Privacy policy

About this privacy policy

Helping (Helping (helping.app), and referred to here as Helping, we, or us) is a messaging-based accountability platform used by coaches to send automated check-ins to their clients. This privacy policy explains what personal data we handle, why we use it, and the choices available to you.

It applies to two groups of people:

• Coaches who hold a Helping account — our customers. For the personal data of coaches (such as account and billing details), Helping acts as the data controller.
• Clients of coaches — the people a coach adds to Helping so that they can be messaged. Clients do not create a Helping account and are not our customers. For the personal data of clients that a coach causes us to process, the coach is the data controller and Helping is the data processor. We process that data only on the coach's instructions to deliver the service. See our data processing agreement.

What personal data we handle

Coach data

To set up and run your account, we handle:

• your name and email address;
• authentication data, such as the credentials used to sign in;
• billing information, which is handled by our payment provider, Stripe (we do not store your full card number);
• usage data, such as when you sign in and how you use the dashboard, used to operate, secure, and improve the service.

Client data (handled on behalf of the coach)

To send check-ins on a coach's instructions, we handle, on the coach's behalf:

• a client's name or identifier;
• phone number (used for SMS) — these are protected with field-level encryption for phone numbers;
• Telegram handle or identifier;
• check-in messages and the client's replies;
• response rate, streak, and engagement data;
• timezone, so check-ins land at the right local time.

What we do not collect from clients

Clients never create an account, never sign in, and never provide payment data to us. The only piece of the web a client ever sees is an optional, read-only progress link a coach chooses to share, which expires within 24 hours.

Why we use it (lawful bases)

We rely on the following lawful bases, depending on the data:

• Performance of a contract — to provide the service to the coach under our agreement with them.
• Legitimate interests — to operate, secure, and improve the service, including aggregated product analytics and fraud prevention, balanced against your rights.
• Legal obligation — where we are required to keep records or respond to lawful requests.

For clients: their personal data is processed as the coach's processor, on the coach's instructions and under the coach's own lawful basis for contacting them. We do not decide to message a client — the coach does. It is the coach's responsibility to have a lawful basis (including any required consent) to contact each client.

Who is responsible for client data

The coach is the data controller for their clients' personal data. They decide which clients to add, what to ask, when to message, and on which channel, and they are responsible for collecting and using that data lawfully, including any required consent and opt-out handling.

Helping is the data processor for that client data. We process it only to deliver the service on the coach's instructions, as set out in our data processing agreement and our terms of service.

Sharing & subprocessors

We share personal data only with the third parties needed to run the service, and only as necessary. Our current subprocessors are:

• Twilio (and Telnyx, where applicable) — SMS delivery for check-ins and replies.
• Telegram Messenger Inc. — Telegram message delivery for check-ins and replies.
• Stripe — Payment processing and billing.
• Self-hosted infrastructure — Hosting and storage of account and client data, on infrastructure the business controls (not a shared public cloud).
• Glitchtip (or a Sentry-compatible service) — Error monitoring and application diagnostics.

Each subprocessor is bound by written terms that require appropriate confidentiality and security. We do not sell personal data, and we do not use it for the subprocessors' own marketing.

International transfers

Because our subprocessors operate globally, personal data may be processed outside the country in which it was collected — for example, when a message is routed by a carrier or platform. Where this happens, we put appropriate safeguards in place, as described in our data processing agreement.

Retention

We keep personal data only for as long as we need it. In broad terms:

• Coach data is retained while your account is active, and for a short period after closure so we can complete export, fulfil legal obligations, and handle cancellation, after which it is deleted.
• Client data is retained while the coach keeps the client in Helping. When a coach removes a client, the data is kept for 30 days and then anonymised.

Security

We are self-hosted on infrastructure the business controls, not a shared public cloud. Data is protected with encryption in transit (TLS) and encryption at rest, phone numbers benefit from field-level encryption for phone numbers, and access to data is restricted to authorised personnel on a least-privilege basis. No system can be guaranteed secure, and we do not make absolute promises, but we design the service with security and privacy in mind from the start.

Your rights

Depending on where you live and your role, you may have the right to ask us to:

• access the personal data we hold about you;
• rectify (correct) inaccurate data;
• erase your personal data (the “right to be forgotten”);
• restrict how we process your data;
• receive a copy of your data in a portable format (data portability);
• object to certain processing; and
• withdraw consent, where we rely on it.

You also have the right to complain to your data protection regulator. For coaches, these rights apply to your account data. For a coach's clients, the coach is the controller, so clients usually exercise these rights through their coach; a client may also contact us directly and we will cooperate with the coach as the controller. See our plain-English rights page for more.

Cookies

Our marketing site uses only essential cookies needed to function. We do not use advertising or cross-site tracking cookies.

Children

Helping is not directed at anyone under 18, and coaches must only add clients who are adults, or for whom they hold appropriate authority to act.

Changes & contact

We may update this policy from time to time. When we do, we will revise the “last updated” date above and, for material changes, give reasonable notice. Continued use of Helping after a change takes effect indicates acceptance of the updated policy.

Questions about this document? Email hello@helping.app.