EEA/UK Privacy Notice (GDPR Addendum)

This notice supplements the Helping.io Privacy Policy for individuals located in the European Economic Area (EEA) and the United Kingdom (UK). It describes additional information we provide under the GDPR/UK GDPR.

Controller. The controller responsible for processing your personal data is IMNS LLC, a Wyoming limited liability company (doing business as “Helping.io”). Contact: support@helping.io.

1. Lawful bases for processing

We process personal data under the following lawful bases:

• Contract (performance of a contract): to provide the Service, authenticate users, deliver features, respond to requests, and manage your account and subscription.
• Legitimate interests: to secure the Service, prevent abuse and fraud, maintain logs and audit trails for security, and improve reliability and performance. We balance these interests against your rights.
• Consent: for marketing communications and any non-essential cookies if we add them in the future. You can withdraw consent at any time.

2. Categories of personal data

Depending on how you use the Service, we may process:

• Account information (for example, name, email address, and password, stored hashed)
• API keys you create
• Subscription and billing metadata (processed via Stripe)
• Service content you submit (messages, prompts, code snippets, tool inputs/outputs you choose to store)
• File paths from your editor (workspace root prefixes removed where they can be matched)
• Error logs and stack traces (workspace root prefixes removed from editor file paths where they can be matched)
• Security and authentication audit logs, including IP address and browser details on sign-in and security records
• Bug reports you send from the VS Code extension

We do not intentionally send personal identifiers (such as your email) to third-party model providers as part of normal operation.

3. Your rights

Subject to certain limitations and exceptions, you may have the right to:

• Request access to your personal data
• Request correction or deletion
• Object to processing or request restriction of processing
• Request data portability
• Withdraw consent (where processing is based on consent)
• Lodge a complaint with your supervisory authority (EEA) or the UK ICO

To exercise rights, contact support@helping.io. We may need to verify your identity.

4. International transfers

We and our service providers may process data in the United States and other countries. Where required for transfers from the EEA/UK to countries without an adequacy decision, we rely on appropriate safeguards, such as Standard Contractual Clauses (and, for UK transfers, the UK addendum where applicable), and additional measures as appropriate.

5. Subprocessors

We use subprocessors to operate the Service (for example, hosting, email, billing, logging, and model providers). See our Subprocessors page for the current list.

6. Retention

We retain personal data as described in our Privacy Policy. No retention period is applied today to account or service data. Our security audit log is kept for as long as needed for security and fraud prevention. You can delete your own conversations in the VS Code extension and through the /v1 API, as described in Section 5 of the Privacy Policy. There is no self-service account deletion; to request account deletion, contact support@helping.io. We handle these requests manually. Within 30 days of your request, we delete or anonymize your personal data. We keep billing records and the security audit log, as the law and security require.

7. Contact

Questions or requests: support@helping.io