Privacy Policy

1. Who We Are

MicHelper is a product for AI-assisted sales-quality analysis in retail networks. The legal operator's registration details are still being completed; the identified contracting party must appear in the signed customer agreement. The platform processes temporary audio and source text to analyse consultations and generate derived metrics.

MicHelper as Processor (розпорядник)

For conversation data, the business customer — the retail network — is the data controller (володілець персональних даних). It decides whether recording is used, in which locations, whose conversations are recorded, for what purpose, and which authorised users receive access.

• Controller (володілець): the customer retail network for recordings, transcripts and employee-performance data.
• Processor (розпорядник): MicHelper processes that data only on the controller's documented instructions and within the written Data Processing Agreement.
• MicHelper as controller: only for MicHelper's own account administration, billing, website, support and security-log data, where MicHelper determines the relevant purposes and means.

If your conversation was recorded, the relevant retail network is the primary contact for exercising your rights. MicHelper accepts requests at privacy@michelper.com, forwards a verified conversation-data request to the controller within 5 days, tells the requester where it was forwarded, and assists the controller with fulfilment.

2. Data We Collect

2.1 Account Information

When you create an account or your employer creates one for you, we collect:

• Name, email address, phone number (optional)
• Company/organization name and role
• Login credentials (passwords are hashed, never stored in plain text)
• Language and timezone preferences

2.2 Usage Data

We automatically collect information about how you interact with our service:

• Login timestamps and session duration
• Features accessed and actions performed
• Browser type, operating system, and device information
• IP address and approximate location (country/region level)

2.3 Device & Technical Data

For our recording devices (microphones) and web application:

• Device identifiers and status
• Connection quality metrics
• Error logs and diagnostic information

2.4 Audio & Transcript Data

This is the core data we process for our service. See Section 3 for detailed information.

2.5 Data from Third-Party Authentication

If you choose to sign in using Google OAuth, we receive and store:

• Your Google account email address
• Your display name
• Your Google account identifier

We do not access your Google contacts, calendar, or any other Google services data. You can disconnect Google authentication at any time through your account settings.

2.6 Push Notifications

If you enable push notifications, we collect and store a device token used solely to deliver notifications to your device. You can disable push notifications at any time through your device settings or the application. Device tokens are deleted when you unsubscribe from notifications or delete your account.

2.7 Telegram Bot Data

If you interact with our Telegram bot, we collect and store:

• Your Telegram chat ID and username
• Message history with the bot
• Your notification preferences

This data is used to provide bot functionality, deliver notifications, and process your requests. You can stop interacting with the bot at any time by blocking it in Telegram, which will cease all data collection. Existing data will be deleted according to our standard retention policies or upon request.

3. Audio Recordings & Transcripts

3.1 What We Record

Our service records audio from designated microphones in retail locations. These recordings capture sales consultations between employees and customers. The recording devices are placed in accordance with local laws and with appropriate signage.

3.2 Audio Processing

Audio is buffered in the browser until upload is acknowledged and held on the server while transcription or a retry is pending. The server removes the raw file after successful transcription. Failed jobs, browser backlog, a valid legal hold or a separate quality-review setting can extend retention; periodic cleanup and backups have their own schedules. Six hours is the standard retry window, not an absolute deletion guarantee.

3.3 Transcription Process

Audio is transcribed using approved AI speech-recognition technology under MicHelper's privacy and retention controls. Specific model routing, providers and fallbacks are confidential technical information. Customer data is not used for AI model training. Transcripts may include:

• Text content of the conversation
• Speaker identification (employee vs. customer)
• Timestamps and segment boundaries
• Language detection results

3.4 Transcripts

Conversation text is temporarily stored in encrypted form while chunk analysis, retries and point settlement need it. For a new successfully analysed chunk, cleanup of its operational source fields is scheduled after a five-minute safety window. This does not erase every text copy: manually saved, historical, pending or retryable records, valid legal holds and encrypted backups follow separate rules. Derived analysis, scores, limited evidence and operational metadata remain under the customer agreement.

3.5 Quality Analysis

Transcripts are analyzed against sales scripts and rules configured by the network administrator to generate:

• Script compliance scores
• Performance metrics and rankings
• Violation flags and recommendations

AI analysis is provided for informational purposes only. Accuracy is not guaranteed. AI-generated outputs do not constitute legal advice, official compliance certification, or evidence of employee misconduct. Significant employment decisions should involve qualified human review.

4. Grounds for Processing

We process personal data based on the following legal grounds:

4.1 Contract Performance

Processing necessary to fulfill our service agreement with business customers, including account management, service delivery, and support.

4.2 Legitimate Interests

Processing necessary for our legitimate business interests, such as:

• Improving and developing our services
• Preventing fraud and ensuring security
• Analyzing usage patterns to optimize performance

4.3 Consent

Where required by law, we obtain consent for:

• Marketing communications
• Processing beyond what is strictly necessary for service delivery

4.4 Legal Obligations

Processing necessary to comply with applicable laws, such as tax reporting, fraud prevention, and responding to lawful requests from authorities.

