Privacy policy

Who is responsible

HeloMate (helomate.com) is the controller of your personal data.

For any privacy question or request, email privacy@helomate.com.

What we collect and why

For each item we list the data, the purpose and the legal basis under Article 6 of the GDPR.

You need an email address and a password to create an account. Everything else is optional. We do not make decisions with legal or similarly significant effects on you based solely on automated processing.

• Account: your email address and password. Your password is handled by our sign-in provider and stored only as a hash. We also keep an internal record of your email address and account status (active, beta tester), and which of our preset profile pictures you picked. Purpose: create and secure your account. Legal basis: contract.
• Learning data: your onboarding answers (including your planned exam date, weekend study hours and prior preparation), your quiz and reading answers and progress, any access you request to extra course packages, and a record of which answers were imported from your browser. Purpose: provide the course and show your progress. Legal basis: contract.
• Question reports: if you use the Report a mistake link, we store the question, the reason you pick, your optional note, your page language and the date. You do not need an account, and we do not store an account, email address or IP address in the report itself. Please do not put personal details in the note. Purpose: find and fix mistakes in our questions. Legal basis: legitimate interest. Our interest: improving HeloMate. You can object at any time.
• Newsletter: your email address, if you subscribe. Purpose: send you updates about HeloMate. Legal basis: consent. You can withdraw your consent at any time by emailing privacy@helomate.com.
• Voice tutor: the AI speaking tutor is switched off for everyone at the moment, so none of this is collected now. If it is switched on, your microphone audio is streamed from your browser directly to an AI speech provider in the United States, and the avatar video comes from an avatar video provider. We do not record or store the audio or the transcript. The speech provider keeps this data for up to 30 days to check for abuse and does not use it to train its models. The avatar provider handles the avatar session under its own terms. For each session we store its duration, scores, noted errors and placement result, plus the notes the tutor keeps about you for the next session. Purpose: speaking practice with feedback. Legal basis: contract.
• Technical and security data: your IP address and request details in server logs (kept up to 30 days), and request details in error reports (we remove the IP address before they are sent). When you sign up, sign in, reset your password or start the free diagnostic, our network security provider runs an automatic bot check. Purpose: keep the service secure and working. Legal basis: legitimate interest. Our interest: keeping HeloMate secure and free of abuse. You can object at any time.
• Blocked IP addresses: if we block an IP address for abuse, we keep its page visits for up to 180 days after its last visit: all request headers except cookies, the network and location data our network security provider adds (including city, postcode and coordinates) and a short code computed from the browser name, platform and language, and the IP addresses seen with that code. Purpose: keep the service secure. Legal basis: legitimate interest. Our interest: keeping HeloMate secure and free of abuse. You can object at any time.
• Look-alike visits: to spot a blocked person returning from another IP address, we compare the browser name, platform and language that every visitor's browser sends with those of blocked addresses. We store nothing when there is no match. On a match the visitor is not blocked. We keep only the time, IP address, country, network provider and the short code, for 30 days. A person reviews each match, and nothing is blocked automatically. Many people share the same browser and language, so you can match without having done anything wrong. We use no cookies or scripts on your device for this and use the data for nothing else. Legal basis: legitimate interest. Our interest: keeping HeloMate secure and free of abuse. You can object, see 'Your rights'.
• Usage statistics: counts of events such as page visits, signups and finished exercises, made with open-source analytics software on our own server in Amsterdam. A count holds the event name and, for a landing page visit, the campaign tags (source, campaign) of the link you came from. It holds no account, email address or answers. Your IP address is used only to count a visit once and to look up the country, and is not stored. We keep totals by country, browser and operating system, not linked to a person. We count nothing if your browser sends Do Not Track or Global Privacy Control. Purpose: see how many people reach and finish practice, so we can improve HeloMate. Legal basis: legitimate interest. Our interest: improving HeloMate. You can object at any time.

What we do not do

We do not sell your data. We do not show ads. We do not use advertising or tracking cookies.

Who processes your data

We use service providers for hosting and database, network delivery and security (including the bot check), error monitoring, email delivery and, for features that need them, AI speech and avatar services. The list below gives each kind and where it processes data. We update it before a new kind of provider or a new country receives your data. Some providers are US companies, and some data may be processed in the United States. For those transfers we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. Email privacy@helomate.com for a copy, or to ask which providers receive your data. We may also share data when the law requires it, or to establish or defend legal claims. If HeloMate moves to another legal entity, such as a BV, your data moves with it and we will tell you.

