Legal · version 1

Privacy

What we collect, why, who helps us handle it, how long we keep it, and how to see it, take it or delete it.

Last updated Thu 1 Oct 2026Applies to helio-app.com, app.helio-app.com and the Helio iOS app

How long we keep it
Applications we turn down12 months Open
Accounts and profileswhile you take part, then 12 months Open
Statements, ledger and invoices10 years Open
Signed agreementsOpen
Sign-in sessions30 days after they end Open
Hashed IP addresses30 days Open

Openmarks what a lawyer still writes or confirms. Each section gives our plain words first, then the legal wording the lawyer completes.

01Who is responsible

The company that runs Helio decides what happens to your data and answers for it. Its details are in the legal notice.

Legal wording

  1. 1.1

    Identity and contact details of the controller (GDPR, art. 13(1), point a). Open

  2. 1.2

    Contact for data protection questions, and whether a data protection officer is required (GDPR, art. 37). Open

02What we collect, and from whom

Only what each step needs. Visitors leave almost nothing; members leave what an agreement and a payout need.

Legal wording

  1. 2.1

    Categories of personal data and where they come from (GDPR, art. 13 and 14). Open

WhoWhat we collect
VisitorsPages seen, counted without cookies. A hashed IP address for 30 days, to stop abuse.
People who applyName, email, your trade or your skills, what you wrote in the application, the test task.
Experts and product buildersYour profile, notes and offers in Helio threads, agreements, statements, the tax number and address an agreement needs, payout details held by Stripe or Wise.
BuyersName, email, company and role, team size, the letters you sign. Card details stay with Stripe.

03Why, and on what basis

We use your data to run the platform you joined, to pay you, to send what you asked for, to keep the site safe and to keep the records the law requires. Each use needs a legal basis, which the lawyer sets in the legal wording.

Legal wording

  1. 3.1

    Membership and agreements: performance of a contract (GDPR, art. 6(1), point b). Open

  2. 3.2

    Accounting and tax records: legal obligation (GDPR, art. 6(1), point c). Open

  3. 3.3

    Security and abuse prevention: legitimate interest (GDPR, art. 6(1), point f). Open

  4. 3.4

    Optional emails and public earnings: consent (GDPR, art. 6(1), point a). Open

04Who helps us

Six companies process data for us, each for one job. Each one signs a data processing agreement with Helio; until it is signed, it is marked Open.

Legal wording

  1. 4.1

    Processors, transfers outside the EU and their safeguards (GDPR, art. 28 and 44 to 46). Open

CompanyWhat it doesWhereAgreement
CloudflareHosts the site and the app, stores data and files, checks forms for bots, counts visits without cookiesEU, for stored dataOpen
ScalewaySends emailsOpenOpen
SentryError reports, without personal dataEUOpen
StripeBuyers’ payments, payouts to experts and product buildersOpenOpen
SkribbleQualified electronic signatures on agreementsOpenOpen
WisePayouts to people who live in UkraineOpenOpen

05What is public

Your public profile: your photo, name, trade or skills, city and the one line you wrote. Open statements show each product’s total paid to people; a split by person appears only when both people agree.

Contact details are never public. Before an agreement they are hidden in notes, and the sender is told why.

Legal wording

  1. 5.1

    Publication of profiles and earnings, and how to withdraw consent. Open

06How long we keep it

The card at the top lists each kind of data and how long it stays. After that it is deleted, or kept only in a form that no longer points to you.

Statements and invoices stay for as long as accounting law requires, even after you leave.

Legal wording

  1. 6.1

    Retention periods and their legal basis; the accounting period confirmed with the accountant. Open

07How we protect it

Data and files are stored in the EU. Logs never hold emails, sign-in links, tax numbers, bank details or what you write in notes. The record of who did what uses IDs, not names.

There are no passwords: you sign in with a link valid 15 minutes, once, or with Google or Apple.

Legal wording

  1. 7.1

    Technical and organisational measures (GDPR, art. 32); notice of a personal data breach (GDPR, art. 33 and 34). Open

08Your rights

You can ask to see your data, correct it, take a copy, limit or object to its use, or delete it. Write to the contact in the legal notice.

You can also complain to the CNPD, Portugal’s data protection authority, at cnpd.pt.

Legal wording

  1. 8.1

    Rights of access, rectification, erasure, restriction, portability and objection, with response times (GDPR, art. 15 to 21). Open

  2. 8.2

    Supervisory authority: Comissão Nacional de Proteção de Dados. Open

09Cookies

A cookie keeps you signed in. Visits are counted without cookies. Public forms use a bot check by Cloudflare. Fonts come from our own server, not from a font service.

Legal wording

  1. 9.1

    List of cookies and similar technologies, and whether consent is needed (Lei 41/2004, art. 5). Open

10Changes

When this notice changes, the version and the date at the top change. Every consent you give is stored with the version you saw.

Legal wording

  1. 10.1

    How changes are announced, and when consent is asked again. Open