Privacy Policy

1. Who We Are

HelmFi (operated by HelmFi Inc., a Delaware corporation) is a software-as-a-service platform that lets users configure and run automated cryptocurrency trading bots on their own exchange accounts, and that operates free market-analytics tools, including the Amon Hen dealer-positioning terminal at amonhen.helmfi.ai. This Privacy Policy covers helmfi.ai and its subdomains, and explains what data we collect, how we use it, who we share it with, and your rights.

2. Data We Collect

2.1 Account data

• Email address (your login identifier).
• Password (stored as a salted hash via Argon2; plaintext is never seen or stored).
• Subscription tier, account creation date, basic usage counters.

2.2 Billing data

Payment processing is handled by Stripe, Inc. (or its affiliates), our payment processor. Card numbers, billing addresses, and tax information are submitted directly to Stripe; HelmFi receives only subscription status, current plan, and an opaque customer identifier. See Stripe’s Privacy Policy.

2.3 Bot configuration & trading data

• Strategy configuration (parameters, risk gates, schedules) that you submit.
• Encrypted API credentials for exchanges you connect. Kraken spot is the current live CEX venue; other integrations are added only when supported.
• Trade history, position state, and bot decision logs from runs you authorize.

API credentials are encrypted at rest with a per-server master secret. HelmFi does not have, and does not request, access to your exchange account password.

2.4 Operational logs

• Server access logs (IP, request path, user-agent, status code) retained ~30 days for security and debugging.
• Application logs of bot activity, retained ~90 days.

2.5 Cookies

A single signed session cookie (helmfi_session) keeps you logged in. No third-party advertising, retargeting, or analytics cookies are set by HelmFi’s servers.

3. How We Use Your Data

• Provide the Service — authenticate you, run the bot you configured, send transactional email.
• Improve the Service — analyze aggregated usage of dashboards and features.
• Communicate — send account, billing, security, and (with your consent) product update email.
• Comply with legal obligations — respond to lawful requests, prevent fraud, enforce our Terms.

4. Who We Share Data With

4.1 Service providers

• Stripe (payment processor) — handles payment processing, sales tax, and invoicing. Receives your billing information directly.
• Hetzner Cloud (infrastructure provider) — hosts the servers that run the Service.
• Cloudflare (DNS, CDN, DDoS protection) — may see request metadata.
• Anthropic (AI inference) — processes the content of AI chat conversations, including Ask Amon questions on the Amon Hen terminal and portfolio-context chat on paid tiers. Chat prompts and replies are logged by us for abuse prevention and quality review.
• Groq (AI inference) — processes market-regime classification requests and Starter-tier chat. These requests contain market data and your questions, not your account credentials.

4.2 Exchanges you connect

When you authorize HelmFi to run a bot on your exchange account, we transmit the trade instructions you have configured to the exchange. The exchange sees activity by definition. HelmFi never custodies your funds.

4.3 Legal compliance

We will disclose information when required by valid legal process (subpoena, court order) or to protect our rights, safety, or property.

We do not sell your personal data. We do not share bot configuration or trading data with third parties for marketing purposes.

5. Data Retention

• Account & subscription data: retained while your account is active and up to 2 years after deletion for tax/audit reasons.
• Bot configurations and trade history: retained for the life of your account; deleted within 30 days of account closure.
• Operational logs: 30 days (access logs), 90 days (application logs).

6. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data (subject to tax/audit retention requirements);
• Export your data in a portable format;
• Object to or restrict certain processing.

To exercise any of these rights, email us via the contact page. We respond within 30 days.

7. International Data Transfers

Our servers are located in the European Union (Hetzner), and account data is stored there. AI chat and market-regime requests are processed by United States-based providers (Anthropic and Groq — see Section 4.1), so chat content you submit is transferred to and processed in the US under those providers' data-processing terms and standard contractual safeguards.

8. Security

We protect your data with HTTPS-only access, encrypted API key storage, Argon2 password hashing, and access-restricted infrastructure. If we discover a breach affecting your data, we will notify affected users without undue delay.

9. Children

HelmFi is not directed to or intended for use by anyone under 18. We do not knowingly collect personal data from minors.

10. Changes to This Policy

Material changes to this Privacy Policy will be announced via email at least 14 days before they take effect.

11. Contact

Privacy questions or data-rights requests: please use the contact page.