Privacy policy
Last updated 2026-11-11. Effective 2026-11-11.
This policy explains how Helikon Labs Inc. handles personal information: about people who use our websites and platform, and about researchers whose published work appears in our index, whether or not they have an account. Material changes are announced by in-app notice and email 30 days before they take effect.
Our commitments
- We do not sell user data.
- We do not use your content to train AI models, and the AI service providers we use are not allowed to train their models on it.
- Research data uploaded to the platform is encrypted at rest and in transit.
- You can export your data at any time, and delete your account and its private data at any time.
- If your institution has data-residency requirements, contact us to discuss options.
Who we are
Helikon Labs Inc. (“Helikon Labs”, “we”) is responsible for the personal information described in this policy. In data-protection terms, we are its controller. We are located at 3518 Fifth Avenue, Pittsburgh, Pennsylvania 15213, United States, and you can reach us about privacy through the contact routes below. Where an institution asks us to process information on its behalf under a separate agreement, we act as its service provider for that information; see Team and institutional accounts.
What we collect and why
For each kind of information: what it is, what we use it for, the legal basis we rely on, and how long we keep it.
Account details
- What
- Your name, email address, password (stored only in hashed form), role, organization, the date you signed up, each version of our terms you accepted and when, and whether you want product news.
- Why
- To create and run your account, sign you in, and contact you about it, including occasional product news unless you turn it off.
- Legal basis
- Performing our contract with you. For product news: our legitimate interest in telling members about our services, or, if you are in the EEA, the UK or Switzerland, your consent.
- How long
- While your account is open. See Deleting your account.
Your profile
- What
- What you add to your profile: title, biography, expertise, affiliations, photo, facilities, publications you add, and your ORCID iD if you choose to give it. We use your ORCID iD to find your publications in public records.
- Why
- To show your profile to other members according to your settings, and to match you with relevant people and projects.
- Legal basis
- Performing our contract with you.
- How long
- While your account is open.
What you create and share
- What
- Projects and their files, messages, meeting requests, comments, saved items, follows, and pipeline cards.
- Why
- To provide those features to you and to the people you share them with.
- Legal basis
- Performing our contract with you.
- How long
- While your account is open. Activity histories are deleted sooner: pipeline activity after 180 days and project activity after 12 months.
Matching and AI-generated data
- What
- Numerical representations of your profile and projects, match scores, and AI-written summaries and analyses.
- Why
- To rank search results and recommendations, and to explain why a match was suggested.
- Legal basis
- Performing our contract with you.
- How long
- Recalculated as your profile changes, and deleted with your account.
How you use the platform
- What
- Searches, features used, notifications, and the profiles you view.
- Why
- To run features such as notifications and view counts, apply plan limits, and find and fix problems.
- Legal basis
- Our legitimate interest in operating and improving the platform.
- How long
- Records of profile views for 30 days, notifications for 90 days, and other usage records while your account is open.
Security records
- What
- Sign-in, sign-up, and password-reset attempts, with the IP address and browser used; the IP address and browser of your most recent sign-in; and a log of actions our staff take on accounts.
- Why
- To alert you to sign-ins from a new device, limit repeated attempts, and prevent and investigate abuse.
- Legal basis
- Our legitimate interest, and our users’, in keeping the service secure.
- How long
- Your most recent sign-in details while your account is open. Event records and the staff action log for up to 7 years. Event records identify you by a keyed one-way hash of your email address, not the address itself.
Billing
- What
- Your plan, billing period, payment status, and billing address, and for a Team or Institutional plan you buy, the organization it is for and its number of seats. Card details go directly to our payment processor, Stripe; we never see your full card number.
- Why
- To take payment, calculate tax, and manage your subscription.
- Legal basis
- Performing our contract with you, and our legal obligations under tax law.
- How long
- Payment event records for 90 days. Billing records as long as tax and accounting law requires. Stripe keeps payment records under its own policy.
Purchases on helikonlabs.com
- What
- When you buy a tool, assessment, Office Hours block or workshop on helikonlabs.com: your name and email address, what you bought and what you paid, and Stripe's record of the checkout. If you accepted analytics, also the campaign link that brought you to the page you bought from.
- Why
- To deliver what you bought and keep accounting records. The campaign link tells us which pages lead to purchases.
- Legal basis
- Performing our contract with you, and our legal obligations under tax law. For the campaign link: your consent, which you can withdraw at any time.
