Helix Privacy Policy

Effective date: 19 December 2025
Last updated: 19 December 2025

1. Key Facts – The quick read

Important: Helix's AI memory is integral to providing you with hyper personalisation. You can delete individual messages, clear your whole conversation history and even delete everything we have inferred from your messages. However, doing so will impact Helix's ability to provide the best service.

We never sell your data. We share only the minimum details with trusted travel providers. All information is encrypted in transit and at rest.

2. Who we are

Helix Technologies Limited ("Helix Tech", "Helix", "we", "us", "our") operates HELIX, the AI concierge for travel, hotels, restaurants, and experiences. Helix Tech is registered in Jersey, Channel Islands (company no. 158737).

• Registered office: 30 Stopford Road, St Helier, JE2 4LZ
• Contact: [email protected]

Helix Tech is the primary data controller for personal data processed via the Services.

Helix Intelligent Services Inc. ("Helix Inc") is a wholly-owned Delaware subsidiary that supports payments and billing. Depending on context, Helix Inc may act as:

• a processor for Helix Tech (processing payment-related data on Helix Tech's instructions), and/or
• a separate controller for certain payment, fraud-prevention, tax, and regulatory compliance activities connected to taking payments.

3. The data we collect

We collect personal data that you provide, that is generated through your use of the Services, and that we receive from booking and payment partners.

Identification and contact

• Full name, email address, phone number, postal address (where needed)

Travel documentation and booking details

• Passport or ID number, visa information, date of birth, citizenship, travel itineraries, booking references
• Loyalty programme details (where provided)

Booking preferences

• Seat and accessibility preferences
• Meal preferences and dietary requirements expressed as fulfilment instructions (for example "strict gluten-free", "no nuts", "dairy-free")

Payments

• Billing details and transaction information (for example payment status, refunds, chargebacks, transaction IDs)
• Card payments are processed by our payment providers. We do not store full card numbers.

Interaction data and HELIX memory

• Chat transcripts, support requests, in-app actions, and preferences you set
• Preferences inferred from your use of the Services (for example preferred airlines, hotel styles, cuisines, budget ranges)

Technical data

• IP address, device and browser/app information, logs, diagnostic data, and analytics events

4. Mobile app-specific data

When you use our iOS or Android apps, we may also collect:

• Device identifiers (such as advertising ID or platform identifiers, where available and permitted)
• App instance identifiers and crash/performance diagnostics
• Push notification tokens (to deliver notifications to your device)
• App settings and feature usage events

Permissions: If you enable optional permissions (for example notifications, location), the app may process the related data. You can control permissions in your device settings.

5. Information about other people (travellers and guests)

You may provide information about other people, such as travel companions, hotel guests, or restaurant reservation guests (for example names, dates of birth, passport details, or dietary requirements).

You confirm that you have permission to provide this information for booking and fulfilment purposes. We use third-party traveller and guest data only to:

• search, reserve, and book requested services
• manage changes and provide support
• meet legal, accounting, and compliance obligations

6. Special category data

We ask you to provide requirements (for example "strict gluten-free") rather than medical diagnoses. If you choose to provide medical details, or if the information reveals health conditions, we will treat it as special category data and apply additional safeguards. Where possible, we will apply data minimisation and record only the relevant information for the purpose of providing you with

Our approach

• We only ask for and use special category data when it is necessary to fulfil your request (eg, ensuring an airline meal or restaurant booking accommodates an allergy).
• Where required, we will seek explicit consent in-product at the time you provide such information.
• You can remove or update these details at any time.

7. How we use your information

We use personal data to:

• Arrange travel, hotel stays, restaurant reservations, and experiences on your behalf
• Send service communications (confirmations, itinerary updates, changes, receipts, and security notices)
• Provide concierge support and resolve issues
• Store preferences and HELIX memory to personalise recommendations and speed up future bookings
• Process payments, refunds, and chargebacks
• Prevent fraud and misuse, and keep the Services secure
• Improve the Services (performance, analytics, debugging)
• Send marketing communications where permitted and in line with your preferences

8. Legal Bases (UK GDPR / GDPR where applicable, and Data Protection (Jersey) Law 2018)

Where applicable, we process personal data under one or more of these legal bases:

• Contract: necessary to provide the Services, including booking fulfilment and support
• Legitimate interests: to operate, secure, and improve the Services, prevent fraud, and maintain quality (balanced against your rights)
• Consent: where required (for example certain marketing communications, and special category data where applicable)
• Legal obligation: to comply with legal, tax, accounting, sanctions, or regulatory requirements

9. Service messages and marketing

Service messages

We send essential communications such as booking confirmations, itinerary updates, receipts, customer support messages, and security notices. These are required to provide the Services.

Marketing

Marketing emails (such as product updates, offers, or re-engagement messages) will include an unsubscribe option and can also be managed in-app where available. If you opt out, we will still send essential service messages.

10. Sharing and processors

We share only the minimum information needed to provide the Services.

Booking and fulfilment partners and suppliers

We share relevant data with partners and suppliers to search, reserve, and book on your behalf, including:

• Airlines, hotels, restaurants, experience operators, and their intermediaries as required to fulfil bookings

Payments and billing

• Helix Intelligent Services Inc. (payments and billing operations)
• Payment providers such as Stripe and related fraud-prevention partners

Infrastructure and communications

• Hosting and database providers, monitoring and logging providers, customer support tools
• Email and messaging providers for sending service communications

Professional advisors and legal

• Accountants, auditors, insurers, legal advisors
• Regulators, courts, or law enforcement where required by law

11. Where we store data and international transfers

We host core production data in Frankfurt, Germany (EU). Some partners may process personal data outside Jersey, the UK, or the EEA. Where international transfers apply, we use appropriate safeguards such as Standard Contractual Clauses or other recognised transfer mechanisms.

12. Data security

We use technical and organisational measures designed to protect personal data, including access controls, multi-factor authentication for internal access, row level security, and encryption for sensitive data where appropriate. No system is completely secure, but we work to protect your data and reduce risk.

13. Retention

We keep personal data only as long as necessary for the purposes described above, then delete or anonymise it unless we must retain it for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes.

Typical retention periods:

• Bookings and invoices: up to 6 years after your last booking, and up to 10 years where needed for accounting, audit, disputes, or regulatory requirements
• Payment and accounting records: up to 10 years
• Security and operational logs: typically 12 to 24 months unless needed for investigations
• Chat history: typically up to 24 months after last activity
• Inferred preferences: you can delete both explicit and inferred preferences; we do not retain them longer than necessary and they are not required to keep your account open

14. Your rights

Depending on your location and applicable law, you may have rights to access, rectify, erase, restrict, object, or port your data, and to withdraw consent where we rely on consent.

You can contact us at [email protected]; we aim to answer within one month.

15. Cookies & similar technologies

We use essential cookies to keep you signed in and secure. Where we use analytics cookies, they are optional and managed through your preferences where required.

16. Automated decisions

HELIX's uses AI to propose itineraries and recommendations. Bookings will not be made without your explicit confirmation.

17. Changes to this Policy

We may update this Policy from time to time. We will post updates on our website and update the effective date above. Where changes are material, we will provide additional notice.

Last updated: 19 December 2025