Privacy policy

1. Who we are

1.1 Sweeber Technologies offers Helpable: online software that organizations use to onboard and train their team and to record and share knowledge. In this policy, "Helpable", "we" and "us" always mean Sweeber Technologies.

1.2 This policy applies to our websites (such as www.gethelpable.com), the app, public knowledge bases shown through Helpable, our emails and our contact with customers and prospects.

1.3 You can always send privacy questions to [email protected]. Put 'Privacy' in the subject line so your message reaches the right person right away.

2. Two roles: controller and processor

2.1 For part of the data, we are the controller. That means we decide why and how the data is processed. This covers data about customers and their contacts, accounts, billing, support, our website, marketing and the security of the service.

2.2 For the data an organization puts into its own workspace, that organization is the controller. Think of data about employees, training progress, quiz results, read confirmations, certificates, questions to Answers, roleplay conversations and personal data in articles and files. Helpable is then the processor: we only process that data on the organization's behalf. The arrangements are in article 19 of our terms of service, which serves as a data processing agreement.

2.3 If you use Helpable through your employer or another organization and have a question about the data in that workspace, please contact that organization first. They decide what happens with that data. If you send your question to us, we will forward it.

3. What data we process

3.1 Which data we process depends on how you use Helpable. It covers these types of data:

• Account data: name, email address, profile photo, language, chosen appearance and how you sign in (for example with email or a Google account). We do not store passwords ourselves; our sign-in partner stores them encrypted.
• Workspace data: the organization's name, the team or location you belong to, your role and who invited you.
• Use of the service: which training and articles are assigned to you, your progress, quiz answers and scores, read confirmations, certificates, questions to Answers, practice conversations and feedback in Roleplay Studio, and notifications.
• Content: everything you or your organization puts into Helpable, such as articles, procedures, training, files, images and videos. This can contain personal data.
• Billing and payment data: company name, address, VAT number, contact person, plan, add-ons, invoices and payment status. Stripe handles card and bank details. We never see the full card number.
• Communication: messages you send us by email, the contact form or chat, and our replies.
• Technical data: IP address, browser and device type, operating system, timestamps, error messages and log data. We need these to run and secure the service.
• Usage and website statistics: which pages you visit, where you came from (for example a search engine or campaign), which buttons you click and how you move through the app. In the app we may also make session recordings; see article 9.
• Visitors of public knowledge bases: the pages you view, searches, questions to Answers and feedback on articles, without needing an account.

3.2 We do not ask for special categories of personal data, such as data about health, religion or origin. If an organization still puts such data into its workspace, it is responsible for that.

3.3 Helpable is not meant for children. Users must be at least 16 years old. We do not knowingly process data of younger children.

4. Why we process data and on what legal basis

4.1 We only process personal data when the GDPR gives us a legal basis. Below you can see the legal basis for each purpose.

4.2 When we process data based on legitimate interest, we have weighed whether that interest outweighs your privacy. You can always object; see article 11.

4.3 When we process data based on consent, you can withdraw that consent at any time. This takes effect from the moment you withdraw.

4.4 We do not make decisions about you based solely on automated processing that have legal effects or affect you in a similarly significant way. Roleplay Studio feedback and quiz scores are meant for learning. Under our terms, an organization may not base decisions about employees on them without a person reviewing them.

5. AI features

5.1 Helpable has AI features: Answers answers questions from an organization's own knowledge base, the AI writer helps with text and procedures, the AI course maker turns documents into training and quiz questions, and Roleplay Studio lets employees practice conversations with an AI character.

5.2 When you use an AI feature, we send your question or request and the relevant parts of your organization's content to our AI provider Anthropic. To search the knowledge base, we create a search index (embeddings) of the content with OpenAI. We send no more data than needed for the answer.

5.3 We do not use your data or your organization's content to train AI models. Our AI providers do not use data sent through their API to train their models. They may keep that data for up to 30 days to detect misuse, unless the law requires longer.

5.4 We store questions to Answers, Roleplay Studio conversations and feedback in the workspace, so the organization can see which questions come up, improve its knowledge base and follow progress. The organization decides how long this data stays.

5.5 AI can make mistakes. That is why Answers shows the sources with every answer, so you can check it.

5.6 Please do not type sensitive personal data into AI features when it is not needed, such as health data or data about your organization's clients.

6. Who we share data with

6.1 We never sell personal data. We only share it when needed for the purposes in this policy.

6.2 We work with carefully chosen providers (sub-processors) that process data for us. We have a data processing agreement or similar arrangements with each of them. They may only use the data for the work they do for us. These are our providers:

6.3 Within a workspace, other users see your data as far as the service requires. Admins and managers of your organization can, for example, see your progress, quiz results, read confirmations, certificates and, where set up, your Roleplay Studio practice conversations.

6.4 If an organization turns on an integration with another service, such as Slack, we share the data needed for that integration with that service. The organization decides which integrations are on.

6.5 We may share data with an advisor bound by confidentiality, such as an accountant or lawyer.

6.6 We share data with the police, a regulator or another authority when the law requires it or when needed to protect our rights or the safety of others.

6.7 If another company acquires Helpable or we merge with another company, the data may pass to that company. This policy then continues to apply, and we will tell you in advance.

6.8 If we add or replace a sub-processor, we update the list above. Customers we serve as a processor are notified at least 30 days in advance.

7. Transfers outside the European Economic Area

7.1 We store the database and uploaded files in the European Union. Some providers also process data outside the European Economic Area (EEA), mainly in the United States. The table in article 6 shows this.

7.2 When data goes to a country outside the EEA, we put appropriate safeguards in place. That is an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for providers certified under it, or the European Commission's standard contractual clauses, with extra measures such as encryption where needed.

