HelenAI Privacy Policy

Last updated: September 21, 2026

This Privacy Policy explains how HelenNow LLC ("HelenAI," "we," "us," or "our") collects, receives, uses, discloses, and retains information when you use the HelenAI ChatGPT app and its remote MCP services (the "Service").

1. Information we collect

We collect only information needed to authenticate an authorized user, enforce tenant access, answer a requested question, maintain security, and operate the Service.

• Account and authorization information: identity and access claims supplied by the configured sign-in provider, such as a user identifier, account name or email address when provided, tenant information, and group or authorization claims. We use these values to authenticate the requesting user and determine which private workspaces the user may access.
• Request information: the specific question, filters, selections, and other parameters that you or ChatGPT explicitly send to the Service. We do not request or reconstruct your full ChatGPT conversation.
• Operational workspace information: information available through the organizational systems used by the Service. HelenAI processes this information to answer questions submitted through ChatGPT. Results may include operational requests, locations, workforce-user records, sources, commands, categories, and related analytics fields. The exact fields depend on the connected systems and the question asked.
• Security and audit information: records needed to authenticate requests, audit access, troubleshoot failures, and protect the Service. These records may include account or tenant identifiers, the requested operation, timestamps, and error details.
• Privacy inquiries: information you provide when contacting us about a privacy request.

2. Information we do not request

Do not submit payment-card data, protected health information, government identification numbers, passwords, API keys, MFA or one-time codes, or other authentication secrets to the Service. The Service is not designed to collect or process those categories of information. If you believe restricted information was submitted, contact us promptly at mbdeir@helennow.com and do not include the restricted information in your message.

3. How we use information

• Authenticate users and apply organization- and tenant-level permissions.
• Retrieve and return only the workspace information needed to answer the requested question.
• Maintain security, prevent unauthorized access, detect abuse, and investigate incidents.
• Maintain audit records and troubleshoot service errors.
• Provide support, respond to requests, and communicate service or policy changes.
• Comply with applicable law and enforce our Terms of Service.

We do not sell personal information, use it for advertising, or engage in behavioral profiling. We do not use the Service to collect a full chat history; processing is limited to the explicit request and authorized resources provided for that request.

4. How we share information

We may disclose information to the following categories of recipients, only as needed for the purposes above:

• ChatGPT and OpenAI: when you use the app through ChatGPT, your request and the HelenAI response pass through ChatGPT/OpenAI so the requested information can be displayed. ChatGPT receives only the results returned by HelenAI for the requested tool call, not direct access to the underlying systems or access credentials.
• HelenAI service infrastructure: HelenNow operates the services needed to retrieve requested operational information and apply authentication and access permissions.
• Identity and access services: configured services may receive the sign-in claims needed to map the account and apply tenant and group-based access permissions.
• Cloud hosting and storage providers: service providers that host the application, store audit records, authenticate users, or protect the infrastructure under contractual confidentiality and security obligations.
• Professional advisers and authorities: when reasonably necessary to comply with law, respond to lawful requests, protect rights and safety, or investigate fraud, abuse, or security incidents.

We do not share workspace data with unrelated third parties for their own marketing purposes.

5. Retention

We retain information only for as long as necessary for the purposes described in this Policy, contractual requirements, security, dispute resolution, and legal obligations.

• Authentication and access records: there is currently no automatic deletion schedule. These records remain in the Azure audit tables until deleted by HelenNow LLC or the relevant customer or administrator, subject to legal, security, and backup requirements.
• Question and access audit records: there is currently no automatic deletion schedule. These records remain in the Azure audit tables until deleted by HelenNow LLC or the relevant customer or administrator, subject to legal, security, and backup requirements.
• Error and security records: there is currently no automatic deletion schedule. These records remain in the Azure audit tables until deleted by HelenNow LLC or the relevant customer or administrator, subject to legal, security, and backup requirements.
• Workspace results: generally returned for the request and not intentionally stored as a separate user profile by the Service, although request and error details may be included in audit records.
• Privacy inquiries: retained only for as long as reasonably necessary to respond, maintain an appropriate record of the inquiry, and meet legal obligations.
• Backups or replicas: if enabled for the Azure storage account, they follow the configured Azure Storage backup, recovery, and deletion settings.

Because the audit tables currently have no automatic expiration configured, users or customer administrators may request deletion by contacting mbdeir@helennow.com. Deletion may be subject to legal holds, security requirements, and backup or replica deletion cycles.

6. Your controls and rights

Depending on your location and relationship with the organization that provides access, you may be able to:

• Disconnect the Service from ChatGPT or your organization’s connected systems.
• Ask your organization’s administrator to change or revoke your access.
• Request access to, correction of, deletion of, or information about the personal data we hold about you.
• Object to or restrict certain processing, or withdraw consent where processing is based on consent.
• Submit a privacy complaint to us or to the applicable data-protection authority.

To exercise a request, contact mbdeir@helennow.com. We may need to verify your identity and coordinate with your organization because access to workspace data is controlled by the organization that authorized the connection. We will respond within the period required by applicable law.

7. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information, including authentication, authorization checks, access auditing, and protected cloud infrastructure. No service can guarantee absolute security.

8. International processing

The Service and its providers may process information in countries other than the country where you live. Where required, we use legally recognized safeguards for cross-border transfers. The exact processing location may depend on the Azure region and identity or connected-service configuration used by your organization.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

10. Changes to this Policy

We may update this Policy from time to time. We will post the revised version at this URL and update the “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice where required.

11. Contact

Privacy contact: mbdeir@helennow.com
Provider: HelenNow LLC