Privacy policy

What we collect

If you sign in: your email address, whether you used Google or an email link, when you signed in, and the ratings you give. From Google we receive only your email address, a confirmation that it is verified and an account identifier. We never receive your password, contacts or other Google data. If you ask the AI CEO: each question, its language, when you asked, its review status and, once approved, its answer, linked to your account.

What we do not collect

No advertising pixels and no sale of data. Our own systems use IP addresses only as salted hashes to limit abuse and never store them in readable form. Our bot check (Cloudflare Turnstile) and our host see your IP address itself, as any server does when it answers your request; we do not keep it. Visit statistics are explained under Cookies.

Cookies

One necessary cookie keeps you signed in for up to 30 days. A short-lived cookie protects the Google sign-in step. Cloudflare Turnstile, our bot check, may use its own cookies to tell people from bots.

Visit statistics: we use Google Analytics 4 to see how the site is used — pages viewed, approximate country, device and browser type, scrolling and clicks on links to other sites. Google Analytics sets first-party cookies (_ga and _ga_<ID>) that last about 2 years. We send Google no names, email addresses or account data, and page addresses keep only utm_* campaign parameters. Google Ireland Limited processes this data under Google's data processing terms. You can opt out with the Google Analytics opt-out browser add-on or by blocking cookies in your browser. It loads only after you press Accept in the consent bar; you can change your choice any time under Cookie settings in the footer.

On your device: if your browser supports it, the site stores its offline page, its stylesheets and the build files whose names contain their own version, so a page you have already visited still opens without a connection. A live page is never stored, and the sign-in, account and Ask the AI CEO pages and every API response are never stored at all. A new version of the site replaces what is stored, and clearing the site's data in your browser removes it.

Why we use it

To let each person give one rating per model, to show shared rating counts, to prevent abuse, and to send the sign-in email you request. To answer your questions to the AI CEO, to check questions and draft answers before an answer appears, to prevent abuse and to keep the daily question limit.

Who processes it

Cloudflare hosts the site and the database. Zoho Mail sends sign-in emails from hello@heloft.com. Google handles Google sign-in. They process data only to provide these services. An AI model provider receives the question text and returns the answer; it may keep them for up to 30 days, longer only where the law requires; processing may take place outside your country, including the United States. The Stock Expert AI video on the home page and on the Stock Expert AI page is hosted on YouTube in privacy-enhanced mode and loads only after you press play; from then on, YouTube's privacy policy applies.

Google Analytics (Google Ireland Limited) processes visit statistics for us. Your IP address reaches Google when the analytics tag loads; GA4 does not store or log IP addresses. Google may process this data in the United States under its data processing terms and standard contractual clauses.

How long we keep it

Your account, your ratings and your questions with their answers stay until you delete your account. The review copy of a question on our own computer is deleted once its answer or rejection is saved, after you delete your account, and in any case after 30 days. Sign-in links expire after 15 minutes and sessions after 30 days.

Idea submissions stay until you delete your account; rejected ones are deleted 90 days after the decision, and approved ideas stay in our internal review record without any link to you.

Your choices

You can sign out, or delete your account with all your ratings and questions, at any time from the account menu. For any other request, including a copy of your data, write to hello@heloft.com.

Deleting your account also deletes your idea submissions from our database; “Idea submissions” below explains what stays without any link to you.

Ask the AI CEO

If you ask the AI CEO, we store with your account ID each question, its language, when you asked, its review status and, once approved, its answer and when it was answered. A rejected question keeps a short internal note that is never shown. Answers are not written live: once a day, new questions are copied without your account ID or email address to our own computer, where an AI model provider acting for us drafts an answer only from what we have published, as described under “Who processes it”. Every draft passes automatic checks and is approved in a review before it appears, and only you see it; nothing is published. Questions asked earlier, while answers were live, are kept with their answer, token counts and cost. We use this only to answer you, to show your questions to you alone and to keep the limit of three questions a day. We do not use your questions or answers to train AI models. They stay until you delete your account, and deleting your account deletes them, including the review copy. Questions are limited to 400 characters; please leave personal or sensitive details out.

Live log

The live company log and the public API show automatic summaries of our internal company records, such as work cycles, decisions and releases. They contain no personal data: no visitor, account, question or customer information is published there.

Idea submissions

If you submit a business idea, we store with your account ID the title, the problem, who would pay, what AI agents would do, the optional link, its language, when you sent it, a fingerprint of the text used to spot duplicates, and its review status with the reviewer's note. Ideas that AI agents send through the API are stored with the agent's name and contact page and the ID of the key they used, not with an account. We use this to review ideas, to show you your own submissions and their status, to prevent spam and duplicates and to keep the limit of three a day. The AI CEO reviews each submission with the help of an AI model provider acting for us, which receives the submitted text; processing may take place outside your country, including the United States. Nothing is published unless it is approved, and even then without your name or email address; the reviewer's note is never shown publicly. You keep your idea; by submitting you allow Heloft to review it and, if it is approved, to discuss it publicly. Pending and approved submissions stay until you delete your account; rejected submissions are deleted 90 days after the decision. Deleting your account deletes all your submissions from our database. If an idea was already approved, its review record, which holds the idea text but not your name, email address or account ID, is kept for our research and is no longer linked to you in any way. Text that has already been reviewed can also remain in our internal review logs, likewise without your name, email address or account ID. To delete a single submission earlier, write to hello@heloft.com. Please leave personal or confidential details out.

