HELFERLAINHELFERLAIN
Start free trial

Privacy

Privacy Notice

Last updated · 2026-10-18

Helferlain is a trademark of Kompetenz Int. Consulting GmbH (HRB 18104, Local Court of Nuremberg). We process personal data on the legal bases set out in Article 6 GDPR. This notice summarises what we collect, why, and how to exercise your rights.

1. Who we are

Helferlain is operated by Kompetenz Int. Consulting GmbH, Fliederstr. 8, 90530 Wendelstein, Germany (Imprint: /legal/imprint). Contact for privacy and support questions: [email protected].

2. What we collect

  • Account — name, email, workspace name, locale, role. Basis: Art. 6(1)(b) — contract.
  • Authentication — sessions, OAuth provider IDs, the IP address and browser identifier (user agent) of each session. Basis: Art. 6(1)(b) and (f) — securing the account.
  • Connected accounts — OAuth tokens for Google Ads, Google Analytics 4, Google Search Console and Bigin. Tokens are encrypted at rest (AES-256-GCM envelope encryption with a key per workspace) and never written to logs. Basis: Art. 6(1)(b).
  • Account and campaign data — metrics and structure of the connected accounts, as far as needed for audits and recommendations, plus the findings and recommendations derived from them. Basis: Art. 6(1)(b).
  • Audit log — actions in your workspace, in particular changes to connected ad accounts. Basis: Art. 6(1)(b) and (f) — traceability.
  • Your own AI keys (BYOK, optional) — encrypted like the OAuth tokens and decrypted only at the moment of a request.

3. Where we host

The web app and the MCP gateway run on Cloudflare (a US provider with a global data-centre network); the database runs on Neon in AWS region eu-central-1 (Frankfurt). The full list of sub-processors is at /legal/sub-processors.

4. AI processing

Helferlain uses AI models to produce audits, recommendations and chat answers. For this, your inputs and the metrics and structure of your connected accounts are sent to the AI provider.

  • Without your own key, Helferlain uses its own access to Anthropic (USA). Anthropic then acts as our sub-processor.
  • With your own key (BYOK), requests are sent from our servers to the provider you chose (Anthropic, OpenAI or Google) using your key; your own contract with that provider governs the processing.

5. Google user data

Helferlain's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request only these Google permissions:

  • Sign in with Google — openid, email, profile: name, email address and profile picture to create and secure your account.
  • Google Ads — https://www.googleapis.com/auth/adwords: read campaigns, metrics and account structure for audits and recommendations, and — only after you approve a specific change — apply it to your account.
  • Google Analytics 4 — https://www.googleapis.com/auth/analytics.readonly: read-only access to reports for cross-source analysis.
  • Google Search Console — https://www.googleapis.com/auth/webmasters.readonly: read-only access to search queries and pages for cross-source analysis.
  • Google account email — https://www.googleapis.com/auth/userinfo.email: to show which Google account is connected.

For data received through these permissions:

  • We use it only to provide and improve the features you see in Helferlain (audits, recommendations, chat, changes you approve).
  • We transfer it only to the sub-processors listed for providing these features (for example the AI provider for the analysis), for security purposes, to comply with applicable law, or as part of a merger or acquisition with your prior consent.
  • We do not sell it and do not use it for advertising, retargeting or profiling.
  • No human reads it unless you have agreed to it for a specific case (e.g. a support request), it is necessary for security purposes, or the law requires it.
  • We do not use it to develop, improve or train generalised AI models.

You can revoke access at any time in your Google account settings (myaccount.google.com/permissions) or by deleting your workspace.

6. Your rights

Under GDPR Articles 15, 16, 17, 18, 20, 21 you may request access, rectification, erasure, restriction, portability or object to processing. Under Settings → Privacy you can export your data and delete a workspace you own; for everything else, email us. We respond within one month.

7. Retention and deletion

  • Deleting a workspace (owner, Settings → Privacy) immediately destroys the workspace key. OAuth tokens, stored AI keys and other encrypted content become unrecoverable at that moment. The workspace and its connections are marked as deleted immediately and can no longer be used.
  • Unencrypted records (account data, audit log, cached account and campaign data, findings) are currently not deleted automatically. We delete them on request — email us.
  • Cancelling a subscription does not delete any data.
  • Invoices are kept for the statutory retention periods (German commercial and tax law).

8. International transfers

Cloudflare, Anthropic, Voyage AI, Inngest, Resend and Stripe, Inc. are based in the USA; Serper.dev processes outside the EU/EEA. These transfers rely on EU Standard Contractual Clauses (Art. 46 GDPR) or, where the provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR).

9. Cookies

See our cookie banner (re-openable via the footer link) and sub-processor list.

10. Complaints

You may lodge a complaint with the supervisory authority of your EU member state, or with the Bavarian State Office for Data Protection Supervision (BayLDA), the competent authority for Kompetenz Int. Consulting GmbH (Wendelstein, Bavaria).