in it, that information is stored with it.
• Feedback reports — if you use the in-app feedback tool (when available), we receive your note plus technical context: the page you were on, the element you clicked, your screen size, and your browser’s user-agent string. If you are signed in, the report also identifies your account (your name and email address) so we can follow up; a report sent from a signed-out page is marked as such instead.

The AI assistant

The assistant is off until someone who can change your company’s settings switches it on. If it is on and you use it:

• Your chats — each question you ask and each answer, with the page you asked it from and when. The first question names the chat. Anything you type into a question, including personal information, is stored with it. The data the assistant reads to answer (your company’s sites, scans and tickets) is not stored with the chat; it is read again for each answer. Only the names of the reads each answer made (such as “asset briefing”) are kept with it.
• Who can read them — you, on the Assistant page. Not your colleagues, and not your company’s administrators. Helix administrators can read a chat to support you or to fix a problem with the assistant; each time they do, we record who and when. You can ask us for that record (see Your rights).
• The assistant’s access — to answer, it reads Helix as you, through a read-only key that lasts for one answer: it can see only what you can see at that company, and it cannot change anything. Each one is listed under AI access in Settings, with when it was used.
• Sent to the AI model provider — your question, the earlier turns of the chat, and the company data the assistant reads to answer. See who we share it with.

What we deliberately do not collect

• No advertising, analytics, or tracking technologies in the dashboard itself, first- or third-party. Signed-in pages carry no analytics script at all. (The separate public demo site counts anonymous page views, described under the demo site.)
• No profiling and no automated decision-making about individuals.
• No marketing, ever — no promotional email, no promotional texts, no newsletters, and no messages from anyone else. Apart from account email (invitations and password resets), we email you only about alerts you have switched on yourself, about your own assets, and each one can be paused or deleted from the Alerts tab of the asset’s 3-D viewer. Inside the app you may also see announcements from us about the service itself, such as planned maintenance or a change to how the product works.
• No personal information in the measurements themselves — readings are attributed to sensors and gateways, not to people, and nothing records who was standing there when a scan ran. Records of who ADJUSTED something are a different matter, and we do keep those — see “Who did what” below.
• We never sell or rent personal information.

Why we use your information

• To create your account, authenticate you, and keep your session signed in.
• To scope what you see to your own company’s sites, assets, and scans.
• To secure the service — rate limiting, revoking stolen or stale sessions.
• To send the transactional emails described above (invitations, password resets).
• To tell you about the alerts you have asked for. Alerts are off until you turn them on, and you choose what each one watches. An alert that crosses its limit is emailed to you and also appears in your notification inbox in the app; pausing or deleting the alert stops both. An alert email shows a picture of the asset, which your mail app loads from our servers when you open the message.
• To show you announcements about the service, and keep the ones you hide hidden.
• To apply your display preferences.
• To respond to feedback and fix problems you report.
• If you use the AI assistant: to answer your questions, to keep your chats so you can return to them, and to support you and fix problems with the assistant.

We do not use your information for any other purpose without asking you first.

Consent

The limited collection described above is integral to providing an authenticated portal — it is a condition of the service, and by signing in and using Helix you consent to it. If we ever want to use your information for a new purpose, we will ask separately before doing so. Alerts are exactly that kind of separate, opt-in purpose: they are off by default, switching one on is the consent, and switching it off withdraws it. Nothing about your account depends on them. The AI assistant is another: your company switches it on, and you choose whether to use it; you are told, before you ask anything, that chats are saved and who may read them. Deleting a chat withdraws it, and not using the assistant means nothing is collected. You may withdraw consent at any time by asking your company’s administrator to close your account, or by contacting us (withdrawing consent for the data the service cannot run without means closing the account).

Who we share it with

We share personal information only with the service providers that host and operate the product, listed below. Each processes it on our behalf; we remain responsible for it.

Beyond service providers: we will disclose personal information if required by law (for example a court order), and if Helix is ever part of a merger or sale of the business, this policy would continue to apply to the information transferred with it. Your company’s administrators can see the accounts (email, name, role, last active) that belong to their company.

Where it is stored

Our service providers may store and process personal information outside Canada, including in the United States and the European Union. While it is there, it is subject to the laws of that jurisdiction, and may be accessible to that jurisdiction’s courts, law enforcement, and national security authorities. We use contractual and technical safeguards with each provider regardless of where the data lives. If you have questions about our cross-border practices, contact our privacy officer (below).

How long we keep it

• Account information — for as long as your account exists. When an account is deleted, the deletion is permanent (we use hard deletes, not archival flags).
• The activity record — kept for as long as the company it belongs to exists. It outlasts the account, and the sensors, pipe sections and other things it describes: each entry keeps the email address as written at the time, deliberately, because deleting an account or a sensor must not quietly rewrite who changed the plant or how a measurement is read. It is deleted with the company. It is not copied when a company is copied. If you need such a record amended or removed, write to our privacy officer and we will handle it case by case.
• Tickets — until the ticket or your company is deleted; deleting a message erases its text and earlier versions.
• Notifications — a message you hide is deleted 90 days after you hide it, and one you never hide is deleted 180 days after it was written. A message goes sooner if the alert it is about is deleted (its rule, its sensor, or the scan that raised it), and every message goes with your account. The internal delivery record behind each message is deleted 7 days after it is delivered.
• Announcements — kept until an administrator deletes one, not deleted by age: an announcement is the record of what was said to whom. The record that you hid one is deleted with the announcement, or with your account.
• Assistant chats — until you delete the chat (on the Assistant page; the deletion is permanent), or your account or your company is deleted. The record of each time Helix administrators read a chat goes with the chat. Switching the assistant off does not delete them.
• Database backups — deleted records may persist in our database provider’s automated backups for some amount of time (depending on the provider) before rotating out.
• Server logs — per our hosting providers’ retention.
• Sign-in rate-limit data (IP addresses) — in server memory only, until the server restarts.
• One-time link records — links expire on their own (30 minutes to 30 days) and records of consumed links are cleared when superseded.

