This policy describes actual product behavior as implemented. It does not claim statutory compliance, certification, or absolute security. Where law applies depends on staged commencement (India), applicability thresholds (California), and your location and use. See each jurisdiction section below.
1. Who MissionHelm is
MissionHelm AI ("MissionHelm", "we") provides a productivity service for tasks, goals, plans, habits, focus sessions, chats, and calendar-assisted planning at missionhelmai.com. This policy covers our website, applications, and services together ("service").
2. Controller identity
For personal data you add to your own MissionHelm account, MissionHelm acts as the controller (decision-maker about purposes and means), except where a separate Data Processing Agreement designates MissionHelm as processor for customer-provided data. Processor/controller roles are determined per processing activity and contract — not by the mere use of a vendor. Pending external legal review, this designation remains our implemented operating model, not a final legal determination.
3. Contact details
Privacy questions: [email protected]. Security reports: [email protected]. Grievance redressal: see Section 16. We do not designate a statutory Data Protection Officer by merely publishing an email address; if a DPO is legally required it will be appointed and published separately.
4. What data we collect
Identity: email, name, password hash (Argon2, never stored reversibly), authentication/session data, IP, user-agent, security metadata. Profile: country, timezone, locale, currency, profile fields, date of birth where you provide it. Product: tasks, goals, plans, habits, focus sessions, chats, AI decisions, embeddings, calendar data, projects, notes. Billing: subscription, invoice/payment references, transaction IDs, currency, amounts, refunds. Integrations: Google OAuth tokens, scopes, imported calendar items. Support/operations: tickets, feedback, error reports, admin notes, impersonation records. Security: sessions, security events, audit logs, failed-auth logs, rate-limit state. Storage: avatars, uploads, exports, backups. Derived/AI data: embeddings, classifications, recommendations, analytics. Derived data remains personal data where it relates to you.
5. Why we use it (purposes)
Service delivery, account security, payment processing, legal compliance, fraud prevention, customer support, optional analytics, marketing (only with your server-stored preference), AI feature processing you request, and Google integration you connect. We do not treat every purpose as consent — necessity, legal obligation, and consent apply per purpose and jurisdiction. Optional marketing, profiling, and model-improvement processing default to OFF/disconnected.
6. Legal basis by jurisdiction
Global baseline. We provide access, correct, export, delete, restrict, object, withdraw optional consent, opt out of sale/sharing, and limit sensitive use as a product baseline, mapped internally to jurisdiction-specific applicability.
India / DPDP. Privacy controls designed to support the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. The Act/Rules use staged commencement — we distinguish currently in force, scheduled to commence, and voluntary readiness controls, and do not describe a provision as enforceable before it is.
EU / EEA / GDPR. GDPR-ready controls for Articles 12-22 rights (access, rectification, erasure, restriction, portability, objection), generally within one month with permitted extensions for complex cases. Storage limitation, minimisation, accuracy, and accountability apply by design.
California / CCPA as amended by CPRA. California privacy rights supported to the extent applicable. Applicability depends on statutory thresholds — it does not automatically apply to every visitor. Know/delete/correct generally 45 days with a possible 45-day extension after notice; opt-out/limit requests have shorter requirements. We honour opt-out preference signals such as Global Privacy Control where legally required.
7. Retention and deletion
User content is erased promptly on verified deletion, including R2 objects (not just DB pointers), Redis user keys, embeddings, caches, and exports. Payment ledgers, security audit records, fraud records, and backups are retained only as legally required or per defined policy: backups expire by routine overwrite (up to 90 days) and are never restored into production without reapplying deletion controls. We do not promise instant deletion from every backup. Legal holds may temporarily suspend automated deletion and are tightly restricted and audited.
You may revoke a connected Google integration at any time in-product or in your Google account settings. Revocation deletes stored Google tokens, stops future access, and marks synchronized Google-derived data per your integration/deletion policy.
8. Recipients and processors
Hosting/CDN, database, Redis, object storage (R2), email provider, Razorpay (payments), Google (only when you connect), AI providers (only for prompts you initiate), and monitoring/logging. Each transfer is classified as sale, share, service-provider processing, or internal processing. We do not sell personal information; "not selling" is enforced as an invariant and does not automatically mean every disclosure is excluded from "sharing" under California law. Subprocessors, regions, DPA status, transfer mechanisms, and deletion behavior are maintained in our internal processor registry and summarised in the Trust center.
