HelpWire Privacy Policy

In short: We collect what we need to run HelpWire — your account details, billing through Paddle, session metadata, and support conversations. We never record or store what happens on screen during your remote sessions. We don't sell your data. Your clients' data is yours: we process it on your instructions.

This Privacy Policy explains how Electronic Team, Inc. ("we," "us"), a Virginia (USA) corporation at 11890 Sunrise Valley Dr, Ste 111, Reston, VA 20191, handles personal data in connection with HelpWire: the helpwire.app website, the web portal, and the HelpWire applications, including Quick Connect (together, the "Service").

It applies to Operators (people who provide remote support), Clients (people who receive it), website visitors, and anyone who contacts us. Capitalized terms have the meanings given in the HelpWire Terms of Service.

In short: For your account, billing, and our website, we decide how data is used — we're the "controller." For data about your Clients, you decide, and we follow your instructions — we're your "processor."

• We act as a controller (the party that determines the purposes and means of processing) for: Operator account and profile data, billing and subscription records, website and marketing data, support communications, and service usage analytics, and device and session records to the extent we use them to enforce Plan limits and prevent abuse.
  
  
• We act as a processor (a party that processes data only on another's instructions) for personal data that Operators and their Organizations manage in the Service: client directory records, notes, session metadata associated with Clients, and data transmitted during Sessions. The Operator (or their Organization) is the controller of this data.

If you are a Client of someone who uses HelpWire — for example, an IT provider who supports your computer — that provider is responsible for the data they hold about you. Please direct privacy requests about it to them; we will assist them in fulfilling such requests. Requests about data we control (Section 12) can come directly to us.

Account and identity (via Clerk). Sign-in and account management are provided by Clerk, our authentication provider. Clerk holds identity data — email address, name, password credentials or SSO identifiers, MFA settings, and profile photo. HelpWire does not store authentication credentials on its own servers; we do cache limited profile data — your email address, name, and avatar — on our own servers (including an in-memory cache holding account information and granted remote-access permissions) for in-product identification and performance.

Organization and profile data. Organization name and logo, Operator names and photos (shown to Clients during sessions), operator permissions and group assignments.

Billing (via Paddle). Paid Plans are sold by Paddle as merchant of record. Paddle collects and processes your payment details, billing address, and tax information under its own privacy policy. We receive subscription status and order records, and Paddle makes limited payment information — the card brand, last four digits, expiry date, and cardholder name — available to us for subscription management and support; we do not store it, and we never receive your full card number.

Session metadata and device records. When Sessions occur and devices are registered, we record: session start and end times (and duration); IP addresses; device information — operating system name and version, host name, CPU architecture, BIOS UUID, router MAC address, and certain hardware characteristics stored as one-way hashes (storage, CPU, and BIOS details); and connection events. We use device identifiers to recognize devices for unattended access, to enforce Plan limits, and to prevent abuse. For the web portal, we store your last sign-in date and IP address. These records are kept until the related device record or account is deleted.

Chat messages and session events. Chat between Operators and Clients, including the service events shown in the session timeline (for example, "access granted," "connection established"), is stored on our servers for your Organization until you delete the related client or device record, or your account. We process these as processor (Section 2).

Client records you create. Operators may store client contact details, profiles, notes, and group assignments in the web portal. We process these as processor (Section 2).

Client app and Quick Connect. When someone runs the HelpWire Client app or Quick Connect, we collect the device information and session metadata described above and any name or message they enter in the app. We process this data as processor for the Operator's Organization (Section 2).

Support and communications. When you contact support (website forms and portal requests route to support@helpwire.app), your message and contact details are managed in Freshdesk, our helpdesk platform. Website chat is provided by Freshchat. We keep records of support correspondence for as long as needed to handle your request and improve our support, or until the requester asks us to delete them.

Website and product analytics. We use Google Analytics 4, PostHog (including session replay of interactions with our website/portal, heatmaps, and A/B testing; session replay masks text and form inputs so that Client records and other Customer Data are not captured), and our own first-party product telemetry to understand how the Service is used — pages visited, features used, device/browser type, approximate location from IP, and product events. The desktop applications send feature-usage events (for example, display-setting changes, unattended-access installation or revocation, admin-elevation requests) associated with your user account; these are stored in our own database and are not shared with any external analytics provider.

Marketing and sales. If you subscribe to updates or interact with our campaigns, we process your contact details and engagement through SendPulse (marketing email) and HubSpot (sales CRM). We send marketing email only with your consent or, where the law allows, to existing customers about similar services, and every marketing email includes an unsubscribe link. Marketing emails include a tracking pixel and tracked links that tell us whether an email was opened and which links were clicked; you can prevent open tracking by blocking images in your email client. Service and authentication emails are sent from our own mail servers — no external provider is used for service email.

Automatically collected website data. Standard server logs (IP address, request time and URL, browser), cookies and similar technologies (Section 8), Google Tag Manager for tag delivery, Google reCAPTCHA for abuse prevention, and Google Ads and Microsoft Advertising (Bing) pixels for ad measurement.

