This Privacy Policy explains how FirstHelm Technologies Ltd collects, uses, and protects your personal data, in accordance with the UK GDPR and the Data Protection Act 2018.
1. Who we are
FirstHelm Technologies Ltd is the data controller responsible for your personal data in connection with the FirstHelm platform. You can contact our data protection team at privacy@firsthelm.dev.
2. Data we collect
- Account details — name, email address, role, and organisation information you provide at registration.
- Agent activity and telemetry — actions, decisions, tool calls, cost and token usage recorded for agents you connect.
- Approval and intervention records — your approval decisions, interventions, and the reasons you record.
- Usage analytics — how you and your team use the platform, collected to improve the service.
- Billing data — plan, payment method identifiers, and invoices. We do not store full card numbers.
3. How we use it
- To provide and operate the platform, including constraint enforcement and approvals.
- To maintain safety and human-oversight records required for AI governance.
- To keep compliance and audit logs as required by applicable law.
- To improve, secure, and support the service.
4. Lawful bases
| Basis | Use |
|---|---|
| Contract | Providing the service you signed up for |
| Legitimate interests | Security, fraud prevention, and platform integrity |
| Legal obligation | AI Act and GDPR record-keeping duties |
| Consent | Optional analytics and marketing communications |
5. Retention
Activity and audit data is retained as required by applicable law and your configured retention policy. Account data is retained until you request deletion, after which it is removed within 30 days except where law requires longer retention.
6. Your rights (UK GDPR, Arts 15–22)
You have the right to access, rectify, erase, restrict, or port your personal data, to object to its processing, and to object to automated decision-making. To exercise any of these rights, contact privacy@firsthelm.dev. If you are unhappy with our response, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
7. International transfers
Your data is hosted in the UK/EEA by default. Where a transfer outside these regions is necessary, we rely on appropriate safeguards such as an International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
8. Security of your data
We protect your data with TLS 1.2+ in transit and AES-256 encryption at rest, role-based access controls, and encrypted secrets. See our Security page for details.
9. Cookies
- Essential — required for authentication and core functionality.
- Analytics — help us understand usage (opt-out available).
- Preferences — remember your settings.
10. Children
The platform is not intended for individuals under 18 and we do not knowingly collect their data.
11. Changes to this policy
We may update this policy from time to time and will indicate the change with a revised "Last updated" date.
12. Contact
FirstHelm Technologies Ltd · privacy@firsthelm.dev