9. Google data
If you connect Google, we request minimum necessary scopes with incremental authorization, persist the exact scopes, consent time, provider, and connected account, display them in Settings → Privacy & Data → Connected apps, and support revoke. We use Google user data only to provide the user-facing features you authorize, never for advertising, and disclose storage, use, and sharing accurately per the Google API Services User Data Policy. MissionHelm remains responsible for its own processing of data obtained through Google APIs.
10. AI data handling
Chat content is personal data. For each AI provider/model we determine what is sent, why, storage duration, training use, region, subprocessors, and deletion support, send only the minimum necessary (never passwords, session tokens, or OAuth secrets), and redact where possible. We never silently use your content for model training. Optional improvement processing is OFF by default with separate disclosure, choice, withdrawal, and version. Embeddings are user-scoped vectors — not anonymous — deleted on account deletion and invalidated on correction. Where we do not use significant-effect automated decision-making we document that; where we do, we provide disclosure, opt-out, human review, explanation, and audit logging.
11. Payments
Payments are processed by Razorpay. We store subscription, order/transaction/payment references, currency, amounts, and refunds — never full card numbers. Payment records needed for legal/accounting obligations survive account deletion in minimal form.
12. International transfers
A database location alone does not determine transfer scope — hosting, AI, email, and analytics providers may process data in other countries. For EU/EEA transfers we use an appropriate Chapter V mechanism such as Standard Contractual Clauses where required. Source/destination regions, categories, mechanisms, contracts, and subprocessors are mapped per processor. We do not claim regional residency until infrastructure truly provides it.
14. Your privacy rights
Access, correct, export (versioned JSON + manifest), delete, restrict, object, withdraw optional consent, opt out of sale/sharing, limit sensitive use, and grievance — via Settings → Privacy & Data or [email protected]. Deadlines follow jurisdiction (GDPR ~1 month; California know/delete/correct 45 days). We verify identity (authenticated session, re-authentication/2FA for sensitive actions, anti-enumeration) and never disclose another person's account existence.
15. How to submit requests
In-product: Settings → Privacy & Data → Requests shows received, verification, processing, and completed states with estimated deadlines, reasons for delay/denial, and appeal channels. Email requests include a secure link to the privacy center — never exported data in the body. Duplicate delete/export requests are idempotent and do not create conflicting state.
16. Grievance redressal
Submit grievances via Settings → Privacy & Data → Complaints or [email protected] with jurisdiction, category, and facts. Each grievance receives an ID, due date, assigned officer, status, response, and resolution timestamp. DPDP grievance rights apply independently of other frameworks.
Grievance contact
For privacy questions, complaints, or grievances, contact the Grievance contact at [email protected]. Response history is available in-product.
17. Security
TLS everywhere (including to DB/Redis/providers where applicable); provider-managed encryption at rest; AES-256-GCM only for stored OAuth tokens and 2FA secrets with separate keys, rotation, authenticated ciphertext, and fail-closed decrypt; Argon2 password hashing (never reversible encryption); HMAC-signed backups for integrity (HMAC is not encryption). We do not promise absolute security and claim no SOC 2 / ISO / HIPAA / PCI certification. Least-privilege admin/support access, audited impersonation with explicit reason and expiry, scoped support views, and privacy-safe logs (minimised IP, redacted headers/cookies/bodies, defined retention) apply.
18. Children
Interim product decision (pending formal age-gating): MissionHelm is intended for adults 18+ only. We do not knowingly allow child accounts. If you believe a child has provided personal information, contact us so we can take appropriate action. The prior "under 13" statement is retired because DPDP child thresholds/protections and GDPR member-state consent ages are materially broader than a COPPA-style rule.
19. Policy changes and contact
Material changes get a new policy version with effective date, previous version, and change summary, notified in-product/by email/appropriate method before taking effect. Consent notices, DPA, cookie, AI, and subprocessor versions are tracked separately. Contact: [email protected] · security: [email protected].