Privacy Policy

Helper Agent · Last updated: July 17, 2026

1. Who We Are & Scope

In plain English: This policy explains what data Helper Agent collects and how we handle it — both for our own customers and for people who chat with our customers' AI agents.

This Privacy Policy describes how Flow My Data, LLC, a Tennessee limited liability company doing business as Helper Agent (“Helper Agent,” “we,” “us”), collects, uses, and shares personal information when you visit our website, register for or use our AI chatbot platform (the “Service”), or interact with an AI agent deployed by one of our customers.

In this policy: a “Customer” is a business that subscribes to the Service; an “End User” is a person who interacts with an AI agent that a Customer has deployed; and “Customer Data” means data submitted to the Service by or on behalf of a Customer, including End User chat conversations, transcripts, and agent configurations.

2. Our Two Roles: Controller & Processor

In plain English: For our own website and billing, we decide how data is used. For chats with a customer's agent, that customer is in charge of the data — we just process it for them.

As a controller, we determine how and why personal information is processed for: our website, marketing, Customer account registration, billing, support, and Service analytics.

As a processor / service provider, we process Customer Data — including End User conversation content — solely on the documented instructions of the relevant Customer and in accordance with our Data Processing Agreement (“DPA”), available upon request at [email protected].

If you are an End User who chatted with an AI agent on a business's website, that business is the controller of your conversation data. Please direct privacy requests about those conversations to that business; we will support them in fulfilling your request.

3. Information We Collect

In plain English: Account and billing details from customers, usage data from everyone, and chat content when agents are used.

3.1 Information Customers provide

Name, email address, company name, phone number, billing address, and payment information (processed by our payment processor — we do not store full card numbers), plus anything you submit through support requests.

3.2 Customer Data

Content Customers upload to configure and train their agents (documents, FAQs, website content), agent settings, and conversations between agents and End Users, including chat transcripts and associated metadata. This may include personal information that End Users choose to share during a conversation.

3.3 Information collected automatically

IP address, browser type and version, device identifiers, pages visited, time and date of visits, time spent on pages, referring URLs, and diagnostic data, collected via cookies and similar technologies (see Section 6).

4. How We Use Information

In plain English: To run and improve the Service, bill you, support you, keep things secure, and (for our own customers) send relevant updates.

We use personal information to: provide, operate, maintain, and improve the Service; create and manage accounts; process payments and manage subscriptions; provide customer support via email and chat; send service communications (such as security alerts, invoices, and changes to terms); with your consent or as otherwise permitted by law, send marketing communications, which you can opt out of at any time; monitor usage, prevent fraud and abuse, and enforce our Terms of Service; and comply with legal obligations.

Customer Data is used solely to provide the Service to the relevant Customer. We do not use Customer Data for advertising or marketing.

5. AI & Model Training

In plain English: We don't use your data or your end users' conversations to train AI models.

We do not use Customer Data — including End User conversation content and chat transcripts — to train, fine-tune, or otherwise improve any artificial intelligence or machine learning models, whether our own or third parties'. AI responses are generated using third-party large language model providers accessed through commercial APIs whose terms prohibit the use of submitted data for model training.

6. Cookies & Tracking

In plain English: We use cookies to keep you signed in, remember preferences, understand site usage, and (on our website) support advertising. You can refuse non-essential cookies.

We use cookies and similar technologies in the following categories:

Essential cookies (session) — required for authentication and core functionality of the Service; policy-acceptance cookies (persistent) — remember that you have accepted our cookie policy; functionality cookies (persistent) — remember your preferences and settings; tracking and performance cookies (third-party, persistent) — help us understand how visitors use our website via Google Analytics; and targeting and advertising cookies (third-party, persistent) — used to deliver advertisements relevant to you and your interests and to measure the effectiveness of advertising campaigns.

You can instruct your browser to refuse cookies or configure your preferences through our cookie banner where available; if you refuse essential cookies, some parts of the Service may not function. For advertising-cookie opt-outs, see Section 14 (California Privacy Rights) and Section 8 (Analytics & Advertising Partners).

In plain English: We share data only with the vendors that make the Service run, when the law requires it, or in a business transfer. We don't sell personal information.

We share personal information only with:

Service providers and sub-processors that help us deliver the Service, limited to what they need to perform their functions, including: our chatbot platform infrastructure provider; large language model (AI inference) providers; cloud hosting providers; our payment processor (e.g., Stripe); email and communications tools; and analytics providers. A current list of sub-processors that process Customer Data is available on request at [email protected]; Customers will be notified of changes and may object on reasonable data-protection grounds.

Legal and safety recipients, when required by law, subpoena, or legal process, or where necessary to protect the rights, property, or safety of Helper Agent, our Customers, or others.

Business transferees, in connection with a merger, acquisition, financing, or sale of assets, in which case this Privacy Policy will continue to apply to your information until you are notified otherwise.

Advertising and analytics partners, which may collect identifiers and internet-activity data from our website through cookies as described in Sections 6 and 8. Customer Data is never shared with advertising partners and is never used for advertising or marketing purposes.

8. Analytics & Advertising Partners

In plain English: Our website uses analytics and advertising services from partners like Google and Meta. You can opt out of personalized ads.

We use the following categories of third-party services on our website. Each partner's use of your information is governed by its own privacy policy:

Analytics: Google Analytics — tracks and reports website traffic. You can opt out by installing the Google Analytics opt-out browser add-on.

Advertising: Google AdSense & DoubleClick — uses cookies to serve ads based on prior visits to our website and other websites; opt out of personalized advertising at Google Ads Settings. Meta (Facebook) advertising — we may use Meta's advertising and remarketing tools; manage your preferences in your Facebook Ad Preferences.

