Who we are
HelloWorld is a solo studio operated by Bryan Hurley (helloworld.ie), based in Ireland. For data protection enquiries, contact us at hello@helloworld.ie.
What data we collect
We collect the following personal data through our website:
- Free AI access check (and checks we run as part of an audit): website URL, business type, business name, and email address. This data is used to run your check, deliver your report, and contact you about the results. The email address you give for the free check is the only personal detail we need to send you your result.
- Audit enquiries and early-access requests: your name, work email, company, website, industry and any message you write. We use this only to reply to your enquiry and prepare for a scoping call.
- Client intake form (PII): business name, address, phone, email, website URL, business details, Google account email, and optionally customer contact details for review seeding. This is the personal information we use to deliver the services you have engaged us for.
- Uploads: if you are a client, you may upload assets such as your logo, cover image, and business photos. These are stored under a private, unguessable path, are marked no-index so search engines do not list them, and are used only to deliver your service.
- Analytics: we collect usage data (page views, scroll depth, button clicks) using our own first-party analytics system. Your IP address is anonymised before it is stored (we do not retain full IP addresses), and we do not use third-party tracking or advertising cookies.
How we use your data
- To run AI search checks and deliver reports
- To set up and manage your Google Business Profile, Bing Places, and directory listings
- To deploy schema markup and technical optimisation on your website
- To send review request emails to customers you have provided (with your explicit consent)
- To deliver monthly reports on your AI search citation performance
- To send you service-related communications (onboarding, handover, reports)
- To send marketing communications only if you have opted in
Legal basis for processing
We process your data under the following legal bases (GDPR Article 6):
- Consent: when you submit the check form, intake form, or opt in to marketing communications.
- Contract: when processing is necessary to deliver the services you have engaged us for.
- Legitimate interest: for first-party analytics that help us improve our website and services.
How we store and protect your data
Our own systems and database are hosted on servers within the European Economic Area. Client data is encrypted at rest. We never store passwords: CMS and hosting credentials are collected via separate secure one-time links and deleted after use.
Access to client data is restricted to authorised personnel. We do not sell your data or share it with anyone for advertising. We do share specific pieces of it with the small number of service providers listed below, because we need them to deliver the service. Where you have engaged us for listings work, we also share it with the platforms you'd expect (for example, submitting your business details to Google Business Profile on your behalf).
Service providers we use
A few trusted companies (our "data processors") handle parts of the service. We send each one only what it needs to do its job:
- Stripe (payments): when you pay for a service online, your name, email address and card details go directly to Stripe, our payment provider. Your card number never touches our servers. Stripe is a US company.
- OpenAI (report writing): to draft parts of your report and rewrite technical findings in plain English, we send business details such as your business name, type, location and services to OpenAI, a US company. We never send passwords or payment details, and under our API agreement OpenAI does not use this data to train its models.
- SerpApi (live Google results): the research we run for an AI Visibility Audit looks up real Google results for the questions your buyers ask. Those lookups can include your business name and location. SerpApi is a US company.
- Google PageSpeed (speed check): we send your website address to Google's free speed-testing service to measure how fast your site loads.
- Email delivery: when we send you a report or service email, the email service we use processes your name and email address.
Transfers outside the EEA
Stripe, OpenAI and SerpApi are based in the United States. When your data goes to them, the transfer is protected by safeguards approved by the European Commission (the EU–US Data Privacy Framework and/or Standard Contractual Clauses), which hold those companies to EU-level data protection standards.
Data retention
- Check data (including the free-check email): retained for 12 months after the check, then deleted.
- Enquiries and early-access requests: retained for 12 months after you last contacted us, then deleted, unless you become a client.
- Client data and uploads: retained for the duration of the engagement plus 12 months, then deleted unless you request earlier deletion. Uploaded files are removed when the related client record is erased.
- Analytics data: retained for 24 months in anonymised form (no full IP addresses).
- Marketing contacts: retained until you unsubscribe.
Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data
- Withdraw consent at any time
- Object to processing based on legitimate interest
- Request data portability
- Lodge a complaint with the Data Protection Commission (dataprotection.ie)
To exercise any of these rights, email hello@helloworld.ie. We will respond within 30 days.
Data export and erasure. On request we will provide a copy of the personal data we hold about you in a portable, machine-readable format. On an erasure request, we permanently delete your personal data (including your check records, client profile, and any uploaded files), except where we are legally required to retain certain records. We will confirm once erasure is complete.
Cookies and browser storage
We do not use cookies at all: no third-party cookies, no advertising cookies, no tracking cookies. Our first-party analytics records anonymised usage without identifying you personally, and the fonts on this site are served from our own server, so no request goes to Google when a page loads.
The site keeps a few small settings in your browser's own storage: your light or dark theme choice, and a sign-in token while you are logged in to the client portal. These stay on your device, are strictly necessary for the site to work, and are never used to track you.
The HelloWorld Companion browser extension
Clients on a programme may install the HelloWorld Companion, a Chrome extension that fills in the figures and evidence their programme asks for while they visit the report pages they already use. It is optional, and nothing in the client portal depends on it.
What it keeps in your browser. The address of your portal, the sign-in token from your portal session (your password is sent to your portal once to obtain it and is never stored), the auto-capture switch, a record of which listed report pages you visited in each period (keyed by report, not by address), the outcome of the last capture, and the page and step lists it last fetched from your portal.
What it reads. Only pages on sites you have explicitly allowed, and on those sites only the report paths on its list. On a page that matches a step in your programme, it reads the figures that step names. It never reads passwords, messages or pages on sites you have not allowed, and it does not record your browsing history.
Where it sends what it reads. Only to the HelloWorld portal you signed in to: the figures and the fields they fill, to your step; report tables, to your Results; and, when a page could not be read, a failure report so we can fix the reader. A failure report contains the reader's name, a reason code, the names of the fields it could not find, the extension version, the page address without its query string, and a fingerprint of the page's structure. It never contains page text or figures. Nothing is sent to any other party.
Your controls. You can remove any site from the Companion's list of allowed sites, sign out, turn auto-capture off, or remove the extension, which deletes everything it kept. The personal data it sends to your portal is covered by the rest of this policy.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page indicates when the most recent changes were made. Continued use of our website after changes constitutes acceptance of the updated policy.