GDPR · AI ACT

Privacy Policy

This is a convenience translation. In case of any discrepancy, the Polish version prevails. Read the Polish version

This Policy describes how Helpify processes the personal data of persons using the website and the contact forms, and of persons who contact us about working together. We want it to be clear and honest. If anything in this document is missing or unclear, write to hello@gethelpify.com.

Last updated: October 12, 2026

§ 1. Controller of personal data

The controller of personal data within the meaning of Art. 4(7) GDPR is Maciej Odrobina, running a sole proprietorship, address: ul. Szarych Szeregów 1E/6, 44-194 Knurów, NIP 9691675425, REGON 543235659 (hereinafter: "Helpify", the "Controller", "we").

Contact in all matters concerning the protection of personal data:

• email: hello@gethelpify.com
• postal correspondence: ul. Szarych Szeregów 1E/6, 44-194 Knurów

The Controller is not obliged to appoint a Data Protection Officer (DPO). Until a DPO is appointed, if ever, all matters concerning personal data are handled at hello@gethelpify.com.

§ 2. Scope of this Policy

This Policy concerns the processing of data in connection with:

• using the Helpify website: visits, cookies, contact forms and call booking forms;
• communication with us: email correspondence, phone calls, online meetings;
• marketing activities: sales contact, remarketing, social media;
• customer relationship management: preparing and performing cooperation agreements.

Important: this Policy does not concern the data of patients of the dental practices we work with. The controller of that data is the practice, and Helpify processes it on the practice's behalf, under a data processing agreement. The practice informs the patient about the processing of the patient's data.

§ 3. What data we process

Depending on how you interact with us, we may process the following categories of data:

3.1. Identification and contact data

First and last name, company name, industry, position, email address, phone number, correspondence address, content of messages, answers to the questions in the booking form.

3.2. Technical data (collected automatically)

IP address, browser identifier (user agent), operating system, cookie identifiers, date and time of the submission, navigation path on the site, to the extent necessary for the operation of the site, security and limiting spam.

3.3. Voice data

The site no longer collects voice data; the AI agent demo was turned off on October 6, 2026.

Recordings and transcripts of phone calls and online meetings are described in § 5.

3.4. Marketing data

Consents and contact preferences, communication history, interactions with advertising campaigns and the source from which the contact was acquired.

3.5. Data saved while you fill in the request form

On the home page we run a request form, after which you proceed to the booking calendar. In this one place we save your name and phone number at the moment you type them, that is, before you submit the form. We inform you about this next to the phone number field, before you start filling it in.

• we save only the name and phone number, never an email address or any other data before the form is submitted;
• we do this so that we can call a person who started booking a call and did not finish;
• such contact is limited to one matter: finishing the booking that was started;
• at any time you can object to this processing or ask for these data to be deleted by writing to hello@gethelpify.com, and we will do so without asking for a reason.

On the service pages (implants, orthodontics, cosmetic dentistry, cleanings, pediatric dentistry) there is no form before the calendar: you choose a time right away in the booking calendar. If none of the times works for you, you can leave your name and phone number there with a request for a call. We save them only after you click the button and use them solely to call you about the time of the call. We accept objections and requests for deletion of these data in the same way, at hello@gethelpify.com.

The calculator on the site runs in your browser: we do not send the numbers you enter and we do not store them on our side. The form on the sample service page is an example: it sends nothing and stores nothing.

We do not seek to obtain special categories of data (Art. 9 GDPR). The site is addressed to business owners (adults). We do not direct our services to children.

3.6. Whether you have to provide data

You do not. Providing data is voluntary and no law obliges you to do so. Without your name and phone number we will not call you back, and without the data in the booking form we will not arrange a call.

§ 4. Purposes and legal bases of processing

Every processing operation has its legal basis:

§ 5. Voice demonstration and recording of the conversation

The voice demonstration is no longer available on the site; since October 6, 2026, the site does not hold voice conversations and does not record conversations.

We record online meetings about working together, including the free 30-minute call on Google Meet, and convert them to text (transcription) with a tool called Fathom. Fathom joins the meeting as a visible participant named "Fathom Notetaker", so you can see it from the start of the call. We make phone calls about working together through CloudTalk and may save a recording and a transcript of them. We do this to have accurate notes from the conversation and to return to what was agreed without asking you to repeat it. The recording and the transcript go to the tools listed in § 9 and to our database. If you do not want a recording, say so at the start of the conversation or write to hello@gethelpify.com: we will not record the conversation, or we will delete the recording and the transcript.

§ 6. Voice data and biometrics

A person's voice may, under certain conditions, constitute biometric data within the meaning of Art. 4(14) GDPR. We explain honestly how we process voice:

• Speech understanding: if a conversation is recorded (§ 5), voice is processed in order to recognize the content of what was said (transcription). The recording is not used to identify a person on the basis of voice characteristics; this is ordinary data (Art. 6 GDPR).
• Voice biometrics (we do not use it): we do not identify or authenticate persons on the basis of the unique characteristics of their voice.
• Voice cloning: we do not clone the voices of real people without their written consent.

