Privacy

Controller

The controller of the data collected on helaio.com is Olivier Herbelin (Helaio), reachable at contact@helaio.com.
Helaio hosts practitioners’ websites. On those sites, the practitioner is responsible for your data and publishes their own policy. Helaio acts as their processor: messages from their contact form are e-mailed to them without being stored, and only the technical logs described below are kept.

The “See my site” form collects your name, e-mail address, phone number if you provide it, profession, city and country, the languages you want, the address of your website or domain name if you have one, your booking tool and the description of your practice.
This information is used only to prepare your site and contact you (pre-contractual steps taken at your request). It is stored in the Helaio database, hosted by Amazon Web Services EMEA SARL, Paris region (eu-west-3), France. Olivier Herbelin is notified of your request by an e-mail that contains none of this information.
If no site is ordered, it is deleted no later than 12 months after receipt. If a contract is signed, it is kept for the duration of the relationship and then as long as the law requires.
It is neither sold nor used for any other purpose. To compose your site, it is sent to the artificial intelligence services described below. It is read by Olivier Herbelin from Israel, a country recognised by the European Commission as providing an adequate level of protection.
The photos and logo you upload go to a private storage space in France, are used only to create your site (the artificial intelligence looks at them to place them), and are deleted automatically no later than 30 days after upload if no site is ordered.

When you become a client, Helaio keeps: your name and, where applicable, your business name, your e-mail address, your phone number, your country and language, your VAT or company number, the plan and options you chose, the content of your site, what you provide for its set-up and the changes you entrust to Helaio.
This data is used to perform the contract: creating, hosting and maintaining your site, giving you access to the client area and supporting you. The legal basis is the contract; for accounting records, legal obligation.
Signing in to the client area uses a link sent by e-mail, single-use and valid for 15 minutes.
It is kept for the whole relationship. After you leave, your site and its content are deleted within the periods set by the terms of sale (archive kept for 90 days); accounting records are kept for as long as the law requires.

The texts of the sites are written, translated and edited by artificial intelligence. To do so, Helaio sends Anthropic (Claude) the description of your practice, your professional details, your photos and, in the client area, the instructions you give. The logo and illustration photos are created by OpenAI, from your practice name, your profession, the chosen style and your wishes.
These services may process data outside the European Union, notably in the United States. This transfer is covered by the European Commission’s standard contractual clauses, included in the data processing agreement Helaio has concluded with Anthropic and with OpenAI. They do not use this data to train their models.
Helaio stores the resulting site, never your instructions nor the intermediate responses of the artificial intelligence.
On the “Try it” pages, what you dictate or type is sent to Anthropic (Claude) to edit the demonstration, then forgotten: nothing is stored. Dictation uses your browser’s speech recognition, which its publisher may run on its own servers (Google for Chrome, for example).

The delivery servers of helaio.com and of practitioners’ sites record, for each page requested, the IP address, the page, the browser and the time. These logs serve security and troubleshooting, on the basis of Helaio’s legitimate interest in protecting its services; they are deleted after 30 days.
The server of the client area, previews and form records only a truncated IP address, which points to a network rather than a device; its archived logs are deleted after 30 days.
Mail received on a helaio.com address or on a site’s contact address is forwarded, then deleted; it is kept for 14 days at most if it could not be forwarded.
Database backups are deleted after 90 days: deleted data disappears from backups no later than 90 days afterwards.

E-mails you exchange with Helaio (contact@helaio.com and its other addresses) arrive at Amazon Web Services EMEA SARL, Paris region (eu-west-3), France, then are forwarded to Olivier Herbelin’s mailbox, hosted by Namecheap (Private Email), a company established in the United States. They may therefore be processed outside the European Union.
The form on the Contact page sends your name, your e-mail address and your message to that same mailbox, by e-mail: they are stored neither on the site nor in the database.
They are used to answer you and follow up on your file, and are kept for the duration of the relationship.

To provide its services, Helaio uses the following sub-processors:
Amazon Web Services EMEA SARL (Luxembourg) — hosting of the sites, the database and the backups, sending and receiving e-mail; data processed in France, Paris region.
Anthropic PBC (United States) — writing, translating and editing the text of the sites; transfer covered by the European Commission’s standard contractual clauses.
OpenAI (United States) — creation of logos and visuals; transfer covered by the European Commission’s standard contractual clauses.
Namecheap, Inc. (United States) — e-mail provider hosting the destination mailbox of the helaio.com addresses; transfer covered by the European Commission’s standard contractual clauses.
The speech recognition used by dictation is your browser’s own: its publisher (Google, Apple or Microsoft depending on the browser) is not a sub-processor of Helaio, which never receives your voice.

You have the right to access, rectify and erase your data, to object to and restrict its processing, and to data portability. To exercise it, write to contact@helaio.com. You may also lodge a complaint with the French authority CNIL (www.cnil.fr).

This site sets no cookies and uses no analytics or tracking tool. No consent banner is therefore needed.
One exception: the client area (espace.helaio.com) sets a single cookie, strictly necessary to keep you signed in. It expires after 30 days, or as soon as you sign out.
Your browser also keeps, on your device only, the draft of the “See my site” form, your accessibility settings and the state of the “Try it” pages. Nothing of it is sent.
To offer Hebrew and Arabic to visitors located in Israel, the site asks its own delivery server once, which answers with the country inferred from the IP address. The country is not kept; like any page, the request appears in the technical logs.