Privacy policy

The data controller is:

• Helia S.r.l.
• Registered office: Via Galliera 32, 40121 Bologna (BO), Italy
• VAT / Tax code: 04352381208
• Email: administration@helia-voice.com

Helia S.r.l. is the controller of your account data (who you are, how you sign in, the plan you use). For the content of the mailbox you connect and the documents you upload, Helia acts as a processor on behalf of the customer business, which remains the controller: the rules of that relationship are in the Terms of service.

• Account: first and last name, email, company name, language, password (stored only as a hash) or the link to the Google or Microsoft account you sign in with.
• Connected mailbox: inbox and sent email, with subject, sender and recipients, body, headers, dates and attachments; the mailbox address and the access tokens issued by Google or Microsoft.
• Content you create in Helia: documents, imported web pages, FAQs, processes, filter and forwarding rules, drafts and replies.
• AI results: the estimated summary, category and tone of each conversation, proposed drafts and their confidence.
• Payments: plan, subscription status and Stripe customer id. Card details are handled by Stripe; Helia never sees them.
• Technical data: IP address, browser, security and operational logs.

The email you receive also contains data about other people (your customers and suppliers). We process it only on your behalf and only for the service you turned on.

• To provide the service: read incoming email, classify it, prepare drafts, send the replies you approve (or, if you turn it on, the confident ones automatically) and show you the history. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• To run your account, subscription and support, including emails about your plan usage. Legal basis: performance of the contract (Art. 6(1)(b)).
• Security and abuse prevention, through technical logs. Legal basis: legitimate interest (Art. 6(1)(f)).
• Legal obligations, such as tax and accounting. Legal basis: legal obligation (Art. 6(1)(c)).
• Internal statistics on product usage (sign-ups, activations, plans), without reading email content. Legal basis: legitimate interest (Art. 6(1)(f)).

We do not use your data for advertising, we do not sell it and we do not profile your contacts.

Helia Inbox asks Google for two separate permissions.

Helia does not change labels, mark email as read or delete your email.

Helia Inbox's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

• we use Gmail data only to provide and improve the user-facing features of Helia Inbox;
• we transfer it to third parties only as needed for those features (the providers listed under sub-processors), for security, to comply with the law, or as part of a merger or acquisition with the same protections;
• we do not use it for advertising or to determine creditworthiness, and we do not sell it;
• we do not use it to train generalized artificial intelligence models, ours or anyone else's. The model providers we use process email only to produce the reply and are contractually barred from training their models on it;
• no person reads your email unless you ask us to for specific messages (for example in support), for security purposes such as investigating abuse, to comply with the law, or as aggregated and anonymized data for internal operations.

You can revoke access at any time: disconnect the mailbox in Helia Inbox, delete your account, or go to myaccount.google.com/permissions. When you disconnect the mailbox or delete your account, Helia also revokes its access with Google.

For Microsoft mailboxes Helia asks for Mail.ReadWrite, Mail.Send, User.Read and offline_access, for the same features described above: reading mail, managing its own drafts and sending replies. The same commitments on use, sharing and training apply. Microsoft does not let an app revoke its own permission: after disconnecting the mailbox you can remove it from the "My apps" page of your Microsoft account.

Unfiltered email, the relevant documents and your instructions are processed by language models to classify the conversation and write the draft. The models run on Amazon Bedrock in European Union regions. To monitor quality and costs we log the model calls, including the processed text, in the monitoring tool listed under sub-processors. These logs are deleted with the conversation or the account.

Drafts are suggestions: you decide whether to send them. If you turn on auto-send, Helia sends on its own only the replies it is highly confident about.

We use providers that process data on our behalf as processors (Art. 28 GDPR). The up-to-date list, with purpose and location, is on the sub-processors page. We disclose data to authorities only when the law requires it.

Google and Microsoft are not our sub-processors: they provide your mailbox, and you have a direct relationship with them.

Databases, files and AI models are hosted in the European Union. Some providers (for example for hosting the web interface and for payments) may process data outside the European Economic Area: those transfers are covered by the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

• Email and conversations: until you delete them, disconnect Helia Inbox or delete your account. In the settings you can have conversations deleted automatically once they have been quiet for 30, 90 or 180 days or a year.
• Documents: until you delete them or your account.
• Account: until you delete it.
• Billing records: for as long as Italian tax law requires (10 years).
• Technical logs: for a limited period, then deleted.
• Backups: overwritten in their normal rotation cycle.

When you delete your account we delete email, attachments, documents (including the search index), model call logs and access tokens, and we revoke our access with Google. We keep only anonymous statistics, without email address or company name, and the data the law requires us to keep.

• A conversation: delete it in the app.
• The mailbox: disconnect it in the settings; Helia stops reading it and revokes its access with Google.
• Everything: in Helia Inbox open the account menu and choose Delete account. If you use the same account in Helia Voice too, you can remove only Helia Inbox or delete everything.
• If you cannot sign in: write to administration@helia-voice.com from the account's address and we delete the data within 30 days.

Data travels encrypted (TLS) and is stored on Amazon Web Services infrastructure in the European Union. Google and Microsoft access tokens are encrypted in the database. Our engineers' access to the systems is limited to those who need it to run the service.

This website uses no profiling cookies and no analytics. The Helia Inbox app stores in your browser (localStorage) only the session token and your preferences, such as language and theme. Google's and Microsoft's sign-in pages apply their own cookie policies.

You can request access, rectification, erasure, restriction, portability and object to processing (Art. 15-22 GDPR) by writing to administration@helia-voice.com. We answer within one month. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

If you are a customer or supplier of a business that uses Helia Inbox, please contact that business first: it is the controller of its email data, and we will help it answer you.

Helia Inbox is a service for businesses and professionals and is not intended for anyone under 18.

If we change this policy materially we will tell you by email or in the app before the changes apply. Last updated: 13 October 2026.