§ 7. AI transparency (AI Act)

We apply the transparency obligations arising from Regulation (EU) 2024/1689 (the AI Act), in particular Art. 50, concerning AI systems interacting with people. In practice this means that:

• the site does not hold conversations with an AI system: it has no chat and no voice assistant;
• if an AI system were to hold a conversation with you, we will tell you so clearly before it starts, and at any point you will be able to ask to be redirected to a human;
• we do not design conversation scenarios intended to convince the other person that they are talking to a human, or to mislead them;
• we do not use practices prohibited by the AI Act, including emotion recognition in the context of employment and education or biometric categorization of protected characteristics;
• AI tools help us prepare transcripts of conversations and drafts of messages; a message prepared this way is read and sent by a human.

§ 8. Profiling and automated decisions

We do not make decisions about you based solely on automated processing that would produce legal effects within the meaning of Art. 22 GDPR, and we do not assess in this way your rights, creditworthiness or qualifications.

For marketing purposes we may use profiling to a limited extent (matching content to interests), to which you may object at any time.

§ 9. Recipients of data

We pass data only to companies without which the site and our services would not work. They process it solely on our instructions, under a data processing agreement. The exception is Meta: with the Meta pixel we are joint controllers (§ 13a).

Passing data to the booking system. The calendar is embedded on our site, but it is run by Cal.com as our processor.

• Service pages: when you open one of them, your browser asks Cal.com for available times and Cal.com sees your IP address in doing so. When you choose a time, we pass to Cal.com a technical identifier of the visit, information that the booking comes from this page, and the campaign parameters from the page address (utm, fbclid, gclid). You enter your name, email and number yourself in the Cal.com form.
• Home page: after you submit the form, we pass to Cal.com your name, email address, phone number and a technical identifier of the inquiry, in order to fill in the booking fields for you.

The booking confirmation with the Google Meet link is sent by Cal.com. We copy the booking data to our database in order to link the booking with the inquiry and to notify the owner about the time.

§ 10. Transfers of data outside the European Economic Area

Some of the recipients in § 9 are based in the USA or use servers in the USA. We base the transfer of data on:

• European Commission Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework (Art. 45 GDPR), where the company is on the DPF list (dataprivacyframework.gov): this applies to Google, Meta and Vercel;
• standard contractual clauses adopted by Commission Decision (EU) 2021/914 (Art. 46(2) (c) GDPR), if the agreement with a provider that is not on the DPF list provides for them: this applies to Cal.com and Supabase. We are still checking the compliance of these agreements with Decision 2021/914.

For Telegram, through which the notification to the owner goes today, we have not yet confirmed the transfer mechanism: we are working on making that notification carry no personal data at all.

For Fathom, CloudTalk and Anthropic we are still confirming the place of data processing and the transfer mechanism.

We will send a copy of the clauses, once we have confirmed them, on request sent to hello@gethelpify.com.

§ 11. Your rights

In connection with the processing of data you have the rights arising from the GDPR:

• the right of access to data and to receive a copy of it (Art. 15);
• the right to rectification of data (Art. 16);
• the right to erasure of data (Art. 17);
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing based on legitimate interest, including direct marketing (Art. 21);
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stanisława Moniuszki 1A, 00-014 Warszawa).

You can submit a request to exercise your rights at hello@gethelpify.com or in writing to the address of the Controller's registered office. We reply without undue delay, as a rule within one month.

Right to object. If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may at any time object on grounds relating to your particular situation. You may object to direct marketing at any time, without giving a reason, and we will then stop using your data for that purpose. An email to hello@gethelpify.com is enough.

§ 12. Data security

We apply technical and organizational measures appropriate to the risk (Art. 32 GDPR): encryption of connections (TLS/HTTPS), role-based access control, authentication of administrative accounts, regular security updates, backups, and confidentiality undertakings and authorizations for persons with access to data. We also apply an incident response procedure in line with Art. 33 GDPR.

§ 13. Cookies and similar technologies

Without your consent the site does not store cookies in your browser. In browser storage it stores only what the table below lists: your choice from the consent window and technical markers that disappear when you close the tab. We start analytics and marketing files only after consent in the given category. You can change your consent at any time here: Cookie settings, and also in your browser settings. After you withdraw consent we delete the Google and Meta files from this domain.

The request for available times to Cal.com (§ 9) does not store anything in your browser.

§ 13a. Meta Pixel and joint controllership with Meta

If you consent to marketing files, the Meta Pixel runs on our site. As regards collecting data on our site and passing it to Meta, we are a joint controller together with Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland). Purpose: measuring the effectiveness of our ads on Facebook and Instagram and reaching people who visited the site with advertising. We agreed with Meta that we provide you with this information, and Meta is responsible for fulfilling your rights (Art. 15-20 GDPR) in respect of the data it stores after receiving it. Information on how Meta processes data, on what basis and how to exercise your rights against Meta: facebook.com/about/privacy.

§ 14. Changes to the Policy

We may update this Policy in connection with changes in law, technology or the scope of services. The current version is always available at this address, with the date of the last change visible at the top of the document.