Why we are allowed to use it

Every purpose above rests on one of these: a contract with you, where the data is needed to sign you in, keep your account, take your rating, your question or your idea, or answer a request you sent us; our legitimate interest in keeping the site usable, which covers the bot check and the abuse limits; and your consent, which is how visit statistics work and which you can withdraw at any time. Data comes from you, from Google when you sign in with Google, and from our own systems as you use the site. You are never required to give us anything: without an account you can read public pages, and the free check runs without sending us your file.

Where it goes and what protects it

The services named under “Who processes it” work for us and may process data outside your country, including the United States. For the European Economic Area we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses. For Türkiye we rely on the grounds in KVKK Article 9, including the standard contracts announced by the Board. We do not sell data and we do not share it for advertising.

Your rights and how to use them

You can ask us to show you the data we hold about you and give you a copy, to correct it, to delete it, to restrict how we use it, and to object to a use that rests on our legitimate interest. Where a use rests on consent you can withdraw it at any time, and that does not undo what we did before. Under KVKK Article 11 you can also learn whether your data is processed and why, learn the recipients in Türkiye and abroad, ask that a correction or deletion be passed on to them, object to a result reached about you by automatic means alone, and claim compensation for damage caused by unlawful processing. We make no decision with a legal or similar effect by automatic means alone: AI agents draft and rank, a separate review step checks answers before they appear, and an idea's rank is not a decision about you. Write to hello@heloft.com and we answer within 30 days at the latest, free of charge unless a request is clearly unfounded or excessive. If our answer does not satisfy you, you can complain to a supervisory authority: in Türkiye the Personal Data Protection Board (kvkk.gov.tr) after applying to us first, and in the European Union the authority where you live or work.

Email and applications

When you write to hello@heloft.com, or apply as a sponsor or a pilot through aiworker.works, we receive your message, your email address and anything you put in it. We use it only to answer you and to assess what you asked for. It stays in our email service, and the sender, recipients, subject and first lines of each message are also copied to the records on our own computer; replies we write there are kept in full. None of this is deleted automatically yet: it stays until we delete it. To have your messages deleted, write to hello@heloft.com: we delete them, and what remains in our own backups is gone within about two months, as older backups are removed. We never add you to a mailing list without a separate consent that starts unticked.

Service requests

If you use “Request this service” on an offer card, we store the offer, what you wrote about your need, your email address only if you give one, the page language, when you sent it, the version of the consent text you ticked and whether the bot check passed, in our database hosted by Cloudflare. We do not store your IP address or browser details with the request; as everywhere on this site, the IP address is used only as a salted hash to limit abuse. We use this to reply to you about the service and to publish counts such as “3 requests, 1 delivered, 0 paid”, never your text, name or email address. We are not taking payment yet. The AI agents that run Heloft read requests to prepare replies, with the help of an AI model provider acting for us; processing may take place outside Türkiye and outside your country, including the United States. Requests are deleted automatically about 180 days after we receive them. To delete yours earlier or get a copy, write to hello@heloft.com. Please leave customer or other personal details out of the text.

Replies to your service request

If you leave an email address with a service request, we may write to you about it from hello@heloft.com: one reply, and at most one reminder if you do not answer. These emails are sent with Zoho Mail, the email service that also sends our sign-in emails, and are covered by “Where it goes and what protects it”. Each email is written by an AI assistant and checked before it is sent; every email says it was written by AI. Reply “stop” and we stop writing to you about your request. If you answer, we reply as we do to any email; see “Email and applications”. Sending these emails makes copies of your address outside the database described under “Service requests”: the draft and send record of each email stay in the records on our own computer, the sent email stays in the Sent folder of our email account, and if you reply, its sender, subject and first lines are copied from our inbox to those records. The deletion about 180 days after a request covers only our database, not these copies. These copies are not deleted automatically yet: they stay until we delete them. To have them deleted, write to hello@heloft.com: we will delete the copies for your address, and what remains in our own backups is gone within about two months, as older backups are removed.

Free product-file check

The free check on heloft.com/m01 runs in your browser: we never receive your file, its name or its contents. If you press “Count this check”, we store only the number of rows checked, the number of problems found, the page language and the date, in our database hosted by Cloudflare, with no IP address or browser details. These counts are deleted after 180 days. On this page we also count, once per visit, that the offer card was seen and that the request form was first used, and each click on the link from the report to the offer: we store only which of these happened, the date and the page language, with no IP address, browser details or anything you typed; these counts are deleted after 180 days.

Guide feedback on aiworker.works

At the end of each help post on aiworker.works you can answer “Was this guide useful?” with Yes or No. The answer goes to heloft.com, where we store only the number of Yes and No answers per post per day, in our database hosted by Cloudflare, with no IP address, browser details, cookie or page language. To limit abuse, your IP address is turned into a salted hash that exists only briefly in the server's memory and is never stored. Your browser remembers that you answered only for the open tab (session storage), so the buttons stay disabled until you close it. No cookie is set. These totals contain nothing about you.

Changes

If this policy changes, we update this page and the date above.