5. How We Use Your Data

We use the data we collect for the following purposes:

5.1 Service Delivery

• Processing and analyzing audio recordings
• Generating transcripts and quality scores
• Creating reports, rankings, and analytics
• Enabling Excel/CSV exports

5.2 Account Management

• User authentication and authorization
• Role-based access control (RBAC)
• Subscription and billing management

5.3 Communication

• Service notifications and alerts
• Support responses
• Product updates (with consent)

5.4 Improvement & Development

• Analyzing usage patterns to improve features
• Debugging and troubleshooting

Customer data is NOT used for AI model training. Customer data is NOT shared with AI providers for training.

6. Data Sharing & Subprocessors

6.1 We Do Not Sell Your Data

We do not sell, rent, or trade personal data to third parties for their marketing purposes.

6.2 Subprocessors

We use the following third-party service providers (subprocessors) to operate the Service. Each subprocessor processes data only as necessary for its stated purpose.

We maintain this list and will notify customers of changes at least 30 days in advance. To subscribe to subprocessor change notifications, contact privacy@michelper.com. The current disclosed provider list is published on the Subprocessors page.

6.3 Legal Requirements

We may disclose data when required by law, court order, or to protect our rights, property, or safety.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity.

7. International Data Transfers

MicHelper uses a protected cloud environment for application services, persistent storage and encrypted backups. Approved AI services process requests under contractual privacy and retention controls; their specific routing is confidential technical information.

Information required for a specific customer agreement, including applicable safeguards and provider commitments, is available from legal@michelper.com.

Important: customer content is not used for AI model training, and approved AI services process only the information necessary to complete a request.

8. Data Retention

Audio Recordings

Server-side raw audio is removed after successful transcription. During a failed upload or transcription, a recoverable copy may remain for retry; the standard retry window is six hours, but cleanup is periodic and exceptions include browser backlog, valid legal hold, quality review and backups.

Transcripts

For new recordings, transcripts are temporarily needed for AI analysis and retry. Cleanup of a successfully analysed chunk’s operational source fields is scheduled after a five-minute safety window; this is not a guarantee that every copy has been erased. Manually saved text, pending or retryable chunks, valid legal holds and backup copies may last longer. Historical records require a separate audited cleanup and may still exist. New reports retain derived scores, summaries and limited evidence rather than a full transcript.

Analytics, Scores & Performance Data

QA scores, coaching notes, event timelines and metadata may remain after source text is removed. Their retention follows the configured service policy and signed customer agreement; these records may still identify an employee.

Account & Configuration Data

User accounts, network configurations, scripts and settings follow the configured service policy and signed customer agreement. Account deletion requests are handled subject to applicable legal obligations and backup-expiry schedules.

Audit Logs

Security and access logs are retained for 90 days.

Summary

9. Security Measures

We implement technical and organizational measures to protect your data:

9.1 Technical Measures

• Encryption in Transit: All data transmitted using TLS 1.2 or higher
• Encryption at Rest: Encrypted data at rest
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Authentication: Secure password hashing (bcrypt), session management
• Rate Limiting: Protection against abuse and brute-force attacks
• CSRF Protection: Cross-site request forgery prevention

9.2 Organizational Measures

• Audit Logging: All data access and modifications are logged (retained 90 days)
• Incident Response: Documented procedures for security incidents
• Regular Reviews: Periodic security assessments and updates

9.3 Incident Notification

In the event of a data breach affecting your personal data, we will notify you and relevant authorities as required by applicable law, within 72 hours of becoming aware of the breach.

10. Cookies

We use essential cookies only. We do not use tracking, analytics, or marketing cookies.

11. Your Rights

Depending on your location and applicable law, you may have the following rights:

11.1 Rights under applicable law

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw previously given consent at any time

11.2 Exercising Your Rights

To exercise any of these rights:

• Contact privacy@michelper.com; MicHelper will forward conversation-data requests to the relevant controller and assist with fulfilment
• Use the Privacy Requests feature in your MicHelper account
• If you are an employee, contact your employer (the Data Controller)

For conversation data, MicHelper will forward a verified request to the relevant controller within 5 days and notify the requester of the recipient. The controller remains responsible for the substantive response within the period required by applicable law.

12. Children's Privacy

MicHelper is a business-to-business service and is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

13. Contact & Complaints

13.1 Contact Us

The official contact channel for all MicHelper support, privacy, sales, billing, security, legal and data subject requests is:

• Privacy: privacy@michelper.com
• Support: support@michelper.com

13.2 Supervisory Authority

If you are in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

For data subjects in Ukraine, complaints may also be addressed to the Ukrainian Parliament Commissioner for Human Rights (the authorised personal data protection authority in Ukraine) in accordance with applicable Ukrainian law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last updated" date at the top of this page
• For significant changes, we will provide notice through our service or via email
• Continued use of our service after changes become effective constitutes acceptance

We encourage you to review this policy periodically.