- How long
- As long as tax and accounting law requires. Stripe keeps payment records under its own policy.
Error reports
- What
- When something breaks in the platform, a technical report of the error and a short recording of the page in which all text and form entries are masked.
- Why
- To find and fix faults.
- Legal basis
- Our legitimate interest in keeping the platform working.
- How long
- For a limited period set by our error-monitoring provider.
Analytics
- What
- Aggregate page views, referrers, and page-loading speed. Only if you accept analytics; see our Cookie Policy.
- Why
- To understand which pages are used and how fast they load.
- Legal basis
- Your consent, which you can withdraw at any time.
- How long
- Our analytics tools keep aggregate statistics, not profiles of individual visitors.
Reddit ad conversions
- What
- If you arrive from a Reddit ad and accept analytics: the click ID Reddit adds to the ad's link. If you then sign up, we keep it with your account.
- Why
- To tell Reddit which of its ads led to a sign-up or a paid plan.
- Legal basis
- Your consent, which you can withdraw at any time.
- How long
- With your account until it is deleted. Reddit keeps what we send under its own policy.
Messages to us
- What
- What you send us through the contact form or a support request.
- Why
- To answer you and keep a record of what we agreed.
- Legal basis
- Our legitimate interest in responding to inquiries.
- How long
- As long as needed to resolve your request and keep a record of it. If you have an account, we delete them with it.
Business contacts
- What
- If you work at an organization we work with or would like to, your name, work contact details, role, and our correspondence.
- Why
- To manage our business relationships.
- Legal basis
- Our legitimate interest in running our business.
- How long
- While the relationship continues, or until you ask us to remove you.
Our marketing mailing list is separate from the platform and is described under Marketing email. Cookies are described in our Cookie Policy.
Researchers in our index
Helikon Labs includes profiles of more than half a million researchers and inventors, built from public research records. Most of them have never used Helikon Labs. If you are one of them, this section explains what we hold about you and what you can do about it.
- Where it comes from. Public records of publications, patents, and research funding, listed under Public scientific record.
- What we hold. Your name and name variants, research identifiers, your publications, patents, and grants, citation counts and metrics, your research field and country, and the organization we associate you with. Some records also include an email address that appeared in the source data.
- What we work out ourselves. We infer the organization you currently work at from the affiliations on your recent publications, and this can be wrong or out of date. We derive expertise keywords, and we use AI to write a short summary of your research, which we label as written by AI. We also calculate how closely your work matches members’ interests.
- Who can see it. Members who are signed in can see your profile. Our public organization pages, which search engines can index, show your name, research field, and counts of your publications and citations, under the organization we associate you with. We do not show your email address to members, and we do not send email to it.
- Why we do this. We rely on our legitimate interest, and that of our members, in making published research easier to find, so that researchers and the organizations that could use their work can find each other. The information comes from records that are already public, we limit what is shown on the open web, and you can object.
- How long. We keep these profiles while we run the research index, and update them as the public records change.
Your right to object, and to correct. You can ask us to correct what we show about you, to remove you from our public pages, or to stop processing your profile altogether. Tell us through the contact form. We will remove you from our public pages when you ask, and stop processing your profile unless we have compelling grounds to continue. The publication, patent, and funding records themselves remain in the index, because they are part of the public scientific record. You can also claim your profile by joining Helikon Labs, which lets you edit it yourself.
How we use AI
We use machine-learning models to turn profile, project, and research text into numerical representations for search and matching, and language models to write research summaries and to explain why a match was suggested. Text written by AI is labeled as such. Some of these models we run ourselves on cloud computing infrastructure. Others are provided by AI service providers, who process the text we send them only to provide their service to us and are not allowed to train their models on it.
These tools help people decide whom to contact. We do not use them to make decisions that have legal or similarly significant effects on anyone.
Where and how we store it
- We are based in the United States, and the platform runs on servers in the United States. If you use Helikon Labs from another country, your information is processed in the United States, whose data-protection laws may differ from yours. Some of our service providers process data in other countries under their own safeguards.
- TLS for data in transit (1.2 minimum, 1.3 negotiated in practice). Our databases and their backups are encrypted at rest with AES-256: by our hosting provider for our main database, and by us for the server that holds our research index.
