Helixon/Legal

Privacy Policy

How Helixon handles the personal data of candidates, the recruiters who use Helixon, and visitors to this website - in plain English, under UK GDPR and EU GDPR.

Last updated: 1 October 2026Questions: hello@helixon.co.uk

At a glance

Never sold, never used for trainingWe don't sell personal data or use CVs to train AI models.
Stored in SwitzerlandRecognised by the UK and EU as giving adequate protection.
Agencies control candidate dataWe process it only on their instructions.
A person makes the decisionAI scores support recruiters - they don't decide.
Deleted when no longer neededInactive candidates are removed automatically.
Your data, your rightsAccess, correct, delete or move it at any time.

01Who we are

Helixon provides AI-assisted CV screening and recruitment workflow software to recruitment agencies. Where this notice says “we”, it means Helixon.

Helixon is not yet operated through an incorporated company. This section will be updated with our registered company name, number and address once incorporation is complete. Until then, contact us at hello@helixon.co.uk for any privacy query or request.

02Our two roles

Candidate data

Controller: The recruitment agency

When an agency uploads a CV or adds a candidate, the agency decides how that data is used - it is the data controller. We process it on its behalf under our Data Processing Agreement. Candidates should contact the agency about their data; we help agencies answer those requests.

Customers and visitors

Controller: Helixon

For the recruiters and agency staff who use Helixon, and for visitors to this website, we are the data controller. The rest of this notice covers both roles.

See the Data Processing Agreement for our commitments as a processor.

03What data is processed

Candidate dataProcessed for agencies

  • CVs and what they contain: name, contact details, location, employment history, education, skills, and anything else the candidate included
  • The AI assessment of each CV against a role: match score, summary, strengths, concerns and suggested interview questions
  • What recruiters record: pipeline stage, notes, tags, next actions, emails drafted or sent, talent pool details, feedback requests

Customer dataHelixon is controller

  • Account details: name, email address, agency name, role in the team
  • Billing details: plan and payment status (card details are held by Stripe, not us)
  • Usage: analyses run, and which features are used
  • Team presence, where the agency has it switched on: when you have Helixon open and when you last used it, plus any status you set yourself. We never record what you click or type. You can hide your presence at any time and the agency can switch the feature off; either way, what was recorded is deleted.
  • Security data: IP addresses and technical logs used for rate limiting, fraud prevention and fixing errors

Website visitorsHelixon is controller

  • Messages you send to the website chat assistant, and details you give in contact or demo request forms
  • Analytics about how the site is used, only if you accept optional cookies (see our Cookie Policy)

04Why we process it, and our lawful basis

Candidate dataThe agency's lawful basis - usually its legitimate interests in recruiting, or steps at the candidate's request before a contract. We process it only on the agency's documented instructions (Article 28), and agencies confirm they have a lawful basis each time they screen a CV. That confirmation is recorded.
Your account and the servicePerformance of a contract - Article 6(1)(b)
Billing and financial recordsLegal obligation - Article 6(1)(c)
Security, preventing abuse, error monitoringOur legitimate interests in keeping Helixon safe and working - Article 6(1)(f)
Team presenceThe agency's legitimate interest in knowing which colleagues are available - Article 6(1)(f). Records availability only, never activity; each person can hide it and the agency can switch it off.
Answering enquiries and demo requestsOur legitimate interests in responding to you - Article 6(1)(f)
Optional analytics and session replayYour consent - Article 6(1)(a). Withdraw it any time from the cookie banner.

05AI assessments and automated decision-making

Helixon uses AI - Anthropic's Claude models, with Voyage AI embeddings for skill matching - to compare a CV against a role's requirements and produce a match score, summary and suggested questions. The AI is instructed to judge only job-relevant skills and experience, and never to take account of protected characteristics such as age, sex, ethnicity, religion or disability. Agencies can also screen “blind”, which removes names, contact details and employers from what the AI sees.

