Data Processing Agreement

1. Definitions

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council.
• Controller means the customer, who determines the purposes and means of processing.
• Processor means Helion, who processes data on the Controller's behalf.
• Personal Data, Processing, Data Subject, and Supervisory Authority have the meanings given in the GDPR.
• Sub-processor means any third party engaged by Helion to process Personal Data in connection with the service.

2. Our approach to privacy

Helion is built to minimize personal data collection by design. We do not use cookies for analytics tracking. We do not store IP addresses. Instead, we generate a daily-rotating anonymous identifier using a one-way hash of the visitor's IP address, user agent, and project ID combined with a salt that is replaced every 24 hours. The raw IP address is discarded immediately and the identifier becomes irreversible once the salt is rotated.

The data we store per event is:

• Page URL and referrer
• Browser name and version
• Operating system name and version
• Device type, brand, and model
• City, country, and region (derived from IP at the time of the request; IP is then discarded)
• Custom event properties the Controller chooses to send

No persistent identifiers, no cookies, no cross-site tracking. Because of this approach, the analytics data Helion collects in standard website tracking mode does not constitute personal data under GDPR Art. 4(1). We provide this DPA for Controllers who require it for their own compliance documentation and records of processing activities.

Session replay (optional feature)

Helion optionally supports session replay, which must be explicitly enabled by the Controller. When enabled, session replay records DOM snapshots and user interactions (mouse movements, clicks, scrolls) using rrweb. All text content and form inputs are masked by default. The Controller is responsible for ensuring their use of session replay complies with applicable privacy law, including providing appropriate notice to end users.

AI features (not currently enabled)

Helion's codebase includes optional AI features (such as natural-language queries over analytics data, anomaly insights, and AI-assisted reports). These are not currently enabled on this deployment, and no data is sent to any AI/LLM provider today. If Helion enables these features in the future, this DPA will be updated in advance, naming the provider used and the safeguards in place.

3. Scope and roles

Helion acts as a Processor when processing data on behalf of the Controller. The Controller is responsible for the analytics data collected from visitors to their websites and applications.

4. Processor obligations

Helion commits to the following:

• Process Personal Data only on the Controller's documented instructions and for no other purpose.
• Ensure that all personnel with access to Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain technical and organizational measures in accordance with Section 7 of this DPA.
• Not engage a Sub-processor without prior general or specific written authorization and flow down equivalent data protection obligations to any Sub-processor.
• Assist the Controller, where reasonably possible, in responding to Data Subject requests to exercise their rights under GDPR.
• Notify the Controller without undue delay (and no later than 48 hours) upon becoming aware of a Personal Data breach.
• Make available all information necessary to demonstrate compliance with this DPA. Audits by the Controller or their designated auditor are limited to one per 12-month period (unless required by a supervisory authority or following a confirmed Personal Data breach), require 30 days' prior notice, are conducted under confidentiality, at the Controller's cost, and without unreasonable disruption to operations. Documentary requests in lieu of on-site audits will be accommodated where they provide equivalent assurance.
• At the Controller's choice, delete or return all Personal Data upon termination of the service.

5. Controller obligations

The Controller confirms that:

• They have a lawful basis for the processing described in this DPA.
• They have provided appropriate privacy notices to their end users.
• They are responsible for the accuracy and lawfulness of the data they instruct Helion to process.

6. Sub-processors

Helion currently uses a small number of sub-processors to deliver the service, limited to cloud infrastructure hosting and transactional email delivery. For security reasons, Helion does not publish the specific identity or location of its infrastructure provider in this public document. Controllers who require this information for their own records of processing activities may request it directly by contacting Helion.

Helion does not currently use any billing provider or AI/LLM sub-processor. Helion will inform the Controller of any intended change to its sub-processors, including any new addition, with reasonable notice, giving the Controller the opportunity to object.

7. Technical and organizational measures

8. International data transfers

Where personal data is transferred outside the Controller's country or the EEA to one of Helion's sub-processors (for example, for transactional email delivery), such transfers are governed by the safeguards available under applicable law, including the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914) where applicable to EEA-originating data.

9. Data retention and deletion

• Analytics events are retained for as long as the Controller's account is active. No maximum retention period is currently enforced. If a retention limit is introduced in the future, all customers will be notified in advance.
• Session replays are retained for 30 days and then permanently deleted.
• The Controller can delete individual projects, all associated data, or their entire account at any time from within the dashboard. Upon account termination, Helion will delete the Controller's data within 30 days unless required by law to retain it longer.

10. Governing law

This DPA is governed by the laws of India, and the courts of Mumbai, Maharashtra shall have exclusive jurisdiction over any dispute arising from it, without prejudice to any mandatory rights the Controller may have under the GDPR or India's Digital Personal Data Protection Act, 2023, as applicable.