/ Legal — Privacy

Privacy Policy

Privacy Policy — Helix (FDE Labs)

> DRAFT — for attorney review. Not legal advice. Generated from FDE's own trust docs + D44 + register. > > This is a first draft produced from the product's actual behavior and internal governance > records (the adversarial pre-pilot sweep, decision `D44`, and the decision register). It is > intended to be refined by counsel before publication. Every place requiring a legal judgment > call is tagged inline [ATTORNEY]; every place requiring a factual re-confirmation against > an executed contract or live config is tagged [VERIFY].

Product: Helix, an early-access sales conversation-intelligence service operated by FDE Labs ("Helix," "we," "us"). Last updated: DRAFT — not yet effective. [ATTORNEY] — set the effective date and the legal entity name/form (e.g., "FDE Labs, Inc." / LLC) and registered address at publication.

1. Scope

This policy describes how Helix handles data when a customer organization uploads sales-call transcripts to the service and receives derived analysis. It covers the customer's account and end-user data (the reps and administrators in a customer workspace) and the call-content data they submit.

Roles. For the call-content our customers upload, the customer organization is the controller and Helix acts as a processor / service provider on the customer's behalf. For the account data of the individual users who log in, Helix acts as a controller. [ATTORNEY] — confirm the controller/processor (and GDPR / CCPA "service provider") framing and whether a separate Data Processing Addendum is required for design partners; align with the Early-Access Addendum.

2. What we collect

2.1 Data you upload (call content)

When a customer uploads a call, Helix ingests and stores:

Transcript text — the verbatim utterances of the conversation, segmented by speaker.
Speaker / participant identifiers present in the uploaded file — participant display names

and, where present in the source, participant email addresses.

Call metadata — the call title, recorded-at date, and duration as provided in the upload.
Account and deal context — the vendor (seller) and customer (buyer) company names and the

deal the call is associated with, as supplied by the uploading organization.

Helix does not capture live audio or video and does not perform real-time or streaming capture. All ingestion is post-call, transcript-in: the customer submits an already-produced transcript file. [VERIFY] — the primary uploaded-file path is the live ingest path today; the webhook (MeetingBaas/Recall.ai) on-ramp is present in code but not enabled in production (adversarial sweep P2). Describe only the on-ramps actually enabled at launch.

2.2 Data we derive (analysis)

From the uploaded transcript, Helix generates and stores derived analysis, including:

MEDDPICC extraction — a structured breakdown of the deal against the MEDDPICC qualification

fields, with supporting quotes and timestamps drawn from the transcript.

Competency scoring — an evaluation of the seller's performance against a sales-competency

rubric.

Deal fingerprints / deal-arc synthesis — a rolled-up, deal-level synthesis produced across a

deal's call history.

Interactive analysis ("dialogue") — answers to questions a user asks about their own deals,

generated only over that user's organization-scoped corpus.

Derived analysis is produced by submitting transcript content to a large-language-model processor (see §4). Derived analysis can and does contain excerpts of, and inferences drawn from, the underlying transcript.

2.3 Account and operational data

User account data — the authenticated user's identity (via our authentication provider),

their organization membership, and their role/seat (e.g., rep, manager).

Usage and billing metadata — an append-only ledger of processing/usage events and metering

data used to enforce allowances and (where applicable) billing.

Early-access request data — if you request access via our landing page, the email address

and any details you submit, used to contact you about access. [VERIFY] — the request-access endpoint currently emails the operator via our email provider; confirm what is stored vs. only emailed, and note that this endpoint is not rate-limited today (sweep P1) — counsel may want a security/abuse note.

We do not sell personal information and do not build advertising profiles. [ATTORNEY] — confirm the "we do not sell / share" statement satisfies CCPA/CPRA "sale"/"share" definitions and add any required "Do Not Sell or Share" mechanism if the definition is triggered.

3. How we use the data

To provide the service: parse the transcript, generate the derived analysis, and display it in

the customer's workspace.

To enforce usage allowances and protect service integrity (metering, throttling, abuse controls).
To operate, secure, debug, and improve the service. [ATTORNEY] — decide whether "improve the

service" includes any use of customer content beyond serving that customer (e.g., rubric calibration). Note internally that a real-name calibration store exists by deliberate decision (D44) but is access-fenced and never reachable from another customer's or a demo surface; counsel should decide what, if anything, is disclosed here and whether design-partner consent is needed. See §7.

To communicate with you (transactional and concierge/onboarding email).

We do not use customer call content for advertising or for training our own or third parties' general-purpose models (see §4).

4. Subprocessors

Helix relies on the following subprocessors. Each receives only the data needed for its function.

No training on customer data. Customer content that Helix submits to the Anthropic API is not used to train Anthropic's models. This reflects Anthropic's commercial/API terms, under which inputs and outputs submitted through the API are not used to train Anthropic's models. [ATTORNEY] — verify this statement against our specific executed Anthropic agreement (commercial/API terms and any zero-retention or enterprise addendum), including any input/output retention window Anthropic applies for abuse-monitoring, and confirm that no other subprocessor listed above trains models on the data. Do not publish the affirmative no-training statement until this is confirmed against the signed agreement.

