Privacy Policy

This Privacy Policy explains how Sierra Sounds LLC, doing business as Helm (“Sierra Sounds,” “Helm,” “we,” “us”), collects, uses, and shares information when you use helmos.co and related services (the “Service”).

1. Information we collect

You give us:

• Account info: your email address and password (stored hashed).
• Your artist data: the Spotify artist URL/ID you connect, plus anything you tell Helm during onboarding (location, genre, story).
• Content you create with Helm: bios, one-sheets, press releases, upcoming shows, social links, song-link entries, EPK details, outreach drafts, and chat messages.
• Outreach activity: the contacts you reach out to (name, email, outlet), the pitches sent, and replies received at your yourartist@helmos.co alias.
• Support messages you send us.

We get from third parties:

• Spotify Web API: public artist profile (name, image, top tracks, releases, monthly listeners) for the artist URL you connect.
• Stripe: subscription status and limited billing metadata. We don't store full card numbers — Stripe handles that.
• Hunter.io: publicly-available, business-contact information about journalists, venues, and similar professional contacts that Helm presents and verifies on your behalf.

We collect automatically:

• Usage data: pages visited, features used, approximate device/browser info, and similar product analytics (via Vercel Web Analytics — designed to be privacy-friendly and cookie-less).
• Server logs: IP address, timestamps, and request details when our servers handle a request.
• Session cookies: a single first-party cookie that keeps you logged in.

2. How we use information

• To provide, secure, and improve Helm — including running AI features and sending outreach on your authorized behalf.
• To process payments and handle subscription lifecycle.
• To send transactional emails (password reset, billing receipts, inbound-mail notifications, support replies).
• To analyze aggregate usage so we can make the product better.
• To detect, prevent, and respond to abuse, fraud, and legal/safety risks.
• To comply with law and enforce our Terms of Service.

We do not sell your personal information. We don't use your content to train third-party AI models, and we don't share it with advertisers.

3. Who we share with (subprocessors)

Helm runs on a small number of carefully chosen vendors. Each handles a specific job:

• Anthropic — runs the AI models that draft bios, pitches, and so on. Per Anthropic's API terms, your inputs are not used to train their public models.
• Stripe — payment processing.
• Resend — sends and receives email from helmos.co (including outreach you authorize and replies routed back to your dashboard inbox).
• Spotify — read-only access to public artist data.
• Hunter.io — contact discovery and email-address verification.
• Vercel — hosting and edge networking; also product analytics.
• Upstash (Redis) — our primary data store for accounts and content.
• GoDaddy — DNS for helmos.co.

We may also share information when required by law, to comply with legal process, to protect users or the public, or in connection with a sale or transfer of our business (in which case the acquirer must honor this Policy).

4. International transfers

Our servers and subprocessors are based in the United States and other countries. If you're outside the U.S., your information will be transferred to and processed in the U.S. We rely on standard contractual clauses or equivalent safeguards where required.

5. How long we keep your information

We keep your account and content while your account is active. If you cancel, we keep limited information as needed for billing records, fraud prevention, or legal obligations (typically up to 7 years for tax/accounting). You can request earlier deletion (see Your Rights below); we'll honor it except where law requires retention.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict our use of your personal data — and to object to certain uses. To exercise any of these, email support@helmos.co.

We'll respond within 30 days. We don't charge for routine requests. We may need to verify your identity before acting on a request.

7. Security

We use industry-standard practices to protect your data — HTTPS everywhere, hashed passwords (PBKDF2), signed session cookies, environment-isolated secrets, and access controls on our infrastructure. No service is 100% secure; if you believe your account has been compromised, email support@helmos.co immediately.

8. Children

Helm isn't intended for anyone under 16. If you believe a child has provided us personal information, contact support@helmos.co and we'll delete it.

9. AI-specific disclosures

• Conversations with Helm's chat and content-generation features are sent to Anthropic's API to produce a response.
• Generated drafts and chat history are stored in your account so you can review and reuse them.
• AI output can be wrong, biased, outdated, or non-original. You're responsible for reviewing it before sending or publishing.
• We don't use your data to train our own models, and our AI provider has agreed not to train on your inputs by default.

10. Cookies

We use a single, essential, first-party session cookie to keep you signed in. Our analytics provider (Vercel) is designed to be cookie-less and privacy-preserving. If we add additional cookies in the future (e.g. preference cookies), we'll update this Policy and present a choice where required.

11. Changes to this Policy

We'll update this Policy from time to time. The “Effective” date at the top reflects the last change. For material changes we'll give reasonable advance notice (email, dashboard banner, or both).

12. Contact

For privacy questions, requests, or complaints: support@helmos.co.
Sierra Sounds LLC, doing business as Helm, operates the Service at helmos.co.