Privacy Policy

Customer-specific use of Helixar products may also be governed by Helixar’s standard terms of business, an applicable order form, data processing addendum or other written agreement. Where Helixar processes personal information in customer data for the commercial Platform, Helixar ordinarily acts as a processor or service provider on the customer’s documented instructions under the applicable customer agreement.

Questions about this Privacy Policy or a privacy request can be sent to [email protected]. Legal enquiries can be sent to [email protected] and security matters to [email protected]. Helixar Limited (NZBN 9429053482686) is registered in New Zealand at 44 Glidepath Road, Hobsonville, Auckland 0616.

Helixar handles personal information in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles. Where Helixar handles personal information about individuals in Australia, Helixar also handles that information consistently with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply. Where the EU or UK General Data Protection Regulation applies to Helixar’s activities, Helixar will respond to applicable rights and transfer requirements under those laws.

• •Contact and enquiry details submitted through website forms, including name, work email address, company, role, phone number and message content.
• •Booking, demonstration, pilot-request, design partner or event registration details.
• •Communications information, including messages sent to Helixar, support requests, vulnerability reports, feedback, meeting notes and correspondence.
• •Public tool inputs voluntarily submitted by a user, such as a target URL, raw manifest JSON string or HDP delegation chain JSON object submitted to the MCP service.
• •Usage analytics collected through Google Analytics 4 in aggregate to understand how the site is used.
• •Technical and request metadata, such as IP address, HTTP method, path, headers, user-agent, device and browser type, pages requested, timestamps, status code and latency, collected by hosting, content-delivery and edge providers for security and website operation.
• •Security and operational information, including authentication events where applicable, abuse signals, error logs, diagnostics and system monitoring data.
• •Publicly available business information, including information from company websites, professional profiles, public registers, security publications and public threat intelligence sources.

Helixar may collect personal information from someone other than the individual concerned, including from an employer, customer, prospective customer, security researcher, integration partner, publicly available source, analytics provider, cloud provider, security service provider or other third-party provider.

Where required by New Zealand privacy law, Helixar will take reasonable steps to ensure the individual is made aware of the indirect collection and the matters required by the Privacy Act 2020, unless an exception applies.

• •Respond to enquiries, demo requests, pilot requests, support requests, legal requests, privacy requests and security reports.
• •Operate, maintain, secure and improve the website, public tools and public services.
• •Provide information about Helixar products, services, research, events and updates where permitted by law.
• •Assess eligibility for design partner, trial, pilot, beta or evaluation access.
• •Detect, investigate and prevent misuse, abuse, fraud, security incidents, unauthorised access and unlawful activity.
• •Generate aggregate analytics and understand how users interact with Helixar websites, publications and public tools.
• •Maintain business records, comply with legal obligations and enforce legal rights.
• •Improve Helixar services using aggregated, anonymised or de-identified information that does not reasonably identify an individual, customer, system, incident or security posture.

Where the GDPR applies, Helixar’s legal bases may include consent, legitimate interests in operating and securing the website and responding to enquiries, performance of a contract or steps taken at a user’s request, and compliance with legal obligations.

Helixar uses essential cookies and similar technologies required to operate the site. Helixar also uses Google Analytics 4 to understand aggregate site usage. Helixar’s current Google Analytics 4 measurement ID is G-Z92L6L5PK6.

Advertising features and ad-personalisation signals are disabled. In particular, allow_google_signals and allow_ad_personalization_signals are set to false. Helixar does not currently use advertising cookies, retargeting cookies or cross-site tracking cookies on the website. More detail is set out in Helixar’s Cookie Notice.

Helixar does not sell or rent personal information and does not share it with third parties for their own marketing. If Helixar sends commercial electronic messages, it will identify itself, use consent where required, and include a working unsubscribe mechanism, consistent with applicable laws including the New Zealand Unsolicited Electronic Messages Act 2007 and the Australian Spam Act 2003.

Helixar uses trusted third-party providers to operate the website and public tools. The current material providers for public website and public-tool operations include:

Platform subprocessors for commercial customers may differ and are addressed under the applicable customer agreement, data processing addendum or Platform subprocessor list.

Helixar and its providers may store or process personal information outside New Zealand and Australia. HubSpot, Google and Anthropic may process information in the United States. Cloudflare operates a global edge network, so processing may occur in any region where Cloudflare operates.

Where Information Privacy Principle 12 applies to an overseas disclosure, Helixar will make the disclosure only where it has reasonable grounds to believe appropriate safeguards apply or another permitted basis applies. For Australia, Helixar handles cross-border disclosures consistently with Australian Privacy Principle 8 where it applies. Where the GDPR applies, Helixar will rely on an appropriate transfer mechanism, such as adequacy, standard contractual clauses or another lawful mechanism.

For the commercial Platform, in-region or customer-specific deployment arrangements may be addressed in the applicable customer agreement.

Helixar keeps personal information only for as long as reasonably required for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Enquiry and CRM records are retained for the duration of Helixar’s relationship with the relevant organisation and a reasonable period afterwards to meet legal, accounting and business requirements. Analytics data is retained according to Helixar’s Google Analytics configuration. Cloudflare operational logs for the public MCP service follow Cloudflare’s standard retention settings for the relevant service; Helixar does not intentionally export public MCP operational logs to a long-term Helixar store.

Helixar uses technical, organisational and administrative safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls and least privilege, encryption in transit, monitoring, logging, secure development practices and personnel controls. No method of transmission or storage is completely secure, and Helixar cannot guarantee absolute security.

If Helixar becomes aware of a privacy breach that is notifiable under the New Zealand Privacy Act 2020, Helixar will notify the New Zealand Privacy Commissioner and affected individuals where required by law, subject to applicable exceptions or permitted delays. Where Australia’s Notifiable Data Breaches scheme applies, Helixar will notify affected individuals and the Office of the Australian Information Commissioner where required.

Individuals may request access to or correction of personal information held by Helixar. Individuals may also ask Helixar to delete or de-identify personal information, although Helixar may retain information where required or permitted by law, including for security, audit, dispute, legal or legitimate business purposes.

Requests may be sent to [email protected]. Helixar may need to verify identity before responding. Helixar aims to respond within the timeframe required by applicable law, including 20 working days under the New Zealand Privacy Act 2020, a reasonable period and generally within 30 days under the Australian Privacy Principles, and one month under the GDPR where it applies.

Where the GDPR or other overseas privacy laws apply, individuals may have additional rights, including rights to object, restrict processing, data portability, withdraw consent and complain to a supervisory authority.

Helixar does not use personal information collected through the public website to make decisions based solely on automated processing that produce legal or similarly significant effects about an individual. Helixar products analyse AI systems and agent behaviour for customers under their own agreements; that is separate from public website processing.

The website and Helixar services are intended for organisations and business professionals, not children. Helixar does not knowingly collect personal information from children. If Helixar becomes aware that a child has provided personal information, Helixar will take reasonable steps to delete it.

Privacy complaints may be sent to [email protected]. Helixar will acknowledge a privacy complaint within 5 business days and aims to respond substantively within 20 working days.

Individuals may also complain to the Office of the Privacy Commissioner in New Zealand, the Office of the Australian Information Commissioner in Australia, or a relevant EU or UK supervisory authority where applicable.

Helixar may update this Privacy Policy from time to time by publishing a revised version on the website. Material changes may be notified by prominent website notice or other reasonable means where appropriate.