HeliosDB Privacy Notice

Change log

1. Who we are

1.1 This notice explains how Dimen Sigon OÜ ("HeliosDB", "we", "us") uses personal data. Dimen Sigon OÜ is a private limited company registered in Estonia under registry code 16757774, with its registered address at Ahtri 12, 10151 Tallinn, Estonia. It trades as HeliosDB.

1.2 For the processing described in this notice we are the controller under Regulation (EU) 2016/679 (the "GDPR") and the Estonian Personal Data Protection Act, except where section 3 says that we act as a processor.

1.3 Contact for anything in this notice: support@heliosdb.com, with "Privacy" in the subject line. Security problems and suspected personal-data breaches can also be reported at any time to security@heliosdb.com. We have not appointed a data protection officer; the address above reaches the people responsible for data protection.

2. Services this notice covers

2.1 This notice covers:

• the website www.heliosdb.com, including its contact, partner and investor forms and the AI Support assistant on it;
• the documentation site docs.heliosdb.com;
• HeliosDB Cloud, including the console at cloud.heliosdb.com and the API at api.heliosdb.com (the "Cloud Service");
• the HeliosDB Partner Portal at partners.heliosdb.com (the "Portal");
• the HeliosDB AI Support service, wherever it is offered;
• e-mail correspondence with our e-mail addresses (for example support@heliosdb.com).

2.2 It does not cover third-party sites and services we link to, such as GitHub, Discord or package registries. Their own privacy notices apply.

3. When we are a processor instead

3.1 When a Cloud customer stores data in its databases on the Cloud Service ("Customer Content"), the customer decides why and how that data is processed. The customer is the controller and we are its processor. We process Customer Content only on the customer's instructions, under the HeliosDB Data Processing Agreement. If your personal data is held in a Cloud customer's database, please contact that customer; we will pass on any request we receive to them.

3.2 The same applies when a customer or partner gives us access to personal data so that we can provide support, diagnose a problem or provide escalation support for its own customers.

4. What we collect, why, and on what legal basis

4.1 Web server logs (all our sites). When you visit any of our sites, our reverse proxy records your IP address, the time, the requested address, the response and your browser's user-agent string. We use these logs to keep the services secure, to stop abuse and to fix faults. Legal basis: our legitimate interest in operating secure services (GDPR Article 6(1)(f)).

4.2 Cookies and fonts. Our websites, the Cloud console and the Portal do not use analytics or advertising cookies, and we do not use Google Analytics. They use the cookies the services you use need, such as the sign-in session of the Portal and the Cloud console and an anti-abuse timer on the SQL playground. When you arrive at www.heliosdb.com through a partner's referral link, the site also stores that partner's referral code in a cookie (hdb_ref, kept for 90 days) so that a HeliosDB Cloud sign-up from your browser can be attributed to the partner (section 4.8). Their pages load fonts from Google Fonts: when your browser loads them it sends your IP address and browser details to Google, which sets no cookie for them. Legal basis: our legitimate interest in showing our pages as designed (Article 6(1)(f)). We intend to serve these fonts ourselves and will update this notice when we do.

4.3 Contact form. When you use the contact form on www.heliosdb.com we collect your name, e-mail address, company, subject and message, and your IP address. We use them to answer you and to protect the form from abuse:

• a proof-of-work check runs in your browser; it is served by us and involves no third party;
• your IP address and e-mail address are used to limit how many messages one sender can submit in a period;
• an automated classifier reads the submission to decide whether it is unsolicited advertising or other spam. It normally runs on equipment operated by HeliosDB. When that equipment is unavailable, the submission may be sent to the remote model provider described in section 6.2. A message classified as spam is held in quarantine instead of being delivered; a person reviews a weekly summary of quarantined messages and can release any of them. If the classifier is unavailable, the message is delivered without the check.

Legal basis: our legitimate interest in answering enquiries and keeping the form free of abuse (Article 6(1)(f)) and, where you ask about our products, steps you request before a contract (Article 6(1)(b)).

4.4 Partner, programme and investor applications. When you apply to the partner programme, the community programme or for investor data-room access, on www.heliosdb.com or in the Portal, we collect the details in the form: names, e-mail address, company or public name, website, country, the contract details you provide (address, registration number, tax details and signatory authority), GitHub login and links for community applicants, investor profile answers for investors, and your message. We also record a shortened IP address (the last part removed) with the application. We use this to assess the application, to prepare and send the agreements that follow and to contact you. Legal basis: steps you request before a contract and performance of that contract (Article 6(1)(b)).

