Privacy Policy: HelpCCMS
Last updated: 3 August 2026.
1. Who we are
HelpCCMS is a service of Solimedia, established at Molenstraat G 64a, 9663 SV Nieuwe Pekela, the Netherlands, Chamber of Commerce (KVK) 50720295, VAT NL001904913B24.
Contact / privacy questions: solinger@solingertxt.nl.
Two roles, and the distinction matters. For your account, billing and usage data we are the data controller. For third-party personal data that you place in your content (for example, names of colleagues in a work instruction) you are the data controller and we act as processor on your behalf. The data processing agreement (Annex 1 to the Terms of Service) applies to that.
2. What data we process
- Account data: your email address and (hashed) password, managed through our auth provider.
- Content you import or create: the texts, documents and images you put into HelpCCMS to build topics and collections. This content may contain third-party personal data if you place it there. You decide that, and for that data we act as processor on your behalf (see §1 and the data processing agreement).
- Usage and billing data: your subscription status, payment data (processed by Stripe; we do not store card numbers) and invoices.
- Your email address, if you sign up for our newsletter: we store it to send you that newsletter and for nothing else, on the basis of your consent. You can withdraw it at any time, and the address is then deleted.
- Technically necessary data: a functional session cookie to keep you logged in. No third-party tracking or analytics cookies (no Google Analytics, no advertising pixels).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create your account and let you log in | Performance of the contract |
| Store your content + structure it into topics and collections with AI | Performance of the contract |
| Handle payments and invoicing | Performance of the contract + legal obligation |
| Transactional emails (welcome, password reset, payment status) | Performance of the contract |
| Retain invoices | Statutory (tax) retention obligation |
| Send you our newsletter, if you asked for it | Consent |
4. AI processing of your content
To structure your imported content into topics and collections, we send parts of that content to our AI processor, Anthropic. This happens solely to provide the service, and only for paid plans. The Free plan has no AI features, so content on a Free plan is never sent to an AI processor. We do not use your content to train AI models, and Anthropic does not train on content submitted through its API under its commercial terms.
5. Sub-processors
We engage the following processors:
| Processor | Role | Data stored in | Transfer basis for the US |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU region | Standard Contractual Clauses |
| Vercel | Application hosting | EU region | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Stripe | Payments and invoicing | US | EU-US Data Privacy Framework (certified) |
| Postmark (AC PM LLC, ActiveCampaign) | Sending transactional email | US | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Anthropic | AI processing of content (paid plans only) | US | Standard Contractual Clauses |
| Zoho | Our mailboxes, so any email you send us | EU data centre | Standard Contractual Clauses (intra-group) |
Where a processor is established outside the EEA, the transfer is based on the mechanism named in the last column: the EU-US Data Privacy Framework where that processor is certified with the U.S. Department of Commerce, and otherwise the Standard Contractual Clauses approved by the European Commission. Verified per processor on 3 August 2026 against each provider's own privacy documentation.
Supabase and Vercel store our data in an EU region. Both are US companies, so incidental access from the US (for example for support) cannot be ruled out; that is what the transfer basis in the table covers.
6. Retention periods
- Account data and content: for as long as you have an account. If you delete your account, we erase your data (see §8).
- Invoices: we retain invoices for 7 years due to the statutory tax retention obligation, also after deletion of your account. These remain available at our payment processor; the account PII is erased.
7. Security
Data is encrypted in transit (HTTPS) and stored with professional, secured processors. Access is isolated per user (row-level security) and file storage is isolated per workspace.
8. Your rights, including deletion we actually honour
You have the right of access, rectification, erasure, restriction, objection and data portability. Specifically:
- Deletion: you can delete your account yourself via your account page. That irreversibly erases your account, your workspaces and all your content, and immediately cancels any running subscription. (Invoices remain under the tax retention obligation, see §6.)
- Access/export/rectification: contact us at solinger@solingertxt.nl.
Complaint? You can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Cookies
HelpCCMS uses only a functional cookie for your login session. It is technically necessary; no consent banner is required for it. We place no third-party tracking, analytics or advertising cookies. The cookie statement names the cookie in question and explains which interface preferences we keep in your browser's local storage.
10. Changes
We may amend this policy. The current version is always on this page, with the date of last change at the top.
11. Language
This privacy policy is established in English; translations (including the Dutch one) are for information only. In case of any discrepancy, the English version prevails.