- The server that holds our research index keeps security logs, which can include IP addresses, for up to 30 days, to detect and investigate attacks.
- Least-privilege access controls on engineering and support tooling.
- Research and partnership data shared in project workspaces stays private to invited members.
Security and abuse prevention
To keep accounts, and the people our users contact, safe from spam, phishing, and fraud:
- We record each sign-in, sign-up, and password-reset attempt, with the IP address and browser used, and we keep the IP address and browser of your most recent sign-in on your account. We use them to alert you to sign-ins from a new device, to limit repeated attempts, and to investigate abuse.
- When you submit a form on our sites, such as sign-in, sign-up, password reset, the contact form, or a newsletter signup, a bot-protection check reads signals from your browser to tell people from automated scripts.
- We check names and invitations for signs of abuse (for example, links or numbers in a name), and only accounts with a completed profile can send invitations.
- When our staff take action on an account, such as suspending it under section 12 of our Terms of Service, we record who acted, when, and why in an internal audit log.
We keep these security records and the audit log for up to 7 years. Security records identify you by a keyed one-way hash of your email address rather than the address itself. If we suspend or close an account for fraud, spam, or other abuse, we keep the disabled account and the record of what happened for as long as needed to stop the same person from returning and to deal with any legal claims.
Our lawful basis for this processing is our legitimate interest, and our users’, in keeping the service secure and free of abuse. If a security incident affects your personal information, we will notify you, and the authorities, as the law requires.
People you invite
When you invite someone to Helikon Labs, to a project, or to a seat on your organization’s plan, we store the email address you give us and any note you add, and send that person an invitation that says who it is from. An invitation expires if it isn’t accepted within 30 days. We keep the record of it so it can be accepted, and so the same person can’t be invited again and again. We don’t yet delete these records automatically. When a team or institution administrator invites a colleague, we also note the invitation in our audit log, which we keep for up to 7 years. If you received an invitation and want the record deleted, tell us.
Team and institutional accounts
If you use Helikon Labs through a team or institutional plan, your organization’s administrators can see your name, email address, job title, plan, when you joined and last signed in, and how many projects and conversations you have. They cannot read your messages. For projects in their organization, they can also see compliance information such as NDA, IRB, and contract dates. Your organization may have its own policies about how its administrators use this information.
Where your seat comes from. On a team or institutional plan, your access comes from your organization’s plan, not from a subscription of your own. People who hold a seat can see the name of the person who manages the plan’s billing. If the plan ends, or an administrator removes your seat, you go back to your own plan, and your account, profile, and projects stay yours. If you ask your organization for a seat, its administrators see your request and any message you include.
Organizations added by customers. If you buy a plan for an organization that isn’t listed yet, the name, website, type, and country you enter create a public organization listing, marked as unverified until we review it. We don’t show who added it. We email you when it is verified.
Where an institution asks us to process information on its behalf under a master agreement, we do so as its service provider and under a data processing agreement, which is available on request.
Emails about your account
We send the emails your account needs: email verification, password resets, alerts about sign-ins from a new device, receipts, invitations sent to you, and notice of changes to our terms and this policy. You can’t turn these off while you have an account. We also send notification emails about new matches, messages, meeting requests, project updates, and activity digests, and you choose which of these you get, and how often, in Settings → Notifications.
We also send occasional emails about new Helikon Labs features, plans, and offers. You choose when you sign up: the box is ticked for you, except in the European Economic Area, the United Kingdom, and Switzerland, where we send them only if you tick it. Turn them off at any time in Settings → Notifications, or with the unsubscribe link in each one.
Our email delivery provider records whether each email was delivered, bounced, or reported as spam, and may record whether it was opened or a link in it was clicked. We use these records to keep our email working and to stop sending to addresses that bounce or have opted out.
Marketing email
Separately from your platform account, we run an opt-in mailing list: Helikon Field Notes, our research newsletter, and short follow-up sequences attached to a specific download or assessment you asked for. Subscribing is never a condition of using the platform, and the two systems are kept apart. This list is separate from the product news we send members, described under Emails about your account.
- Double opt-in. Giving us an address sends you one confirmation email and nothing else. Until you click that link we send you no marketing mail, and the link expires. Our lawful basis is your consent, which you can withdraw at any time.