4.5 Portal accounts. For each Portal user we keep the name, e-mail address, organisation, role, membership status, password hash (if you set a password), two-factor authentication settings and the time of the last sign-in. Legal basis: performance of the programme agreement (Article 6(1)(b)) and our legitimate interest in securing accounts (Article 6(1)(f)).

4.6 Agreements and electronic signatures. When an agreement is signed in the Portal we keep the agreement, the names, e-mail addresses and capacities of signatories, signature evidence (time, IP address, user-agent string, the signature as typed, drawn or uploaded, and the method used), the sealed PDF and its certificate. To prove when a document existed, we send a cryptographic hash of the sealed document to an external timestamp service (freetsa.org); the hash reveals no personal data. Legal basis: performance of the agreement (Article 6(1)(b)), our legal obligations (Article 6(1)(c)) and our legitimate interest in being able to prove what was agreed (Article 6(1)(f)).

4.7 Acceptance of legal documents. When you accept or acknowledge one of our legal documents, we record which document and version you accepted, its SHA-256 fingerprint, the time in UTC, your account or application, your e-mail address, a shortened IP address and your browser's user-agent string. Legal basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in proving what was accepted (Article 6(1)(f)).

4.8 Referral, commission and payout records. For referral partners we keep referral links, clicks on them (time, shortened IP address, a one-way hash of the browser's user-agent string, the referring page and the landing page), attributions of customers to partners, commission ledger entries, statements, disputes and payout details, including bank details and the tax information needed to pay you. Legal basis: performance of the programme agreement (Article 6(1)(b)) and our legal obligations under accounting and tax law (Article 6(1)(c)).

4.9 Deal registrations. When a partner registers a prospective customer, we receive business contact details of people at that customer (name, role, business e-mail address and the opportunity). We use them to decide the registration, to avoid conflicts between partners and our own sales, and to follow the opportunity. Legal basis: our legitimate interest in running the partner programme (Article 6(1)(f)). If we received your details this way and you want to know which partner gave them to us, ask us at the address in section 1.3.

4.10 Investor data room. For investors with data-room access we record which documents are opened or downloaded, the time spent on each, questions and answers, a shortened IP address, the approximate location (country, region and city) derived from the IP address using a database stored on our own servers, and the device class and browser family. Downloaded documents may carry a visible watermark identifying the recipient. Legal basis: our legitimate interest in protecting confidential material and in following investor interest (Article 6(1)(f)).

4.11 Community programme. For ambassadors and contributors we collect public data from GitHub through its API, such as the public profile, public repositories and public contributions to HeliosDB repositories, to verify contributions and to recognise contributors. Legal basis: our legitimate interest in running the community programme (Article 6(1)(f)).

4.12 Partner materials, decks and share links. When you generate co-branded materials in the Portal, the text you provide may be sent to the HeliosDB AI Support service described in section 4.14 to draft content. When someone opens a deck or document through a Portal share link, we record the time, the action (view, page or download), a shortened IP address, the approximate location derived from the full IP address before it is shortened (country, region and city, using a database stored on our own servers), a one-way hash of the user-agent string, the device class, the first browser language and the referring site, so that the partner who shared it can see how it was used. Legal basis: performance of the programme agreement (Article 6(1)(b)) and the partner's and our legitimate interest in knowing how shared material is used (Article 6(1)(f)).

4.13 Cloud Service accounts. For Cloud users we keep the name, business e-mail address, organisation, password hash, two-factor authentication secret (stored encrypted), API keys, usage and quota counters, sign-in and security events (including IP address and time) and billing status. If a payment is made, the payment is processed by Stripe; we receive the customer and subscription identifiers, status and amounts, never full card numbers. Legal basis: performance of the Cloud terms (Article 6(1)(b)), our legitimate interest in security and abuse prevention (Article 6(1)(f)) and our legal obligations under accounting law (Article 6(1)(c)).

4.14 AI Support. When you ask the AI Support assistant a question, the question and the product you selected are processed to retrieve documentation and generate an answer. The answer is generated by a language model:

• normally a model running on equipment operated by HeliosDB, reached over an encrypted private network;
• when that equipment is unavailable, a remote model provided by OpenAI (section 6.2), in which case your question is sent to that provider.

The service does not store the text of your question in its logs; it logs your IP address, the product, the length of the question and timings. Please do not include personal data, credentials or confidential information in questions. Legal basis: our legitimate interest in offering self-service product help (Article 6(1)(f)) and, for customers, performance of the contract (Article 6(1)(b)). AI Support answers are generated automatically and may be wrong; they are not decisions about you.

