Privacy Policy

Last updated: 2026-07-04

Helper is a record-keeping tool that processes personal data about employers and domestic helpers. This policy explains what we collect, why, and the choices you have. It is written to align with the Hong Kong Personal Data (Privacy) Ordinance (PDPO).

1. Who is the data controller

The “data controller” responsible for your personal data is the operator of the Helper instance you are using — the person or organisation that deployed and runs this software. If you are unsure who that is, it is whoever gave you access to this site. The maintainers of the open-source Helper project are not a party to your use of any specific deployment.

2. What we collect

• Account: email address and a hashed password (stored using bcrypt; the plain password is never kept).
• Employer profile: display name.
• Helper profile: full name, nationality, phone number, and contract/employment start date.
• Employment relationship: the link between an employer and a helper, including status and history.
• Pay records: pay date, amount, optional payment method, and confirmation status.
• Leave records: leave type, dates, status (pending / approved / rejected), and any optional reason you enter.
• Operational data: a locale (language) preference cookie and an authenticated session cookie. We log minimal server-side error information needed to keep the service running.

3. Why we use it (purpose & legal basis)

We process this data to provide the record-keeping service you asked for — letting employers and helpers record and review pay and leave. The legal basis is the performance of your request to use the service, and (for anything beyond that) your consent. We do not use your data to train models, build advertising profiles, or sell it.

4. Where it is stored

Data is stored in the PostgreSQL database of the instance you use, on hosting chosen by the operator. Depending on that hosting, data may be processed or stored outside Hong Kong, which may involve a cross-border transfer. If you need to know the exact location, ask the operator.

5. Sharing & sub-processors

We do not sell your data. The core application has no third-party analytics or advertising. The operator’s hosting and infrastructure providers may process data on the operator’s behalf as sub-processors. We may disclose data where required by law or a binding order of a court or government authority.

6. Retention

We keep your data for as long as your account and the relevant employment relationship are active. To delete your data, contact the operator (see below). Note that employers may have a separate legal duty under Hong Kong law to retain certain employment records.

7. Security

Passwords are hashed; access is enforced server-side by role (employers see only their own helpers; helpers see only their own records); sessions use a signed token. No method of transmission or storage is fully secure, however, and we cannot guarantee absolute protection.

8. Your rights

Under the PDPO you may:

• know whether we hold personal data about you and request access to it;
• request correction of inaccurate data;
• find out the purposes for which data is used; and
• withdraw consent for optional processing and request deletion where the law allows.

To exercise any of these, contact the operator. We respond within a reasonable time.

9. Cookies

We use only an authentication session cookie and a language-preference cookie. We do not use tracking or advertising cookies.

10. Children

The service is not intended for anyone under 18. A helper’s personal data is entered by their employer; helpers should be informed that their data is being recorded.

11. Changes to this policy

We may update this policy. The “Last updated” date above reflects the latest version.

12. Contact & governing law

To ask about your data, contact the operator of your instance. This policy is governed by the laws of the Hong Kong Special Administrative Region. See also the Terms of Use and the disclaimer.Reach the operator via the contact page.