Privacy Policy.

Helm is operated by AI Compass Pty Ltd (ABN 51 673 500 868), an Australian company. This policy explains what personal information we collect across Helm Tenders and Helm Grants, why we collect it, who receives it and the choices you have. We run Helm in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). The short version: we collect only what the service needs, we use it only to run Helm for you, we sell nothing to anyone, and your data lives in Australia.

What we collect

• Account details: your name, email address and, if you verify it, your mobile number.
• Business profile: company details, capability statements, past projects, preferences and any documents or records you add so Helm can score opportunities and help you respond.
• Usage: which opportunities you view and track, and how the product is used, measured by our own first-party analytics so dashboards, reminders and the product itself work and improve.
• Support: messages and screenshots you send us through tickets.
• Billing: handled by Stripe. We never see or store your card number.

We collect this directly from you, from your use of the product, and from public sources: government procurement and grant listings sometimes contain the published contact details of agency officers, which we index as part of the public notice they appear in.

What we use it for

One purpose: running Helm for you. Your profile is used to score tenders and grant rounds against your business, power the tools you use, and send the digests and reminders you turn on. We use aggregated, de-identified usage statistics to improve the product. We do not sell personal information, we do not share it with advertisers, and we do not use your data to train AI models. Marketing email is only sent with an unsubscribe control in every message, as the Spam Act 2003 (Cth) requires.

Who receives your data

We share personal information only with the service providers that run Helm, each limited to its purpose, and with no one else unless the law requires it:

• Supabase: database and authentication.
• Stripe: payments and billing.
• Resend: transactional email delivery.
• Twilio: one-time codes for mobile verification.
• OpenAI and Anthropic: AI processing of the text you ask Helm to score, read or draft.

If our business is ever sold or restructured, your data may transfer to the successor under this same policy. We may disclose information where a law, court or regulator validly requires it.

Overseas disclosure

Your account data and business profile are stored in Australia (Sydney). Some of the providers above process data outside Australia, including in the United States: payment processing, email delivery, mobile verification and AI processing involve data passing to them for those purposes. We rely on contractual safeguards with each provider, and our AI providers process text under terms that prohibit training on it. We store no personal information overseas ourselves.

Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access or disclosure: encrypted connections, access limited to the people who need it, and the platform hardening described on our security page. If a data breach happens that is likely to result in serious harm, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.

Retention

• Documents you upload into a workspace are deleted 90 days after their tender or round closes, or immediately when you delete them or your account.
• Support-ticket screenshots are deleted 90 days after the ticket closes.
• Account and profile data is kept while your account exists. Ask us to delete your account and we action it within 30 days, keeping only what tax, accounting or other law requires us to keep.
• We may keep de-identified statistics that no longer relate to anyone.

Access, correction and your choices

You can access and correct almost everything Helm holds about you directly in the product. For anything else - a copy of your data, a correction we have missed, or deletion of your account - use the contact form and we will respond within 30 days without charge. Every marketing and digest email carries an unsubscribe control, and notification settings live in the product.

Cookies

Helm uses no third-party tracking cookies, no advertising pixels and no external analytics trackers, which is why there is no cookie banner: there is nothing to consent to. The cookies we set are our own and the service needs them:

• Authentication: keeps you signed in securely.
• World selection: remembers whether you are working in the tenders or grants side.
• Signed-in hint: lets public pages show the right navigation when you already have a session.
• Analytics happen first-party on our own infrastructure, tied to the product working, not to advertising.

Blocking cookies in your browser will prevent signing in, since the session cookie is how Helm knows you.

Complaints

If you think we have mishandled your personal information, tell us first through the contact form and we will investigate and respond. If we cannot resolve your concern, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

When this policy changes materially we will tell you by email or in the product before the change takes effect. The date at the top of this page always states the current version.