7.3 Would you like a copy of these safeguards? Email [email protected].

8. Cookies and similar technologies

8.1 A cookie is a small file your browser stores when you visit a website. We also use similar technologies, such as local storage in your browser. In this policy we call all of these cookies.

8.2 Functional cookies are needed for the website and the app to work, for example to keep you signed in and remember your language. We do not ask consent for these.

8.3 Analytics cookies help us understand how the website and the app are used, so we can improve them. We only place them when you accept them in the cookie notice. Until you choose, they stay off. You can change your choice at any time through 'Cookie settings' at the bottom of every page. We remember your choice for 12 months in the hp-consent cookie.

8.4 We do not use cookies to show you ads on other websites and we do not sell data to advertisers.

8.5 These are the main cookies we use:

8.6 You can always delete or block cookies in your browser settings. If you block functional cookies, some parts, such as signing in, will no longer work properly.

9. Analytics and session recordings

9.1 We use PostHog to see how the website and the app are used. PostHog runs for us in the EU. In the app, PostHog may make session recordings: a replay of mouse movements, clicks and screens, so we can see where people get stuck and fix errors. What you type into input fields is masked and not recorded. We do not make session recordings on public knowledge bases.

9.2 We use Google Analytics to measure visits to our website. We only use that data for statistics and not to show ads.

9.3 We do not load analytics on local test environments and preview versions of the service.

9.4 We only use statistics to improve the service, the website and our communication. We do not use them to build profiles to judge you.

10. How long we keep data

10.1 We do not keep data longer than needed for the purpose we process it for, or as long as the law requires. These are our retention periods:

10.2 For data in a workspace, the organization decides how long it keeps it. It can delete or export data earlier.

11. Your rights

11.1 You have the following rights over your personal data:

• Right of access: you may know which data we hold about you and what we do with it.
• Right to rectification: if your data is wrong, you may ask us to correct it. You can also change much of it yourself in your profile.
• Right to erasure: you may ask us to delete your data, unless we still have to keep it, for example by law.
• Right to restriction: you may ask us to temporarily do less with your data, for example while we review a correction request.
• Right to data portability: you may get a copy of your data in a common format, so you can take it to another service.
• Right to object: you may object to processing based on legitimate interest. You can always object to direct marketing; we then stop right away.
• Right to withdraw consent: if you gave consent, you can withdraw it at any time.

11.2 Send your request to [email protected]. We may ask you to prove who you are, so we do not give data to the wrong person. We respond within one month. If a request is complex or we receive many, this can take two more months; we will tell you within the first month. A request is free, unless it is clearly unfounded or keeps being repeated.

11.3 If your request concerns data in an organization's workspace, we forward it to that organization, because it decides about that data. We help it handle your request.

11.4 If you disagree with how we handle your data, please tell us. We are happy to solve it together. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the country where you live or work.

12. Security

12.1 We take appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access. These include:

• encrypted connections (HTTPS with TLS) for all traffic with the website, the app and our providers;
• encrypted storage of the database, files and backups;
• separation of data per workspace, so an organization only sees its own data;
• role-based access within the workspace, and limited access for our own team based on need;
• secure sign-in through a specialized sign-in partner, with the option to sign in with a Google account;
• encrypted storage of integration data, such as access keys;
• protection against attacks and overload through Cloudflare;
• logging and monitoring to detect failures and misuse;
• regular backups and keeping software up to date;
• carefully choosing providers that set high security standards themselves.

12.2 No system is completely secure. If you find a security weakness, please report it at [email protected]. We investigate every report.

12.3 You can help too: use a strong, unique password, share your sign-in details with no one and sign out on devices you share with others.

13. Data breaches

13.1 If, despite our measures, something goes wrong with personal data, such as loss or access by an unauthorized person, we call it a data breach. We investigate every breach right away, limit the damage and take measures to prevent it from happening again.

13.2 Where we are the controller, we report a breach to the Dutch Data Protection Authority within 72 hours when the GDPR requires it. If the breach is likely to have serious consequences for you, we also tell you as soon as possible.

13.3 If the breach affects data we process as a processor for an organization, we notify that organization without undue delay, and where possible within 48 hours. The organization then decides whether to report the breach to the authority and the people affected.

13.4 We keep a register of every data breach, including those that do not need to be reported.

14. Exporting and deleting your data

14.1 Organizations can export content and results with the export features in the service. Users can change their own profile data.

14.2 If you want your account deleted, email [email protected]. If you own a workspace, you can delete the workspace yourself in the settings. After deletion we erase the data within the periods in article 10.

14.3 If your account is part of an organization's workspace, that organization can also remove you from the workspace. Your results in that workspace may then be kept if the organization needs them, for example to show that a mandatory training was completed.

15. Emails we send

15.1 Service emails, such as invitations, assigned training, reminders, password resets, invoices and important changes to the service or the terms, are part of the service. You cannot unsubscribe from them as long as you have an account. Your organization can adjust training reminders.

15.2 We only send news, tips and offers to customers or to people who have given consent. Every email has an unsubscribe link at the bottom.

16. Links to other websites

16.1 Our website, public knowledge bases and organizations' content may contain links to other websites. We are not responsible for how those websites handle your data. Please read their privacy policies.

17. Changes to this policy

17.1 We update this policy when our service, our providers or the law change. The date at the top shows when we last updated it.

17.2 If the changes matter to you, we will tell you in advance by email or through a notice in the service.

18. Contact

Do you have a privacy question, want to use one of your rights or report a data breach? Get in touch.

• Sweeber Technologies
• Torenlaan 5B, Bussum, the Netherlands
• Email: [email protected] (subject: Privacy)
• Website: www.gethelpable.com