• Hosting and database: EU.
• Network delivery, encryption and security, including the bot check, which receives your IP address and browser details: global network. Abuse records are stored in the EU.
• Error monitoring, without IP addresses: EU.
• Email delivery, such as the welcome email. It receives your email address and the message: sent from the EU by a US-based company.
• Voice tutor (AI speech provider in the US, avatar video provider): switched off, so they receive nothing from you now.

Cookies and browser storage

We use no advertising or tracking cookies. The site keeps the entries listed below in your browser only so it can work. You can clear them at any time in your browser settings.

If you practise or take the diagnostic without an account, your answers stay in your browser, in the entries listed below. When you sign up or sign in, the free-practice answers and the answers of a finished diagnostic are uploaded to your account and then removed from the browser. Your account stores the question, the option you chose, whether it was correct and when it was answered, plus a record that the answer was imported. A diagnostic in progress, and older free-practice answers saved without the chosen option, are not uploaded and stay in your browser until you clear it.

Our bot check may also set a security cookie it needs to work.

We count a few anonymous events (such as a page view of the landing page, finishing a practice exam or a signup) with open-source analytics software, which runs on our own server in Amsterdam. This uses no cookies and no browser storage. Your IP address is used only to count a visit once and to look up the country, and is not stored. Legal basis: legitimate interest. Our interest: improving HeloMate. You can object at any time.

• hm_free_practice_v1: your free-practice answers: for each topic, the question numbers, whether each answer was correct and the option you chose.
• hm_diagnostic_v1: a diagnostic in progress: the questions, your answers so far, where you are, the language, the start time and a signed exam token that works once. Removed the next time the diagnostic opens after 170 minutes.
• hm_diagnostic_done_v1: the answers of a finished diagnostic, until they are uploaded to your account.
• hm_lang: the language you chose.
• A sign-in entry from our sign-in provider (its name starts with sb-): your sign-in session, with your email address and access tokens. Removed when you sign out.
• hm_has_account: a flag that you have signed in on this browser, so the form opens on sign-in.
• helomate-focus-mode: whether focus mode is on.
• helomate_banner_seen_count: how many times a hint banner was shown, as a number.
• maya_avatar_mode: the avatar style you picked for the voice tutor, used only if it is switched on.
• hm_error_retried (session storage): a flag that the page reloaded itself once after an error. Gone when you close the tab.

How long we keep data

We keep data no longer than we need it for the purposes above. The periods below are maximums; we may delete sooner.

• Account and learning data: until you delete your account in your profile or ask us to delete it.
• Newsletter email address: until you unsubscribe.
• Error reports: up to 90 days.
• Question reports: up to 90 days.
• Server logs: up to 30 days.
• Records of visits from IP addresses blocked for abuse: up to 180 days after the last blocked visit.
• Records of visits from other IP addresses that look like they come from the same browser: up to 30 days.
• The list of blocked IP addresses: as long as the block lasts.
• Usage statistics: up to 12 months.
• Deleted accounts: a marker with only the account ID and the deletion time, kept for 2 days (longer only if deleting your sign-in account fails and we retry) so that a sign-in token that is still valid cannot create your data again.
• Backups: deleted data can remain in encrypted backups for up to 8 weeks.
• Emails you send us and records of privacy requests: up to 2 years after the matter is closed, longer only to handle a legal claim.
• Our sign-in provider keeps its own security log of sign-in events, which can include your email address and IP address. Sign-in security log (email address, IP address, time of each sign-in event): up to 90 days.

Security

All traffic is encrypted with HTTPS.

Your rights

Under the GDPR you have the right to:

• access your data
• have your data corrected. If personal data we hold about you is wrong or incomplete, tell us at privacy@helomate.com and we will fix it.
• have your data deleted
• restrict how we use your data
• receive your data in a portable format
• object to our use of your data
• object at any time to processing based on legitimate interest (email privacy@helomate.com)
• withdraw your consent at any time

How to use your rights or complain

When you are signed in, you can download your data or delete your account yourself in your profile.

Email privacy@helomate.com. We answer within one month. For complex requests we may extend this by up to two months and tell you why. We may ask you to confirm your identity first.

You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Children

HeloMate is not intended for children under 16. Accounts are for people aged 16 or older. If we learn that an account belongs to someone under 16, we may delete it.

Changes to this policy

We post updates here and change the date. Before we use your data for a new purpose, we tell you on the site or by email before it starts.