[ATTORNEY] — decide whether to publish a maintained public subprocessor list with a change-notification commitment (common for a DPA), and the notice period for adding subprocessors.

[VERIFY] — confirm the processing/hosting regions of each subprocessor (data residency) and state them if the customer base or a design partner requires a residency commitment. The current product makes no region guarantee.

5. Consent for recording the underlying calls

Helix processes transcripts that the customer uploads. Responsibility for lawfully recording, transcribing, and obtaining any required consent for the underlying conversations — including two-party / all-party consent where the participants' jurisdictions require it — rests with the uploading customer, not with Helix. By uploading a transcript, the customer represents that it had the right to record and to share that content with Helix and its subprocessors. [ATTORNEY] — confirm this consent-shifting representation is enforceable and sufficient, and whether it should be mirrored as a warranty in the Terms of Service / DPA rather than (or in addition to) here.

6. Security and tenant isolation

Per-organization isolation. Data is scoped to the owning organization. The database enforces

Row-Level Security (RLS) so that a customer's data is only accessible within that customer's organization, and the ingest/service paths additionally filter every read and write by organization id.

Isolation was adversarially tested. In a pre-pilot adversarial sweep (2026-08-04), an attempt

to read across tenants via the interactive analysis path was not reproducible — query scope is always derived from the authenticated session, a cross-organization identifier returns not-found, and concurrent writes to separate organizations' usage ledgers summed per-organization with zero cross-tenant bleed. Authentication walls held on protected routes.

[ATTORNEY] — any security assurance to customers is a representation with legal weight. Soften or qualify these statements as counsel requires (e.g., "designed to," "commercially reasonable measures," no guarantee of absolute security), and confirm we do not overstate. The adversarial sweep is an internal, point-in-time test — not a certification (e.g., SOC 2). Do not imply a certification we do not hold. See also the Terms of Service disclaimer of warranties.

7. Data retention and deletion

Retention posture (per D44). Helix's standing rule is that a retention and anonymization decision is made for every ingested dataset _before_ it is ingested — retain, pseudonymize, or drop — so that personal data does not accrete into the service without a decided posture. This is a deliberate policy choice: real personal data is bounded by decision at the point of ingest rather than left to accumulate indefinitely.

Customer call content is retained for the duration of the customer's active use of the service

so the customer can view and query their deals, unless the customer requests earlier deletion or a shorter retention term is agreed. [ATTORNEY] — D44 sets a _pre-ingest decision_ discipline but does not fix a single numeric default retention period; this is the explicit customer-data-retention question D44 raised and left to be answered per engagement. Counsel/owner must set the published default retention term (and any post-termination deletion window) here. Until set, state the conservative default actually operated: content is retained while the account is active and deleted on request or on termination (see §8 and the Terms of Service).

Calibration/evaluation data. Helix maintains an internal calibration set used to tune its

analysis rubric. Per D44, this set is access-fenced: it is never reachable from any other customer's workspace or from any demonstration surface. It is not a shared pool of customer data. [ATTORNEY] — decide what, if anything, about the calibration set is disclosed publicly and whether design-partner data may ever enter it (and if so, on what consent). By default, do not represent that any given customer's data will be used for calibration.

Deletion on request. A customer may request deletion of its data by contacting us at [VERIFY: support/privacy contact address]. On a verified request we will delete the customer's transcripts and derived analysis. [ATTORNEY] — specify the response SLA (e.g., within 30 days), whether deletion extends to backups (and the backup-rotation window before purge), and how deletion propagates to subprocessors (Supabase storage; any Anthropic API retention window per §4). Note the current product has no self-serve "delete my org" flow — deletion is operator-run today; describe the process honestly. [VERIFY]

8. Your rights

Depending on your jurisdiction (e.g., GDPR/UK GDPR, CCPA/CPRA), you may have rights to access, correct, delete, port, or restrict processing of your personal data, and to object or withdraw consent. Because Helix acts as a processor for customer-uploaded call content, requests about that content should generally be directed to the customer organization that uploaded it; we will assist that customer in responding. [ATTORNEY] — enumerate the specific rights and the request/verification/appeal process required by the applicable regimes; add the "we will not discriminate for exercising rights" statement if CCPA applies.

9. International transfers

[ATTORNEY]/[VERIFY] — if data crosses borders (subprocessors in §4 may process data outside the customer's region), specify the transfer mechanism (e.g., Standard Contractual Clauses) and confirm each subprocessor's contractual basis. The current product makes no data-residency commitment; do not imply one.

10. Children's data

The service is for business use by sales organizations and is not directed to children. We do not knowingly collect data from children. [ATTORNEY] — confirm scope statement.

11. Changes to this policy

During early access, this policy may change as the product evolves. Material changes will be communicated to active customers. [ATTORNEY] — set the change-notice mechanism and whether prior versions are archived.

12. Contact

Questions or requests: [VERIFY: privacy contact email]. [ATTORNEY] — set the controller entity, contact address, and (if required) an EU/UK representative or DPO.

> Note on domains (internal, D45): the company site is served from `fdelabs.ai` > (product at `helix.fdelabs.ai`), and email is sent from the separate `fdelabsai.com` / > `onboarding@resend.dev` sender during early access. Confirm the correct customer-facing contact > address before publication.