Sub-processors
Last updated: 2 October 2026
Helix Technologies Limited uses the service providers below to run Helix. They process personal data on our behalf, only on our instructions and under contracts that require them to protect it. This page sits alongside our Privacy Policy, which explains what we collect and why.
We send each provider only what it needs for the task listed.
AI providers
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| OpenAI | AI models that interpret your requests and write responses, and search indexing for Helix memory | Your messages, relevant profile and preferences, booking context, and text from Helix memory | United States |
| Google (Gemini API) | AI models that understand your requests, write replies, plan trips, organise Helix memory and read receipts you upload | Your messages, relevant profile, preferences and memory, booking context, and receipt images | United States |
| ElevenLabs | Live voice calls: speech recognition, the Helix voice and the voice assistant | Your voice audio during a call, call transcripts, and the context needed to answer you | United States |
| Perplexity | Web research for travel planning | Search questions generated from your request, such as destination, dates and interests | United States |
ElevenLabs uses its own AI model providers, including Google and OpenAI, to run voice conversations.
Hosting, data and infrastructure
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Render | Hosts our application servers, caching and the Helix memory store | All data processed by the Helix service | Frankfurt, Germany |
| Supabase | Main database, sign-in and file storage | Account details, conversations, preferences and memory, booking records, voice call transcripts, and files you upload | Frankfurt, Germany |
| Pydantic (Logfire) | Monitoring and error tracing | Technical logs and traces of AI requests, which can include message content. We filter out identity document numbers and access credentials. | EU |
| PostHog | Product analytics | Usage events, device and browser information, approximate location from IP address, and your account identifier | EU |
| Cloudflare | Bot protection on some sign-up and guest flows | IP address and browser signals | Global network |
Payments
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Stripe | Card payments, subscriptions and refunds | Name, email address, billing address, card details (entered directly with Stripe) and transaction records | United States and Ireland |
| Helix Intelligent Services Inc. | Payments and billing operations (a Helix group company) | Billing and transaction records | United States |
Communications
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Twilio | Phone number verification by SMS or WhatsApp | Phone number | United States |
| Novu | Sending booking confirmations, updates and other emails, in-app messages and push notifications | Name, email address, notification content and device push tokens | EU |
| Expo | Delivering push notifications to the Helix mobile app | Device push token and notification content | United States |
| Microsoft (Microsoft 365) | Business email, including the inbox for receipts you forward for expenses | Emails you send us and their attachments | United Kingdom |
Maps and places
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Mapbox | Maps in the Helix app | IP address, device information and the map areas you view | United States |
| Google Maps Platform | Finding places and restaurants, and locating destinations | Place and restaurant search text and locations. No account details. | United States |
Support and quality
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Anthropic | Investigating problems when you mark a response as unhelpful or our support team flags a conversation | The conversation linked to the report and any comment you add | United States |
Our website
| Provider | What they do for Helix | Personal data involved | Location |
|---|---|---|---|
| Replit | Hosting this website and handling form submissions | IP address, browser information, and information you submit through website forms | United States |
| Lettermint | Sending notifications and acknowledgements for website forms, including Black membership requests and partner enquiries | Names, email addresses and form submission details included in emails | Netherlands |
Booking partners
To make a booking, we pass your booking details to the companies that provide it. These partners are not our sub-processors: they use your details to deliver the booking under their own terms and privacy policies.
| Partner | What they do | Personal data involved | Location |
|---|---|---|---|
| Duffel | Flight search, booking, changes and cancellations | Traveller names, date of birth, contact details, passport details where the airline requires them, loyalty numbers, and seat and meal requests | United Kingdom |
| Sleap | Hotel search and booking | Guest names, contact details, stay dates and special requests | Switzerland |
| Airlines, hotels, restaurants and experience providers | Delivering the booking you asked for | What they need to fulfil it, such as names, contact details and dietary or accessibility requirements | Worldwide, depending on your booking |
International transfers
Our core production data is hosted in Frankfurt, Germany. Where a provider processes personal data outside Jersey, the UK or the EEA, we rely on Standard Contractual Clauses (with the UK Addendum where relevant) or another recognised transfer mechanism, such as the EU-US Data Privacy Framework where the provider is certified.
Changes to this list
We keep this list up to date and change the date above whenever we add or replace a provider. Business customers can ask to be notified of changes by emailing [email protected].
Questions about this page? Email [email protected].