• We do not record or store the audiovisual content of remote Sessions — what appears on screen and keyboard/mouse activity pass between the Operator and Client, end-to-end encrypted between the Operator and Client applications, and are not retained by us.
  
  
• Files and clipboard content transferred during Sessions are never stored on our servers.
  
  
• Relay servers, used when a direct connection is not possible, forward encrypted traffic only — they do not decrypt it or access the content of Sessions.
  
  
• To be clear about the boundary: session content (screen, input, files, clipboard) is never stored; session communication records — chat messages and session events — are stored for your Organization, as described in Section 3.
  
  
• We do not sell personal data, and we do not serve third-party advertising inside the Service.

We use personal data to: provide and operate the Service (contract performance, GDPR Art. 6(1)(b)); authenticate users and secure the Service, prevent fraud and abuse (legitimate interests, Art. 6(1)(f), and legal obligation where applicable); process subscriptions and payments through Paddle (contract); provide support (contract); analyze and improve the Service (legitimate interests); send marketing communications (consent, Art. 6(1)(a) — withdrawable at any time; or, for existing customers where the law allows, legitimate interests, Art. 6(1)(f)); and comply with legal obligations (Art. 6(1)(c)). Where we rely on legitimate interests, you can object as described in Section 12.

In short: We share data with the service providers that run parts of HelpWire — not for their own advertising (other than the advertising-measurement providers described in Section 7), and we list them all here.

We share personal data only with: (a) the providers below; (b) your Organization (owners see Organization data; Operators see the client groups they've been given access to); (c) authorities where legally required; and (d) a successor entity in a corporate transaction (Section 14).

All other infrastructure is operated by us directly: no external CDN/WAF, crash-reporting, monitoring, relay (STUN/TURN), or analytics-warehouse providers are used. Billing and receipt emails are sent by Paddle as merchant of record.

We maintain this list at https://www.helpwire.app/legal/subprocessors/ and will notify Organization owners by email at least 14 days before adding or replacing subprocessors that process Client data on Operators' behalf.

We advertise HelpWire through Google Ads and Microsoft Advertising and measure campaign performance with their tools and pixels. This may involve cookies or identifiers that these providers link across sites under their own policies. California law treats this as "sharing" personal information for cross-context behavioral advertising, and some other U.S. state laws treat it as targeted advertising. We do not provide the Service or website as an advertising platform for third parties, and we do not share Operator or Client service data with advertisers. You can block or delete these cookies in your browser (Section 8) and turn off interest-based advertising in your Google and Microsoft ad settings.

We use cookies and similar technologies (pixels and local storage) on helpwire.app and in the web portal for: essential operation (sign-in, security, abuse prevention with Google reCAPTCHA, and remembering your preferences); analytics (Google Analytics 4 and PostHog); and advertising measurement (Google Ads and Microsoft Advertising pixels, delivered through Google Tag Manager). The analytics and advertising providers may link these identifiers across sites under their own policies (Section 7).

Our cookie banner currently tells visitors that we use cookies, but it does not yet let you choose which cookies are set, so analytics and advertising cookies are set when you visit. We are introducing a consent tool that will let you accept or decline non-essential cookies, and when it is live we will publish a detailed Cookie Policy and update this section.

Until then, you can control cookies in your browser settings: you can block or delete them, although blocking essential cookies will prevent sign-in from working. You can opt out of Google Analytics across all sites with Google's browser add-on, and manage ad personalization in your Google and Microsoft account settings. Because there is no common standard for browser "Do Not Track" signals, we do not respond to them.

We are a US company. Our production servers are located in California, USA (AWS us-west-1); session relay servers operate in 12 AWS regions worldwide (EU, UK, US, Canada, Brazil, India, Japan, Australia), carrying only end-to-end-encrypted session traffic. Personal data is otherwise processed in the countries where our providers operate. Where we transfer personal data from the EU/EEA, UK, or Switzerland to countries without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses ("SCCs" — contract terms pre-approved by EU regulators) and, for providers certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, that certification. Our subprocessor list identifies the mechanism we rely on for each provider. You may request a copy of the relevant safeguards via the contact in Section 16.

In short: We keep data while your account is active. Deleting your account removes your data from production immediately; a few records outlive it for the limited periods shown below, because the law requires it, because they sit with Paddle, or for the operational reasons shown below.

Account deletion is self-service in the web portal and is immediate and irreversible for the data we control in production; backup snapshots containing deleted data expire within 7 days. Deletion does not reach data your Operator (as controller) holds about you elsewhere, or records Paddle must keep independently, or our support correspondence and server logs, which follow the periods above.