How we protect it

• All traffic is encrypted in transit (TLS).
• Your session lives in an httpOnly cookie that page scripts cannot read; sessions expire after 24 hours and can be revoked instantly on every device (“Sign out everywhere” in Settings).
• Passwords: salted Argon2id hashes, additionally encrypted with a server-held key.
• Two-step sign-in (where your account uses it): your authenticator secret is encrypted with that same server-held key, each code can be used only once, and the short-lived token that carries you between the password step and the code step is a separate, five-minute credential that grants no access to your data on its own.
• One-time links are stored only as cryptographic hashes.
• Assistant chats are readable through the product only by their owner, and by Helix administrators holding a separate permission for it, whose every read is recorded. The assistant itself cannot read or change them.
• When you open a one-time link, we take its token straight back out of the web address so it is not left in your address bar, your browser history, or the referrer sent to any later request. While you finish setting your password the tab holds it in session storage instead — it is erased when you close the tab, never reaches another tab, and is deleted the moment the link is used.
• Every request is re-checked server-side against your current role and company — hiding things in the browser is never the security boundary.
• Files are never public links. An asset’s preview picture is sent through our own service, which checks your access each time it is requested; other files are served through short-lived signed URLs (minutes to one hour).

No online service can promise perfect security, but we design so that the blast radius of any failure is as small as we can make it.

Your rights

You can ask us to confirm what personal information we hold about you, to access it, to correct it, or to delete it. Write to our privacy officer (below); we will verify your identity, respond within 30 days, and explain anything we cannot do (for example, deleting the account of a colleague — that request has to come from your company’s administrator). Your assistant chats are on the Assistant page, where you can delete any of them; ask us, and we will tell you each time Helix administrators read one, and who. You can correct your own display name — and add or remove a mobile number — yourself, in Settings. An email address cannot be edited once an account exists: it is the account’s identity, so moving to a new address means your administrator creating an account there and closing the old one.

For British Columbia residents

• Helix is based in British Columbia, and its Personal Information Protection Act applies to how we handle your personal information. The person responsible for our compliance with it is our privacy officer (below).
• We tell you why we collect personal information before or when we collect it: in this policy, and in the product where it happens — the assistant says that chats are saved, and who may read them, before you ask anything.
• On request, we tell you what personal information we hold about you, how it has been used, and to whom it has been disclosed.
• You can withdraw your consent at any time, on reasonable notice, unless withdrawing would frustrate a legal obligation; we will tell you what withdrawing means for your account.

For Quebec residents

• The person in charge of the protection of personal information at Helix is Cohen Van Kalsbeek - CTO and Co-founder, reachable at the contact below.
• The sign-in cookie is a technology that identifies you (it keeps your session tied to your account). It cannot be deactivated because the service cannot function without it — see the Cookie Policy for exactly what it does.
• There are no privacy-affecting settings that default to sharing: the dashboard collects no optional personal information, and every configurable setting is a display preference.
• On the public demo site only, page-view counting is active by default. We chose a form of it that stores nothing on your device and hands us nothing that identifies you, so there is nothing held on your device to switch off — but you are entitled to know it is on rather than off: see the demo site. It is not present on the dashboard, so it never applies to an account holder’s use of the product.
• You have the rights of access, rectification, deletion, and data portability described above, and the right to withdraw consent.

Privacy officer

Questions, requests, and complaints about personal information go to: Cohen Van Kalsbeek - CTO and Co-founder, info@helixsensors.com, 1774 Billington Rd, Bowen Island, BC, Canada - V0N 1G2.

If something goes wrong

If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and report it to the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d’accès à l’information) as required by law, and we keep a record of every security incident.

The demo site

Our public demo (demo.helixsensors.com) signs every visitor into a single shared, read-only demonstration account automatically — the cookie it sets identifies that shared demo account, not you. We collect no personal information from demo visitors beyond ordinary server logs, and anything you submit through the feedback tool there.

The demo site is also the only place in the product where we measure traffic. It runs Vercel Web Analytics, which counts page views so we can tell whether the demo is worth maintaining. What it records is the page path, the referring site, and a country and device type derived from your request. Counting repeat visitors happens on Vercel’s side, not ours: they state that they derive a short-lived hash from the request instead of storing your IP address, and that it cannot be used to identify you or follow you between sites — their documentation is the authority on that, not this page. What reaches us is aggregate counts: never an IP address, never a list of visitors, and nothing we could tie to a Helix account.

None of this runs on the dashboard itself. The analytics script is loaded only when the site is running as the demo; on app.helixsensors.com no analytics code is served at all, so nothing about how you or your colleagues use the product is measured by a third party. If that ever changes we will say so here, and on the notice, before it ships.

Changes to this policy

We update this policy from time to time. Most updates take effect when we post them here, and the date at the top changes with them. That includes clarifications and corrections, and changes to optional features which you can decide whether to keep using.

Earlier versions of this policy are available on request.