Privacy Policy

Last updated: September 23, 2026

Helm Information Security LLC ("Helm," "we," "us") is a cybersecurity consultancy based in Wisconsin. This policy explains what information we collect, how we use and share it, how long we keep it, and what choices you have.

1. Scope

This Privacy Policy applies to information we collect through our website, when you email or call us, and when you book a consultation through our scheduling link. It also covers the business contact information of our clients and prospective clients, such as names, email addresses, phone numbers, meeting details, and our correspondence with them.

This Privacy Policy does not cover information we process on behalf of our clients while delivering services, such as forensic evidence, system logs, mailbox exports, or other data from client environments. That processing is governed by our agreements with those clients.

Our website and services are intended for businesses in the United States.

2. Information We Collect

Information you provide. Our website has no forms. When you email us, call us, or book a consultation, we receive the information you choose to share: typically your name, organization, email address, phone number, meeting time, and the content of your message or booking notes.

Website usage information. When you visit helminfosec.com, our analytics tools record pages viewed, the referring site or campaign, device and browser type, approximate location derived from your IP address, and clicks on our scheduling, email, phone, and newsletter links.

Technical and security information. Our hosting and network providers process IP addresses, request times, requested URLs, browser user agents, and security events in order to deliver the site and protect it from abuse.

Advertising information. Google's tags on our site may process your visits and interactions using cookies and device identifiers, including to build advertising audiences as described in section 4. When you interact with one of our ads, Google also uses ad click identifiers to attribute your visit and later actions on our site to that campaign.

Newsletter. Our newsletter is published on Substack. Our site only links to it. If you subscribe, you do so on Substack, which collects your email address and shares it with us as the publisher.

3. How We Use Information

• To respond to your inquiry and to schedule and hold consultations
• To maintain business relationships and records with clients and prospective clients
• To operate, secure, and troubleshoot our website
• To understand how visitors find and use our site
• To measure the effectiveness of our advertising
• To send our newsletter to subscribers through Substack
• To comply with legal obligations and protect our rights

4. Analytics, Advertising, and Embedded Content

Google Analytics 4. We use Google Analytics, which sets first-party cookies to distinguish visitors and measure visits and interactions. For visitors in the United States, we have enabled Google signals, which lets Google associate activity on our site with signed-in Google accounts whose owners have turned on ad personalization, so that we can see aggregated cross-device reports. We do not receive the identity of those account holders. Our Analytics retention settings keep event-level data for 2 months and user-level data for 14 months, and the 14-month period restarts each time the same visitor returns. Aggregated reports are not subject to these limits. You can learn how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites, and you can opt out of Google Analytics with Google's browser add-on.

Cloudflare Web Analytics. We also use Cloudflare Web Analytics, which measures page views and site performance without setting cookies.

Google Ads. We run advertising campaigns from time to time, targeted to the United States. Our Google Ads account is linked to Google Analytics so that actions on our site, such as clicking our scheduling, email, or phone link, can be counted as conversions for a campaign. Our Google Ads account also has enhanced conversions enabled. That feature can send contact information entered on a website to Google in hashed form, to match conversions to Google accounts. Hashing does not make information anonymous.

Remarketing lists. Using data from the Google tag on our site, Google Ads automatically creates audience lists of people who have visited our site or completed a conversion. Advertisers can use such lists to show ads to past visitors. We do not currently use these lists to target ads.

Visitors from Europe. For visitors from the European Economic Area, the United Kingdom, and Switzerland, our site sets Google's consent controls to "denied" before any Google tag runs. As a result, Google's tags do not store analytics or advertising cookies for these visitors, do not send user data such as enhanced conversion data to Google for advertising, and do not use their data for personalized advertising. Ad click identifiers are removed from these requests, and Google signals is disabled for these regions. Google may still receive cookieless signals, such as page views and conversion events, which it can use for aggregated measurement and conversion modeling.

Embedded videos. Some pages offer YouTube videos. The video player does not load until you choose to load it. Once loaded, YouTube, which is operated by Google, may set cookies and collect information about your viewing under Google's privacy policy.

Because of these tools, Google may collect information about your online activity over time and across different websites when you visit our site. You can manage ad personalization in Google's My Ad Center, and you can block or delete cookies through your browser settings or an extension without losing access to our site's core content, although embedded videos and other third-party features may not work. Our website does not currently respond to browser Do Not Track signals.

