Effective Date: 27.3.2026
Last Updated: 27.3.2026
This Privacy Policy describes how Duer Oy (business ID: 3471255-9) ("Duer", "we", "us", "our") processes personal data in connection with the Helmi service, including related websites, applications, and connected functionality (the "Service").
This Privacy Policy applies to personal data processed when you browse or otherwise use the Service, including public websites and pre-account website features, create an account, submit an early access or waitlist application, subscribe to changelog or product update emails, purchase a subscription, upload or generate content through the Service, contact support, or otherwise interact with us in relation to the Service.
For personal data relating to account management, billing, customer communications, and general operation of the Service, Duer Oy is generally the data controller unless otherwise stated in a separate agreement or required by applicable law.
If you use the Service on behalf of an organization, that organization may act as the data controller for personal data included in User Content, and Duer may process such data on the organization's behalf where applicable. Further details may be set out in a separate data processing agreement.
We may obtain personal data:
Depending on how you use the Service, we may process the following categories of personal data:
We may process personal data for the following purposes:
Where required under applicable law, we rely on one or more of the following legal bases:
Where we rely on legitimate interests, you have the right to object to such processing as described in Section 8.
Depending on the context, we may rely on different legal bases for different Service features. For example, we may process early access or waitlist application data based on legitimate interests and/or steps taken at your request before entering into a contract, use technical and security data for fraud prevention and service protection based on legitimate interests, use strictly necessary cookies or browser storage to operate website features, and rely on consent for changelog or product update emails and for non-essential cookies or similar technologies where consent is required by law.
We may share personal data with the following categories of recipients where necessary to operate the Service or comply with law:
These recipients may process personal data on our behalf or, in some cases, as independent controllers under their own terms and privacy notices. The specific providers we use may change from time to time as the Service evolves, and references to named providers in this Privacy Policy are intended to improve transparency rather than to serve as an exhaustive list of all vendors we may engage.
Personal data may be processed outside your country of residence, including outside the European Economic Area, where this is necessary to provide the Service.
This may include transfers connected with cloud infrastructure, authentication, billing, customer support, security operations, or AI processing features that rely on third-party providers operating in multiple jurisdictions, including the United States and other countries outside the EEA.
Depending on the feature used, some processing may occur within the EEA while other processing may involve providers operating outside the EEA. Where required, we use appropriate safeguards for such transfers, such as Standard Contractual Clauses or other lawful transfer mechanisms recognized under applicable law.
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
In general:
When personal data is no longer needed, we may delete it, anonymize it, or retain limited records where reasonably necessary for security, compliance, dispute resolution, enforcement, backup integrity, local synchronization integrity, or legal recordkeeping purposes.
Subject to applicable law, you may have the right to:
We will assess requests in accordance with applicable law. Some rights are limited and may not apply in all situations.
Where we send changelog or other product update emails based on consent, you may also withdraw that consent at any time. Once such communications are enabled, we expect to provide an unsubscribe mechanism in the relevant messages or through other contact channels we make available.
Where required by applicable law, we will respond to rights requests without undue delay and within the time required by law, subject to any lawful extensions or limitations.
To exercise your rights, you may contact us through the support or contact channels made available on our website or in the Service. We may request information necessary to verify your identity before processing a request. We may also refuse or limit a request where permitted by applicable law, including where the request is manifestly unfounded, excessive, would adversely affect the rights of others, or would require disclosure of protected confidential information beyond what the law requires.
If you believe that our processing of your personal data violates applicable law, you also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto). More information is available at www.tietosuoja.fi.
The Service may provide features that allow you to export certain User Content and user-facing outputs, such as videos and other materials made available to you in the Service.
Your rights under applicable data protection law do not automatically mean that we must disclose all internal data, systems, or analysis connected to your use of the Service.
Except as required by applicable law, access and portability rights do not obligate us to disclose:
Where required by law, we will provide access to personal data relating to you and, where applicable, data portability in a manner that takes into account our legal obligations and legitimate rights, including protection of confidential business information and the rights of others.
The Service uses AI systems and other automated processing tools to support user-requested workflows, including conversational assistance, video analysis, and edit assistance features that may combine AI and media analysis technologies.
When you use these features, prompts, uploaded or imported content, generated outputs, and related metadata may be processed by Duer and by third-party AI providers engaged by us to provide the requested functionality. This processing may be necessary, for example, to:
We do not use your User Content or generated outputs to train our own AI models. When engaging third-party AI providers, we use commercially reasonable efforts to select providers, service tiers, or configurations that prohibit the use of your data for training their foundational models. These providers may nonetheless process your data as necessary to deliver the requested feature, subject to their applicable legal and contractual obligations.
AI-related processing may involve providers operating in multiple jurisdictions, including outside the EEA. See Section 6 for more information on international transfers and safeguards.
These features are designed to assist you in creating, editing, organizing, or analyzing content. They do not make automated decisions that produce legal effects or similarly significant effects concerning you. In particular, AI-assisted video edits or workflow actions triggered from your prompts are treated as user-initiated assistive product behavior rather than legally significant automated decision-making.
You may request deletion of your personal data, subject to applicable law. This right is part of the rights described in Section 8.
Deletion does not necessarily require immediate removal of all related internal records where retention is reasonably necessary for legal compliance, security, fraud prevention, dispute resolution, enforcement, backup integrity, or other legitimate purposes permitted by law.
The Service is not intended for children under the minimum age specified in our Terms of Service. If we become aware that personal data has been collected from a child in violation of applicable law or our service rules, we may delete the data, suspend the account, or take other appropriate action.
If you access the Service through a website or web application, we may use cookies, browser storage, or similar technologies that are necessary to operate the Service, maintain sessions, preserve navigation state, remember preferences, improve performance, and measure usage. This may include, for example, browser session storage or similar mechanisms used to support website functionality.
If you use a mobile or desktop application, the Service may also use local device storage, caches, saved preferences, synchronization state, or similar technologies to support app functionality, performance, offline continuity, exports, and security.
Necessary cookies — These cookies are required for the Service to function and cannot be disabled.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| __session | Helmi (first-party) | Maintains your authenticated session | Session |
| cookie_consent | Helmi (first-party) | Stores your cookie consent preferences | 1 year |
Analytics cookies — These cookies help us understand how visitors use the Service so we can improve it. They are only set after you grant consent.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique users | 2 years |
| _ga_<container-id> | Google Analytics | Maintains session state | 2 years |
We use Google Analytics 4 to collect aggregated, anonymized usage data such as page views, session duration, and general geographic region. Google Analytics processes this data on our behalf under its data processing terms. You can learn more about how Google uses data at policies.google.com/technologies/partner-sites.
Where required by applicable law, we will request consent before using non-essential cookies or similar technologies. You can manage your cookie preferences at any time through the cookie settings link available in the website footer. This Privacy Policy is intended to serve as the primary source of information about the cookies, browser storage, and similar technologies we use in connection with the Service.
We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure.
Where required by applicable law, we will notify the relevant supervisory authority and affected individuals of certain personal data breaches within the time required by law.
We may update this Privacy Policy from time to time. Material changes may be communicated through the Service, by email, or by other appropriate means.
If you have questions about this Privacy Policy or wish to exercise your rights, you may contact us using the details below:
Duer Oy
Metsänhoitajankatu 4 d 45
00790 Helsinki, Finland
Business ID: 3471255-9
General contact: hello@helmi.ai
Privacy contact: privacy@helmi.ai
This Privacy Policy was last updated on 27.3.2026.