Privacy policy for controlled business document workflows.

Hosting in France and optional external AI review

Helvabase is operated by Starbox Group GmbH, a Swiss company. The application and its primary databases are hosted by OVHcloud in Roubaix, France. Primary Vaultbrix database backups are stored separately at Exoscale in Geneva, Switzerland. Additional database backups use Cloudflare R2; we do not claim Swiss-only residency for those copies. When advisory review is requested, selected source excerpts, draft sentences and requirements with response text are sent directly to Mistral AI by default, without a separate workspace activation or consent step. A workspace administrator can disable Mistral review. Jev through OpenRouter and TypeSafe AI remains an explicit alternative requiring its own workspace agreement. Mistral states EU hosting by default, with possible feature-dependent transfers outside the EU. This optional review does not guarantee Swiss-only or EU-only processing. Mistral review is available by default and can be disabled for future requests; it does not run on every document automatically. Existing customer agreements still apply. Your chosen AI client also has its own processing terms. Automated checks never replace human validation.

Data and processing

Who this policy covers

This policy explains how Helvabase handles personal data and customer content when someone visits the public site, creates an account, joins a workspace, asks for a pilot, uploads or references business sources, or uses the product to prepare response dossiers. If a customer has a signed order form, data processing agreement, or other written agreement with Helvabase, that agreement controls where it conflicts with this public policy.

Data we process

Account and contact data: name, business email, authentication provider, workspace membership, role, invitations, support messages, and pilot requests. Workspace and project data: organization names, project names, source inventory metadata, review states, output requests, approval notes, and assistant connection settings. Customer content: documents, links, questionnaires, RFP material, templates, source excerpts, generated drafts, and other files or text that users submit or ask Helvabase to process. Operational data: device, browser, IP address, request logs, security events, error traces, delivery logs for transactional email, billing events, and similar technical records.

How we use data

We use data to provide and secure the service, authenticate users, manage workspaces, process source review workflows, create response dossiers and agent context packs, provide support, handle billing, improve reliability, and comply with legal obligations. Helvabase is designed to keep business context controlled. The product should surface source status, caveats, missing proof, and human review states before generated content is reused or exported.

Processors and service providers

Helvabase may use Snipara for context, indexing, retrieval, memory, MCP access, and source health. It may also use infrastructure, database, email, authentication, billing, logging, and security providers to operate the service. These providers process data only as needed for the service relationship, security, compliance, support, and payment operations. Production secrets and service-account keys are handled server-side and are not exposed in public pages.

Cookies and authentication

The service uses essential cookies and similar storage for authentication, sessions, security, and product operation. Helvabase does not need advertising cookies to provide the core business workflow. Helvabase uses Umami for privacy-focused public site analytics, such as page views and referrers, to understand whether public pages are useful. Helvabase does not use advertising cookies for the core business workflow.

Retention and deletion

Helvabase keeps account, workspace, project, customer content, billing, and operational data for as long as needed to provide the service, meet contractual obligations, protect security, resolve disputes, and satisfy legal requirements. Customers can request deletion or export of workspace data through their account owner or by contacting support. Some records may be retained where required for security, billing, audit, legal, or backup integrity.

Your rights

Depending on where you are located and how the service is used, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data. You may also have the right to lodge a complaint with a data protection authority. For workspace content, Helvabase may act as a processor for the customer organization. In that case, requests about workspace content may need to be handled through the customer organization that controls the workspace.

Contact

For privacy questions, data requests, or security concerns, contact support@helvabase.com. Include the workspace, account email, and request type so the team can route it correctly.