Helix Research Intelligence
Privacy Policy
Last updated: July 1, 2026
Data controller
The data controller is Helix Research Intelligence, a SASU with its registered office at 50 rue Colbert, 92700 Colombes, France. In Atlas's current setup, Helix Research Intelligence acts as data controller for the data processing covered by the website, account management, security, support, inbound requests and operation of the Platform. Data protection contact point: [email protected].
Data collected
The data that may be processed includes in particular: identification and account data; business email addresses; invitation, authentication and session management data; connection data and technical logs; IP addresses; user-entered content and prompts; imported documents and content; project, workspace and service usage metadata; navigation and usage metadata; and support or assistance information.
When using the website or the Platform, certain technical data may be collected automatically, such as technical logs, dates and times of connection, technical identifiers, browser information and IP addresses. Users may also provide data when creating an account, using the Platform, importing content, submitting support requests or engaging in commercial discussions.
Where certain data is not collected directly from the data subject - for example when it comes from a client organization, an account administrator, public scientific sources or an authorized integration - Helix Research Intelligence seeks to provide the required information under the conditions set by applicable regulations.
Purposes of processing and legal bases
Processing may notably pursue the following purposes: account management and authentication; provision of the Platform; hosting, indexing and processing of imported content; execution of AI features; user support; security, fraud prevention and logging; service improvement; compliance with legal obligations; and defense of legal rights.
Depending on the case, processing is based on the performance of a contract or pre-contractual measures, the legitimate interests of Helix Research Intelligence, compliance with a legal obligation, or consent where required. For the contact form, processing is based on pre-contractual measures or the legitimate interest in responding to an inbound request.
Recipients and subprocessors
Data may be accessible to authorized internal teams of Helix Research Intelligence; technical providers and hosting providers, including the main infrastructure currently hosted on OCI Cloud (ACI / OCI Cloud), 2 rue Ampere, 67450 Mundolsheim, France - SIREN 908 563 307; the transactional email provider Brevo, when an email or contact request must be handled; AI providers OpenAI and DeepSeek, to the extent necessary for the execution of the relevant features; and legally authorized authorities where required by law.
A detailed list of subprocessors is available at /legal/subprocessors.
Artificial intelligence providers
Certain Atlas features may rely on third-party AI providers. Depending on the product and contractual configuration, prompts, document segments, metadata or instructions may be transmitted to them in order to generate the expected output. In the current production setup, the identified AI providers are OpenAI and DeepSeek.
Transfers outside the EU
Where certain providers or subprocessors are located outside the European Union or process data from third countries, Helix Research Intelligence implements appropriate safeguards where required, such as adequate contractual clauses or other recognized mechanisms.
Retention periods
| Category | Retention period |
|---|---|
| Technical logs | 12 months |
| Account data | For the duration of the account, then 2 years after closure or last activity |
| Contact requests with no contractual follow-up | 2 years from the last meaningful contact |
| Support exchanges | 2 years after closure, unless a legal obligation requires otherwise |
Where certain data must be kept longer in order to comply with legal, accounting, tax, evidentiary or dispute-management obligations, it may be subject to intermediate archiving with restricted access.
Security
Helix Research Intelligence implements reasonable technical and organizational measures to protect the confidentiality, integrity and availability of processed data.
Data subject rights
Subject to the conditions provided by applicable regulations, data subjects notably have rights of access, rectification, erasure, restriction, objection, portability where applicable, and the right to define instructions regarding the fate of their data after death. Where processing is based on consent, consent may be withdrawn at any time.
Requests may be sent to [email protected], together with any information useful for identifying the requester. Requests are handled manually, in principle within one month. In case of unresolved difficulty, data subjects may lodge a complaint with the CNIL.
Automated decisions and profiling
In the current state of the service, Atlas does not make fully automated decisions producing legal effects or similarly significant effects on individuals within the meaning of the GDPR. The Platform may perform algorithmic or AI-assisted processing on scientific and professional content - relevance scores, syntheses, rankings, link suggestions - as analysis support, subject to human review.
Health data and minors' data
In its initial version, Atlas is not intended to receive or process identifiable personal health data without a specific contractual framework, an appropriate compliance review and suitable security measures. The Platform is not designed for use by minors in a consumer context.
Policy changes
This policy may be updated to reflect legal, technical or organizational changes.
Processing summary table
| Data category | Purpose | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Account data | Account creation and access management | Contract / pre-contractual measures | Internal teams, hosting provider, auth providers | Account duration, then 2 years |
| Technical logs and IP addresses | Security, debugging, abuse prevention | Legitimate interest / legal obligation | Internal teams, hosting provider | 12 months |
| Prompts and imported content | Service execution and AI features | Contract | Authorized internal teams, hosting provider, AI providers | According to account lifecycle |
| Support tickets and emails | User assistance | Contract / legitimate interest | Support teams and related tools | 2 years after closure |
| Contact or demo requests | Responding to a commercial request | Pre-contractual measures / legitimate interest | Internal teams, hosting provider, Brevo | 2 years from the last contact |