Privacy policy.
What this website collects, why, who else touches it, and how long we keep it — in the plainest language we can manage.
Draft pending legal review. This policy accurately describes what the helpzero.ai website does today, and it was written by reading the code that handles your submission. It has not yet been reviewed by a qualified lawyer. Before relying on it, have counsel confirm the identified controller and registered address, the governing-law and regulator references, and whether your customer base requires additional disclosures.
Last updated: 26 July 2026 · Applies to: helpzero.ai
1. Scope
This policy covers the helpzero.ai marketing website only — the pages you are reading now and the two forms on them (the demo request on /contact and the plan signup on /signup).
It does not cover the Helpzero product itself. When an organization deploys the Helpzero agent against its helpdesk, that processing is governed by the agreement and data processing addendum signed with that organization, not by this page. In that arrangement Helpzero acts as a processor for the customer; here, on the website, Helpzero is the controller.
2. Who is responsible
Helpzero is the controller for the data described here. Reach us at [email protected] for any privacy question, request, or complaint — it is a monitored mailbox, not an auto-responder.
Our registered legal entity name and address are to be inserted here before publication; see the draft notice above.
3. What we collect
Only two things reach us: what you type into a form, and a small amount of technical detail that arrives with any web request.
What you type
| Field | Where | Required |
|---|---|---|
| Full name | Both forms | Yes |
| Company | Both forms | Yes |
| Work email | Both forms | Yes |
| Phone / WhatsApp | Both forms | No |
| Company size | Both forms | No |
| Which describes you (SMB, MSP, on-prem, other) | Demo request | No |
| Free-text description of your ticket queue | Demo request | No |
| Your stack (Microsoft 365, Google, mixed, other) | Signup | No |
| Selected plan | Signup | Yes |
The free-text field is the one place you could volunteer more than we ask for. Please do not paste ticket contents, credentials, employee names, or anything else sensitive into it — a description of your queue is all we need, and we would rather not hold the rest.
What arrives automatically
| Data | Why | Kept |
|---|---|---|
| Country your request came from | Knowing which markets are asking | With the lead record |
| Browser user-agent string | Distinguishing real submissions from bots | With the lead record |
| Referring page | Which page prompted you to get in touch | With the lead record |
| Submission timestamp | Ordering and responding to enquiries | With the lead record |
| A salted hash of your IP address | Rate limiting, so the form cannot be flooded | Deleted within roughly 20 minutes |
Your IP address is not stored in readable form. It is hashed the moment it arrives, used only as an anonymous counter key, and the counter row is deleted shortly afterwards. Cloudflare, our infrastructure provider, separately sees your IP address as an unavoidable part of routing any internet request — see section 5.
4. What we deliberately do not do
- No cookies. This site sets none. There is no consent banner because there is nothing to consent to.
- No analytics. No Google Analytics, no product analytics, no session recording, no heatmaps.
- No advertising or tracking pixels. Nothing here reports back to an ad network.
- No profiling and no automated decision-making that produces legal or similarly significant effects.
- No selling or renting of your data, in any form, to anyone, ever.
One honest caveat: the site loads its typefaces from Google Fonts. Requesting a font file discloses your IP address and user-agent to Google, exactly as visiting any page that uses Google Fonts does. No cookie is set by that request. If you would prefer that not to happen, a browser extension that blocks third-party font requests will stop it, and the site remains fully readable in fallback fonts.
5. Who else processes your data
| Processor | Role | Where |
|---|---|---|
| Cloudflare | Hosting, CDN, and the D1 database holding lead records | Global edge network |
| Microsoft (Microsoft 365 / Graph) | Delivers the notification email and hosts the mailbox that receives it | Per our Microsoft 365 tenant region |
| Google Fonts | Serves typefaces; receives IP and user-agent only | Global |
That is the complete list. There is no CRM, no marketing automation platform, and no lead-enrichment service in this pipeline. When you submit a form, the record is written to Cloudflare D1 and an email is sent to our own mailbox — nothing else happens.
6. Why we are allowed to hold it (legal bases)
Where the UK/EU GDPR applies:
- Legitimate interests (Article 6(1)(f)) for responding to a business enquiry you initiated, and for the rate limiting that keeps the form usable. You asked us to get in touch; replying is the obvious expectation.
- Steps prior to entering a contract (Article 6(1)(b)) for signup requests, where you are asking us to start a commercial relationship.
We do not rely on consent for any of this, which is also why there is no cookie banner. If you are in a jurisdiction with a different framework — including the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection — the practical position is the same: you gave us business contact details so that we would reply to you, and we use them for that.
7. How long we keep it
- Rate-limiting counters: deleted within roughly 20 minutes.
- Lead and signup records: kept for 24 months from your last contact with us, then deleted. If the enquiry becomes a customer relationship, the records move under that contract's retention terms instead.
- Notification emails in our mailbox follow our internal mail retention, which is also 24 months.
Ask us to delete your record sooner and we will, without argument — see section 9.
8. International transfers
Cloudflare and Microsoft both operate global infrastructure, so your data may be processed outside your country. Both provide Standard Contractual Clauses and equivalent transfer mechanisms for this purpose, and we rely on those. If you need the specifics for a vendor review, email us and we will send them.
9. Your rights
Depending on where you live, you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything inaccurate;
- delete it;
- restrict or object to how we use it;
- hand it to you, or to someone else, in a portable format.
Email [email protected]. We will respond within 30 days. There is no charge, and we will not ask you why. Because we hold so little, most of these requests take us minutes.
If you think we have handled your data badly, please tell us first — but you are also entitled to complain to your data protection authority, and we would rather you did that than stayed unhappy.
10. Security
The site is HTTPS-only with HSTS, a strict Content Security Policy, and no third-party scripts of any kind. Lead records live in a Cloudflare D1 database reachable only by our own server-side code. The internal leads console is password-protected, rate-limited against brute force, and excluded from search engines. Access to the receiving mailbox is limited to the people who need to answer you.
No system is perfect. If you find a vulnerability in this site, please report it to [email protected] — we will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.
11. Children
This is a business-to-business site. It is not directed at anyone under 16, and we do not knowingly collect their data. If a child has submitted a form, email us and we will delete the record.
12. Changes
If we change this policy we will update the date at the top. For anything that materially changes what we collect or who we share it with, we will say so plainly rather than quietly editing the text.
13. Contact
Privacy questions, access requests, deletion requests, or complaints: [email protected].