The assessment supports a recruiter's decision - it isn't the decision. Helixon never makes decisions about candidates solely by automated means, and every report tells the recruiter to review it before acting. A candidate can ask the agency for a person to review how they were assessed, and to explain it.

CVs sometimes contain special category data, such as health information, religion or a photo. It is processed only because it is in the CV; it isn't used for scoring, and agencies should ask candidates not to include it.

06Who we share it with

These providers help us run Helixon. Each is bound by a data processing agreement and none may use the data for its own purposes. We don't sell personal data, and we don't use CV data to train AI models.

AnthropicAI analysis of CVs and job descriptionsUnited States
Voyage AISkill-matching embeddings for CV analysisUnited States
Google (Gemini API)The website chat assistantUnited States
SupabaseDatabase and file storageSwitzerland
VercelApplication hostingUnited States
Upstash (via Vercel)Rate limiting - IP addresses and account ids, kept up to an hourUnited States
ClerkSign-in and accountsUnited States
StripeBilling and paymentsEU / United States
ResendSending emailEU / United States
SentryError monitoring; session replay only with your consentEU (Germany)
PostHogProduct analytics, only with your consentEU

Transfers to the United States are protected as described in the next section.

07International transfers

Our database is in Switzerland, which the UK and EU recognise as giving adequate protection. Where a provider processes data in the United States or another country without an adequacy decision, the transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses (or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework), with additional safeguards such as encryption in transit and at rest.

You can ask us for a copy of the relevant safeguards.

08How long we keep it

Candidate dataEach agency chooses 6, 12, 24 or 36 months (12 by default). Candidates with no activity for that long are deleted automatically, CV files included. Talent pool entries lapse after the same period unless renewed. Everything is deleted 90 days after an agency cancels. Agencies can delete any candidate at any time.
Your accountWhile it's open. If you delete it, your name and presence details are removed from the agency's workspace, and notes or history you wrote show as "Former team member".
Billing recordsSix years, as UK tax law requires.
Team presenceOverwritten as you use Helixon; deleted straight away if you hide it or the agency switches it off.
Website request logsEach request to the site (IP address, browser, approximate location, the page asked for and what our firewall did) is deleted after 90 days at most. Request headers and other detail are cleared within 30 days. We use these logs to keep the service secure and working, not for advertising.
Product feedbackFeedback you give us in the product (survey answers, reasons for cancelling, agreeing to take part in research) is kept for up to two years, then deleted.
Rate-limiting recordsUp to one hour.
Error reportsUp to 90 days.
Website enquiriesUp to two years after our last contact. If you've accepted optional cookies, the questions you ask the chat assistant are kept for up to two years, with email addresses, phone numbers and links removed, to understand what visitors need; otherwise they aren't stored.

09Your rights

AccessCorrectionErasureRestrictionObjectionPortabilityWithdraw consentHuman review of automated decisions

You have the right to access your personal data, to have it corrected or erased, to restrict or object to how it is used, to data portability, and to withdraw consent where we rely on it. You also have the right not to be subject to a decision based solely on automated processing that significantly affects you.

Candidates - contact the agency that holds your data. It is the controller and can export, correct or erase everything it holds about you in Helixon. If you contact us, we'll pass your request to the agency.
Helixon customers and website visitors - contact us at hello@helixon.co.uk. We'll respond within one month.

10Complaints

If you're unhappy with how your data is handled, please contact us first so we can put it right.

You also have the right to complain to the Information Commissioner's Office - ico.org.uk, 0303 123 1113 - or to the data protection authority where you live or work.

11Security

  • Data is encrypted in transit and at rest.
  • Every agency's data is kept separate, and only reachable through checks that the person asking belongs to that agency.
  • Original CV files are held privately and opened only through links that expire after a minute.
  • Access by Helixon staff is limited and logged.

12Changes to this notice

We'll update this notice when how we handle data changes, and tell customers about significant changes by email.

13Contact us

Privacy questions or requests

We reply within one month - usually much sooner.

hello@helixon.co.uk