4.15 Support and other e-mail. When you write to support@heliosdb.com, partners@heliosdb.com, security@heliosdb.com or another of our e-mail addresses, we keep your message, your contact details and our replies. Support requests are triaged with the help of AI systems as described in the HeliosDB Support Policy; those systems run on equipment operated by HeliosDB or are provided by the service providers listed in section 6.2. Legal basis: performance of a contract (Article 6(1)(b)) or our legitimate interest in answering you (Article 6(1)(f)).

4.16 Search-engine notifications. When we publish or change a page, we notify search engines through the IndexNow protocol. These notifications contain only page addresses and no personal data.

4.17 Required data. Data marked as required in a form is needed to provide what you asked for. If you do not provide it we cannot process the application, create the account or provide the service. Otherwise, providing data is voluntary.

5. Automated decisions

5.1 We do not make decisions that produce legal effects for you, or similarly significant effects, based solely on automated processing. The spam classifier in section 4.3 only decides whether a message is delivered at once or held for human review, and a person can release any held message. Applications, registrations, payouts and account decisions are made by people.

6. Who receives your data

6.1 Our own staff and contractors who need the data for their tasks, under confidentiality duties.

6.2 Service providers acting for us:

6.3 Independent recipients, each responsible for its own processing:

• Stripe, for Cloud payments and the related fraud checks and records;
• banks and payment providers that execute payouts;
• the external timestamp service in section 4.6, which receives only document hashes;
• tax authorities, courts, regulators and law-enforcement bodies when the law requires it;
• our professional advisers (lawyers, accountants, auditors) under confidentiality duties;
• a buyer of, or successor to, all or part of our business, if the business is transferred, under the protections of this notice.

6.4 We do not sell personal data and do not share it for third-party advertising.

7. Where your data is processed and international transfers

7.1 Our websites, the Portal, the Cloud Service, our e-mail server and their databases run on a server we rent from OVH. We are confirming the data-centre location of that server: our records place it in Switzerland, while the provider's network registration points to Germany. Either location is in the European Economic Area or in a country the European Commission recognises as providing adequate protection (Switzerland). We will update this section once the location is confirmed.

7.2 Our AI model equipment and our backup storage are operated by HeliosDB in Switzerland.

7.3 OpenAI and Google may process data in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework we rely on the adequacy decision for that framework; otherwise we rely on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914). You can ask for a copy of the safeguards at the address in section 1.3.

8. How long we keep data

8.1 We keep personal data only for as long as needed for the purposes in section 4, as follows:

8.2 Data deleted from a live system can remain in backups until those backups expire under the cycle above. Backups are encrypted and are not used except to restore service.

8.3 We keep data longer only where the law requires it or where it is needed to establish, exercise or defend a legal claim, and only for that purpose.

9. Your rights

9.1 Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have data erased, where there is no longer a lawful reason to keep it;
• restrict processing in the cases the GDPR sets out;
• receive data you gave us in a structured, machine-readable format and have it sent to another controller, where processing is based on consent or contract and carried out by automated means;
• object at any time to processing based on our legitimate interests, on grounds relating to your situation, and to direct marketing at any time;
• withdraw consent at any time, without affecting processing before the withdrawal.

9.2 To exercise a right, write to the address in section 1.3. We may ask for information to confirm your identity. We answer within one month; where a request is complex we may extend this by up to two further months and will tell you why.

9.3 You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where the alleged infringement took place. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee. We would appreciate the chance to address your concern first.

10. Security

10.1 We protect personal data with measures appropriate to the risk, including: encryption in transit (TLS, with a post-quantum hybrid key exchange where the client supports it); encryption at rest of the Portal database, the contact queue and the Cloud control-plane database; encrypted backups with regular restore tests; two-factor authentication for staff accounts; a default-deny network firewall; and access limited to the people who need it. No system is completely secure; if a breach affects you, we will inform you where the law requires it.

11. Children

11.1 Our services are intended for businesses and professionals. They are not directed at children, and we do not knowingly collect data from anyone under 16.

12. Changes to this notice

12.1 We publish every version of this notice at the address at the top, with its version, effective date, change log and SHA-256 fingerprint, and keep earlier versions available there. If we make a material change, we will tell account holders by e-mail or in the Portal or Cloud console before it takes effect.

13. Contact

13.1 Dimen Sigon OÜ (HeliosDB), Ahtri 12, 10151 Tallinn, Estonia. E-mail: support@heliosdb.com (subject "Privacy"). Security and breach reports: security@heliosdb.com.