Session content (screen, input, clipboard, and transferred files) is end-to-end encrypted between the Operator and Client applications using TLS 1.3 with AES-256-GCM — it is not decrypted by relay servers or any other HelpWire infrastructure. Chat and service traffic between the applications and our servers is encrypted in transit with the same protocols and is decrypted only on our central servers. Connections are peer-to-peer by default; relay servers, used only as fallback, forward encrypted traffic without storing or decrypting it. Additional measures include: authentication with optional MFA for user accounts through Clerk; DigiCert code signing of all HelpWire applications; access to personal data limited to personnel who need it to perform their duties, with internal services accessible only over our corporate VPN behind an additional authentication layer and all service accounts credential-protected; and encrypted backup snapshots retained for a maximum of 7 days. No internet service can guarantee absolute security; if we learn of a breach affecting your personal data, we will notify you and regulators as required by law. If you believe you have found a security vulnerability in the Service, please report it to support@helpwire.app.

In short: You can access, correct, delete, and take away your data, and object to some uses. It's free, and we don't punish you for asking.

Everyone. Regardless of where you live, you can access and correct your account data in the web portal, delete your account (Section 10), and unsubscribe from marketing at any time.

EU/EEA, UK, and Swiss residents (GDPR, UK GDPR, and Swiss FADP). You have the right to: access your personal data and get a copy; rectify inaccurate data; erasure; restriction of processing; data portability (a machine-readable copy); object to processing based on legitimate interests, including profiling; object to direct marketing (absolute — we stop immediately); withdraw consent at any time without affecting prior processing; and lodge a complaint with your supervisory authority. We do not make decisions with legal or similarly significant effects based solely on automated processing.

California residents (CCPA/CPRA). You have the right to: know what personal information we collect, use, and disclose; access it; correct it; delete it; and not be discriminated against for exercising your rights. We do not sell personal information. Our use of advertising-measurement cookies (Section 7) constitutes "sharing" for cross-context behavioral advertising under the CPRA. Until our consent tool is live, you can limit it by blocking cookies in your browser or turning off ad personalization in your Google and Microsoft account settings (Sections 7 and 8). The consent tool will add an opt-out control and support for Global Privacy Control signals, and we will update this Policy when it is live. Authorized agents may submit requests on your behalf with proof of authorization.

Notice at collection for California residents. In the preceding 12 months, we collected these categories of personal information: identifiers (name, email address, IP address, device identifiers); commercial information (subscription and order records); internet or other network activity (website, portal, and product usage, and session metadata); approximate geolocation derived from IP address; professional information you provide about your Organization and role; the contents of your support communications; and sensitive personal information limited to account log-in credentials, which are held by Clerk and used only to authenticate you. We collect these categories from you, from your devices and use of the Service, and from Clerk and Paddle, for the purposes in Section 5, and keep them for the periods in Section 10. We disclosed identifiers, commercial information, and internet activity to our service providers for business purposes, and shared identifiers and internet activity with Google and Microsoft for advertising measurement. We do not sell personal information, do not knowingly sell or share the personal information of consumers under 16, and do not use or disclose sensitive personal information for purposes that would require a right to limit.

Virginia residents (VCDPA). You have the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, and significant profiling. We do not sell personal data. If we decline a request, you may appeal by replying to our decision or writing to the contact in Section 16 marked "Appeal"; we respond to appeals within 60 days, and if we deny your appeal, you may contact the Virginia Attorney General.

Residents of other U.S. states. If you live in another state with a comprehensive privacy law (for example, Colorado, Connecticut, Texas, or Oregon), you have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising and sale, and you can exercise them in the same way. If we decline a request, you may appeal using the process described above for Virginia residents.

How to exercise rights. Email dpo@electronic.us or use the contacts in Section 16. We verify requests using your account email and respond within one month (GDPR) or 45 days (CCPA/VCDPA), extendable once where the law allows; we'll tell you if we need longer. If your request concerns data an Operator holds about you as their Client, we will refer you to them and assist them (Section 2).

HelpWire is not directed to children, and you must be 18 to create an account. We do not knowingly collect personal data from children under 13 (or the higher age applicable under local law, such as 16 in parts of the EU). A child may appear as the user of a device receiving support arranged by an adult — for example, a parent's or school's device; in that case the Operator, as controller, is responsible for the lawfulness of that support. If you believe we hold personal data collected directly from a child, contact us and we will delete it.

If Electronic Team is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the successor. We will notify you before your personal data becomes subject to a materially different privacy policy, and you will have the opportunity to object or delete your account.

We may update this Policy. Material changes will be announced by email and/or a portal notice at least 30 days before taking effect; minor changes are posted with an updated "Last updated" date. We will not use previously collected data in ways materially inconsistent with the policy in effect when it was collected without your consent.

Electronic Team, Inc., 11890 Sunrise Valley Dr, Ste 111, Reston, VA 20191, USA · +1 202 335 8465

• Privacy contact: dpo@electronic.us
  
• Support: support@helpwire.app
  
• General: support@helpwire.app · feedback@helpwire.app

EU/EEA residents may complain to their local supervisory authority, UK residents to the Information Commissioner's Office, and Swiss residents to the Federal Data Protection and Information Commissioner; Virginia residents may contact the Virginia Attorney General.