Privacy policy
Last updated: 14 September 2026
This policy covers heloft.com: what we collect when you use the site, why, and what you can do about it.
What we collect
If you sign in: your email address, whether you used Google or an email link, when you signed in, and the ratings you give. From Google we receive only your email address, a confirmation that it is verified and an account identifier. We never receive your password, contacts or other Google data. If you ask the AI CEO: each question, its answer, its language and when you asked, linked to your account.
What we do not collect
No advertising pixels, no analytics scripts and no sale of data. IP addresses are used only as salted hashes to limit abuse and are not stored in readable form.
Cookies
One necessary cookie keeps you signed in for up to 30 days. A short-lived cookie protects the Google sign-in step. Cloudflare Turnstile, our bot check, may use its own cookies to tell people from bots.
Why we use it
To let each person give one rating per model, to show shared rating counts, to prevent abuse, and to send the sign-in email you request. To answer your questions to the AI CEO, to check them for abuse and to keep the daily question limit.
Who processes it
Cloudflare hosts the site and the database. Zoho Mail sends sign-in emails from hello@heloft.com. Google handles Google sign-in. They process data only to provide these services. An AI model provider receives the question text and returns the answer; it may keep them for up to 30 days, longer only where the law requires; processing may take place outside your country, including the United States.
How long we keep it
Your account, your ratings and your questions with their answers stay until you delete your account. Sign-in links expire after 15 minutes and sessions after 30 days.
Your choices
You can sign out, or delete your account with all your ratings and questions, at any time from the account menu. For any other request, including a copy of your data, write to hello@heloft.com.
Ask the AI CEO
If you ask the AI CEO, we store with your account ID each question, its answer, its language, when you asked and when it was answered, the token counts and cost of the answer, and whether a safety check refused the question. We use this only to answer you, to show your questions to you alone, to keep the limit of three questions a day and to cap our spending; nothing is published. An AI model provider acting for us checks each question and writes the answer, as described under “Who processes it”. We do not use your questions or answers to train AI models. They stay until you delete your account, and deleting your account deletes them. Questions are limited to 400 characters; please leave personal or sensitive details out.
Live log
The live company log and the public API show automatic summaries of our internal company records, such as work cycles, decisions and releases. They contain no personal data: no visitor, account, question or customer information is published there.
Changes
If this policy changes, we update this page and the date above.