Legal

Privacy Policy

LAST UPDATED JULY 17 2026

This policy explains what data Helmia collects, why, who processes it, and your rights under the GDPR. Short version: we collect what the product needs to work, we don’t sell it, and we don’t train models on it.

01Who is responsible

The data controller is Helmia, operated from Barcelona, Spain. Contact for privacy matters: hello@helmia.ai.

02What we collect

  • Account data: email address and authentication data, managed through Supabase.
  • Content you provide: prompts, chat messages with the directing agent, and images you upload as character or product references. Reference images may contain faces; see section 03.
  • Generated content: the images, clips, audio and videos you create, stored so you can access your library.
  • Payment data: handled entirely by Stripe. We receive confirmation of payment and credit amounts, never your card details.
  • Technical data: logs, IP address and basic usage data needed to operate, secure and rate-limit the service.

03Uploaded faces

Reference photos containing faces are processed only to fulfil the generations you explicitly request (character consistency across scenes) and are shared with our AI providers solely for that purpose. We do not use them for identification, profiling, or model training, and we do not build biometric databases. Delete a character and its reference images are removed from active storage.

04Why we process it (legal bases)

  • Performance of contract: everything needed to provide the service: accounts, generation, storage, billing.
  • Legitimate interest: security, abuse prevention, rate limiting, service improvement based on aggregate usage.
  • Legal obligation: invoicing and tax records.

05Who processes your data

We use a small set of processors, each receiving only what their function requires:

  • Supabase: authentication, database and file storage.
  • Stripe: payments.
  • Vercel and Railway: application hosting.
  • AI generation partners: specialized providers for image and video generation, avatar lipsync, voice synthesis and the directing agent. Your prompts and reference images are sent to these partners only as needed to fulfil each generation you request.

Some providers are located outside the European Economic Area (primarily in the United States). Transfers rely on the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

06Retention

Account data and your content library are kept while your account is active. If you delete your account, we delete your personal data and content within 30 days, except records we must keep for legal reasons (such as invoices). Technical logs are kept for a short rolling window.

07Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to hello@helmia.ai and we will respond within one month. You can also lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

08Cookies

Helmia uses only the cookies strictly necessary for authentication and session management. We do not use advertising or cross-site tracking cookies. If that ever changes, we will ask for your consent first.