Updated October 8, 2026

Privacy policy

What Helm keeps, why, and what it never does with your data. Written to be read, not skimmed past.

The short version
  • 01Helm stores what it needs to run your agents: your account, their rules, your memory and skills, and a log of what they did.
  • 02Your Gmail, Drive and Calendar stay in Google. Helm fetches what your client asks for and passes it back.
  • 03Access to your accounts is encrypted, and you can remove it at any time.
  • 04We never sell your data, show you ads with it, or use it to train AI models.
  • 05Email hi@helm.mom and we delete your account and its data within 30 days.
01

Who we are

Helm is run by SenseWork AI LLC, a California company. In this policy, "Helm", "we" and "us" mean SenseWork AI LLC.

This policy covers the website at helm.mom, the app at app.helm.mom, and the MCP addresses Helm gives you.

Questions about your data: hi@helm.mom.

02

What Helm does

Helm sits between your AI client (Claude Code, claude.ai, Cursor and others) and the accounts you connect, such as Gmail, Google Drive and Google Calendar.

Your client calls a tool through Helm. Helm checks whether that agent may use that tool, asks you first when the rule says so, makes the call with your connected account, and returns the answer to your client.

Helm also keeps a memory and a set of skills for your agents. You write them, or your AI client writes them for you.

Helm does not run an AI model of its own. It never sends your data to a model provider. Your AI client does that, under its own terms.

03

What we collect, and why

We keep only what Helm needs to work for you.

Data
Why
How it's kept
Your account: email, name, and a password hash if you set a password
To sign you in and contact you about your account
In our database. Passwords are hashed with bcrypt, never stored as text
Access to your connected accounts: Google and Microsoft OAuth tokens, and API keys you add (GitHub, Linear, Notion and others)
So your agents can call those services for you
Encrypted at rest with AES-256-GCM. Removed the moment you delete the connection
The name and email of each connected account
To show you which account each agent uses
In our database
Your agents and their rules: which tools each may call, which need your approval, which folders it may use
This is the product: it is how Helm enforces your rules
In our database
Memory and skills
So your agents remember what you told them and work the way you set up
In our database, as you or your client wrote them
Approval requests: the tool, what it would send (for example an email's recipient, subject and text), your decision, and the result
So you can see and decide what your agent wants to do
In our database
Activity log: each tool call, its inputs and result, and how long it took
So you can see what your agents did, and so we can fix problems
In our database. File contents are removed and long text is cut to 4,096 characters
Files an agent uploads to attach to an email
To attach them
Deleted after 24 hours
Telegram chat ID, and your iPhone's push token if you use the app
To send you approval requests
In our database
Billing: your Stripe customer and subscription IDs and your plan
To know whether your plan is active
In our database. Your card details go to Stripe and never reach us
Usage events: which pages and buttons you use in the dashboard, and which tool was called and how long it took
To see how Helm is used and make it better
Sent to PostHog. Text on screen is masked, there are no session recordings, and tool inputs are never sent

When your client connects to Helm, we store only a fingerprint (SHA-256 hash) of its access tokens, never the tokens themselves.

04

Google user data

If you connect a Google account, Helm asks Google for the permissions below. Each one is used only for the tools listed, and only when your AI client calls them.

Permission
What Helm does with it
gmail.readonly
List, search and open messages and attachments you ask about, and list labels
gmail.compose
Create drafts, so you can read a reply before it goes anywhere
gmail.modify
Archive a message, mark it read, and add or remove labels
gmail.send
Send a draft. By default each send waits for your approval
drive
List, search, read, create and update files, only inside the folders you choose for each agent. Sharing and deleting are blocked by default
calendar.readonly, calendar.events
Read your calendars and free time, and create or update events. Deleting is blocked by default
userinfo.email, userinfo.profile
Show which Google account is connected, and sign you in with Google

What we keep. Helm does not copy your mailbox, your files or your calendar into its database. It fetches what your client asks for and passes it straight back. Some of it is kept, as described above: the inputs of each tool call in your activity log (for example the text of a draft), the details of an approval request and the result of the call you approved, and an uploaded attachment for 24 hours.

Limited Use. Helm's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide the features you use in Helm.
  • We do not sell it, and we do not use it for advertising.
  • We do not use it to train AI or machine learning models, ours or anyone else's.
  • We transfer it only to provide Helm's features, to comply with the law, or as part of a merger or sale with your notice.
  • No person at Helm reads it, unless you ask us to (for example to fix a problem you report), it is needed for security or to investigate abuse, or the law requires it.
05

Who else receives your data

We do not sell your data. These services receive some of it, only to run Helm:

Service
What they receive
Fly.io (hosting and database, United States)
Everything Helm stores, because Helm runs on their servers
Google and Microsoft
The calls your agents make to your own accounts
GitHub, Linear, Notion, Pipedrive, Zendesk and other services you connect
The calls your agents make, with the API key you gave
Telegram and Apple push notifications
Approval requests: the tool, and a preview of what it would send (up to 3,000 characters on Telegram)
Stripe
Your email and plan, to take payment
Mailgun
Your email address, to send account emails (welcome, trial reminders, reconnect requests)
PostHog (United States)
Usage events tied to your account, as described above
Brave Search
Web search queries your agents make

We may disclose data if the law requires it, or to protect Helm, our users or the public from harm.

06

How long we keep it

  • Connected accounts: until you delete the connection, or your account.
  • Account, agents, memory, skills, approvals and activity log: while your account is open.
  • Uploaded attachments: 24 hours.
  • When your trial or plan ends: your agents stop calling tools, and your data stays as it is so you can come back. Ask us and we delete it.
  • When you ask us to delete your account: we delete it and its data within 30 days.
07

Your choices

  • Disconnect an account in Helm at any time. Its token is deleted right away.
  • You can also remove Helm's access from your Google account permissions. Your agents then stop working with that account until you reconnect it.
  • Change what each agent may do: allow a tool, require your approval, or block it.
  • Get a copy of your data, or have it deleted: email hi@helm.mom with "Data request" in the subject. We answer within 5 business days and finish deletion within 30 days.
08

Security

Access tokens and API keys are encrypted at rest with AES-256-GCM. All connections to Helm use TLS. Your client's tokens are stored only as hashes. Risky tools (sending mail, sharing or deleting files, deleting events) are blocked or need your approval by default, and you can make them stricter.

If you find a security problem, email hi@helm.mom. We answer within 24 hours.

09

Children

Helm is not for children. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger.

10

Changes to this policy

If we change how we handle your data, we update this page and its date. If the change matters, we tell you by email before it takes effect.

11

Contact

SenseWork AI LLC, operator of Helm. hi@helm.mom. We read every email.