- What we store. Your email address, your first name and role category if you gave them, the page that captured the signup, tags recording which download or sequence you asked for, and, if you accepted analytics, the campaign link that brought you to that page. We also record delivery, open, click and bounce events for the emails we send you, which is how we tell a broken sending setup from an uninteresting newsletter.
- Unsubscribing takes one click. Every marketing email carries an unsubscribe link and the one-click unsubscribe headers your mail client uses, so Gmail and Outlook can offer the control directly. Unsubscribing stops all marketing email and lands you on a confirmation page. We don’t ask you to sign in first, and we don’t email you to confirm it.
- How long we keep it. If you never confirm, we delete the record about 30 days after the confirmation link expires, unless you have already used it to download something or take an assessment. If you unsubscribe, we keep a minimal suppression record of your address so that we do not mail you again by mistake. Ask us to erase it entirely and we will.
To be removed completely, including the suppression record, send us a note.
Public scientific record
Publication, patent, and research-funding data surfaced on the platform comes from public research records: OpenAlex, Crossref, the Research Organization Registry (ROR), the U.S. Patent and Trademark Office (by way of PatentsView), and U.S. government funding sources (NIH RePORTER, the NSF awards database, Grants.gov, SAM.gov, the SBIR/STTR program database, and USAspending.gov). This data is part of the public scientific record and is not deleted when an individual account is closed. For corrections upstream, contact the indexing source directly. For what we show about you on Helikon Labs, see Researchers in our index. See our Attributions page for full trademark and licensing details on these sources. For copyright concerns about hosted or indexed content, see our DMCA and copyright policy.
Deleting your account
When you delete your Helikon Labs account, you are signed out everywhere, and your profile, private projects, messages, and files enter a 30-day grace period during which you can restore the account by simply signing in again, or ask us to restore it. After 30 days we permanently delete your account data from the live service, with these exceptions:
- Messages you sent stay in the other person’s conversation, and files and comments you added to someone else’s project stay in that project, with your name removed.
- We keep records of account events, such as sign-up, sign-in, and deletion, for up to 7 years for security and legal purposes. They identify you by a keyed one-way hash of your email address, not the address itself.
- We keep billing records for as long as tax and accounting law requires.
- Deleted data remains in routine backups until they expire: within about 14 days for our main database, and within about 30 days for the server that holds our research index.
- Publication, patent, and funding records remain in the public research index and are unaffected. Your researcher profile is unlinked from your account, the bio you wrote for it is erased, and it is then handled as described under Researchers in our index.
Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct it if it is wrong;
- have it deleted;
- receive it in a portable format;
- restrict how we use it, or object to our using it, including objecting at any time to processing based on our legitimate interests;
- withdraw your consent where we rely on it, such as for analytics, reporting an ad conversion to Reddit, or our mailing list. Withdrawing stops future reports but can’t recall one already sent; and
- not be treated differently for using any of these rights.
You can do much of this yourself: edit your profile, export your data from Settings → Data & account, change your email choices in Settings → Notifications, and delete your account. For anything else, use the contact routes below. We may ask you to confirm your identity, usually by writing from the email address on your account. You can also act through an authorized agent, whom we will ask for proof of authority. We respond within one month, and tell you if a complex request needs longer. If we decline a request, you can ask us to reconsider by replying to our decision.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to complain to your local data protection authority.
Minimum age
Helikon Labs is built for researchers, university staff, and industry professionals. You must be at least 16 years old to create an account, and we ask you to confirm this at signup. We do not knowingly collect personal information from anyone under 16.
If you believe someone under 16 has created an account or given us personal information, tell us and we will delete the account and the associated personal data. Publication, patent, and funding records already in the public research index are drawn from public research records and are handled under Public scientific record rather than this section.
Compliance programs (roadmap)
Formal SOC 2 certification, FERPA, and GDPR programs are on our roadmap for institutional customers. If your institution has a specific compliance requirement, send us a note and we’ll share where we are on the path.
Changes to this policy
If we make a material change to this policy, we will tell you by in-app notice and email 30 days before it takes effect. The date at the top of this page shows when the policy last changed.
Contact us about privacy
All privacy, data-subject, and GDPR requests are handled through our contact form. We don’t list inboxes publicly, so legitimate requests don’t get buried in spam. You can also write to Helikon Labs Inc., 3518 Fifth Avenue, Pittsburgh, Pennsylvania 15213, United States.
Submissions are routed to the right team internally. We respond to data-subject requests within one month.