5. How We Share Information

We share information with the following categories of recipients:

• Hosting and network providers. Our site is hosted on GitHub Pages and delivered through Cloudflare, which provides content delivery and security. They process technical information, including visitor IP addresses, under their own policies, and Cloudflare may set strictly necessary cookies when it presents a security challenge. See the GitHub Privacy Statement and the Cloudflare Privacy Policy.
• Email and calendar. Messages to our addresses and booked meetings are stored in Google Workspace (Gmail, Google Groups, and Google Calendar).
• Scheduling and meetings. Our scheduling link takes you to Calendly, where you enter your name, email address, meeting time, and any notes. Calendly shares the booking with us and adds it to our Google Calendar with a Zoom meeting link. See the Calendly Privacy Notice and the Zoom Privacy Statement.
• Analytics and advertising providers. Google and Cloudflare, as described in section 4. Google also processes this data for its own purposes as described in its policies.
• Newsletter. Substack, if you subscribe. See the Substack Privacy Policy.
• Legal and safety. When required by law or valid legal process, or when needed to protect the rights, property, or safety of Helm, our clients, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.

We do not sell personal information for money.

6. How Long We Keep Information

• Records in our own accounts. Emails, calendar entries, Calendly bookings, and business contact records stored in our Google Workspace and Calendly accounts are our responsibility even though those providers host them. We do not apply a fixed deletion schedule. We keep these records while they remain relevant to responding to you, our business relationship, or legal, tax, or professional obligations, and we delete them on request as described in section 7.
• Newsletter subscribers. We keep your subscriber record in our Substack account while you are subscribed. After you unsubscribe, Substack may keep a record that you unsubscribed, which prevents further newsletters from being sent to you. On request, as described in section 7, we remove the subscriber information we control from our Substack account. Substack may keep its own records, such as backups and suppression lists that prevent future emails, under its own policies.
• Analytics and advertising records we manage. Google Analytics data is kept as described in section 4. Audience lists, conversion records, and other advertising records in our Google Ads account are kept according to Google's retention practices and the settings Google makes available to us. For example, audience lists follow the membership duration set for each list. We can adjust those settings and use the deletion controls Google provides, but not every type of Google Ads record can be deleted by an advertiser.
• Provider-controlled records. Operational and security records that our providers keep for their own services, such as hosting and network logs and the system records of Google, Calendly, Zoom, and Substack, follow each provider's own retention practices.

7. Your Choices and Requests

You can ask us to access, correct, or delete the personal information we hold about you by emailing [email protected] or through our contact page. We will take reasonable steps to verify your identity before acting on a request. We may keep information when we are legally required to, or when it is needed to establish, exercise, or defend legal claims.

We can locate records tied to your name, email address, or phone number, such as correspondence, bookings, and newsletter subscriptions. We generally cannot link analytics or advertising identifiers to a named person. The browser and Google controls described in section 4 mainly limit future collection; blocking or deleting cookies does not necessarily erase information already collected. If you have questions about those records, you can still contact us and we will help where we can.

Newsletter. You can unsubscribe at any time using the unsubscribe link in any newsletter email or through your Substack account settings. Unsubscribing stops future newsletters but does not delete your subscriber record. To have us remove the subscriber information we control from our Substack account, email us at [email protected]. Substack may keep its own records, such as backups and a suppression record that prevents future emails, under its own policies.

8. Security

Our website is served only over encrypted HTTPS connections. We protect the accounts that hold the information covered by this policy with multi-factor authentication and limit access to the people who need it. Ordinary email and phone calls may not be encrypted end to end, which is one reason for the guidance below. No system is perfectly secure.

Please do not send passwords, forensic evidence, or sensitive incident details by email or in booking notes. Contact us first and we will arrange a secure way to transfer them.

To report a security vulnerability, email [email protected]. Our security.txt file lists the same contact.

9. Children's Privacy

Our website and services are directed to businesses and organizations. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will change the "last updated" date at the top of this page, and for material changes we will also note the change at the top of this page.

11. Contact Us

Questions about this policy or privacy requests can be sent to [email protected], through our contact page, or by phone at (608) 448-6075.

Helm Information Security LLC
Wisconsin, United States