Payments: Stripe — processes subscription payments in compliance with PCI-DSS; we do not store full payment card details.

You can also opt out of interest-based advertising from many partners through the NAI opt-out platform or the DAA opt-out platform, and via your mobile device's ad-tracking settings.

In plain English: When we launch our social media pages, interacting with them involves data collection by those platforms too.

Helper Agent maintains (or will maintain) profiles on social media platforms where you can follow us and interact with our content:

Facebook: Coming soon · LinkedIn: Coming soon · X (Twitter): Coming soon · Instagram: Coming soon

Facebook fan page. For our Facebook page, Helper Agent and Meta Platforms, Inc. are joint controllers of personal data processed in connection with the page. Meta provides us with aggregated, anonymized statistics about visits to and interactions with the page (“Page Insights”) collected via cookies, each of which typically persists for two years. We do not receive individual-level data from Page Insights. The processing of your data by Meta is governed by Meta's Privacy Policy, and you can exercise your privacy rights with respect to that processing directly with Meta.

When you interact with our social media profiles, the relevant platform collects data about you under its own privacy policy. We only see the information you make public or send to us directly.

10. Data Retention

In plain English: We keep data as long as your account is active or as the law requires, then delete it.

We retain Customer account information for as long as the account is active and as needed to comply with legal, tax, and accounting obligations. Customer Data is retained for the duration of the Customer's subscription; upon termination, Customer Data is deleted or returned in accordance with our DPA, subject to routine backup cycles (which are purged on a rolling basis of no more than thirty (30) days) and any legal retention requirements. Usage data is generally retained for shorter periods unless needed for security or legal purposes.

11. Security

In plain English: Data is encrypted in transit and at rest, and access is restricted — but no system is 100% secure.

We implement commercially reasonable technical and organizational safeguards, including encryption in transit (HTTPS/TLS), encryption at rest via our infrastructure providers, logical segregation of Customer Data by account, least-privilege access controls, and restricted access to production systems. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify affected Customers of any personal data breach as required by applicable law and our DPA.

12. International Data Transfers

In plain English: Data is processed in the United States. For EU/UK data, we use approved safeguards.

Our Service is operated from the United States, and information is processed on infrastructure located in the United States (and, for some sub-processors, other jurisdictions). Where we transfer personal data protected by the GDPR or UK GDPR outside the EEA or UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum.

In plain English: If you're in the EU or UK, you can access, correct, delete, or export your data, object to processing, and withdraw consent.

Legal bases. Where the GDPR or UK GDPR applies, we process personal data on the following legal bases: performance of a contract (providing the Service you signed up for); legitimate interests (securing and improving the Service, business communications); consent (marketing communications and non-essential cookies); and legal obligation (tax and accounting records).

Your rights. You have the right to: request access to your personal data; request correction of inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; withdraw consent at any time (without affecting prior processing); and lodge a complaint with your local supervisory authority.

To exercise these rights, contact [email protected]. We may need to verify your identity, and we will respond within one month (extendable as permitted by law). If your request concerns a conversation with a Customer's AI agent, we will refer you to, and assist, that Customer as controller.

14. California Privacy Rights (CCPA/CPRA)

In plain English: California residents can ask what we collect, request deletion or correction, and won't be discriminated against for asking. We don't sell or share your data for cross-context ads.

In the preceding 12 months, we have collected the following categories of personal information as defined by the California Consumer Privacy Act, as amended by the CPRA:

Category	Examples	Collected
A. Identifiers	Name, email, IP address	Yes
B. Customer records	Billing address, payment details	Yes
D. Commercial information	Subscription and purchase history	Yes
F. Internet activity	Browsing and usage data on our Service	Yes
C, E, G–K	Protected classifications, biometrics, precise geolocation, employment/education data, profiles	No

We collect this information from you directly and automatically through your use of the Service, for the business purposes described in Section 4.

Sale and sharing of personal information. We do not sell personal information in the ordinary sense of the word, and Customer Data is never sold or shared for advertising. However, our use of third-party advertising and analytics cookies on our website (Sections 6 and 8) may allow those partners to collect identifiers and internet-activity data (Categories A and F) in a way that constitutes a “sale” or “sharing” for cross-context behavioral advertising under the CCPA/CPRA. You have the right to opt out at any time using our cookie preference controls, the opt-out platforms listed in Section 8, or a browser-based opt-out preference signal such as Global Privacy Control. We do not knowingly collect or sell the personal information of consumers under 16 years of age.

Your rights. California residents have the right to: know what personal information we collect, use, and disclose; access a copy of it; correct inaccurate information; delete personal information (subject to legal exceptions); opt out of the “sale” or “sharing” of personal information; limit the use of sensitive personal information; and not be discriminated against for exercising these rights.

Submit requests to [email protected]. We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice). You may designate an authorized agent to make requests on your behalf.

15. Children's Privacy

The Service is intended for business use and is not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

16. Do Not Track

Our Service does not currently respond to “Do Not Track” browser signals. You can express your preferences using the cookie controls described in Section 6.

17. Third-Party Links

Our website and Service may contain links to third-party websites we do not operate. We are not responsible for the content or privacy practices of third-party sites and encourage you to review their privacy policies.

18. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised “Last updated” date and, for material changes, notify you by email or prominent notice within the Service before the changes take effect.

19. Contact Us

Questions or requests regarding this Privacy Policy or your personal data:

Flow My Data, LLC d/b/a Helper Agent
PO Box 1000
Springfield, TN 37173
Privacy requests: [email protected]
General support: [email protected]