Security

Payments are processed by Tap Payments. When you pay, you are handed to Tap’s own hosted payment page to enter your card details. SmarThinkerz SPC never receives, processes or stores a card number, CVV or expiry date, and no part of Helmable has access to them.

What we keep is the outcome of the payment: the plan bought, the amount, the currency, the status, a Tap charge reference, and the name and email you gave at checkout. That is what appears on our side; the card itself does not.

We do not store cards for future use and nothing renews automatically. Each month is a separate, one-off charge that you choose to make.

Application data — your account, campaigns, brand settings, generated content and billing records — is held in a PostgreSQL database hosted on Supabase, in the Singapore (ap-southeast-1) region.

Uploaded assets are stored in Supabase Storage in the same project. Traffic between your browser and the application is served over HTTPS.

Access is enforced in the database itself using PostgreSQL Row Level Security, not only in the application. A signed-in account can read and write its own rows; the policies reject anything else even if a request is crafted by hand.

Administrative access is a separate, explicitly granted role. It cannot be self-assigned: the database blocks an account from changing its own role, so compromising an ordinary login does not yield an administrator.

The privileged key that bypasses these policies is used only by server-side code — checkout, the payment webhook and the admin order view. It is never sent to the browser and never appears in any page we serve.

Text you submit to the AI tools is sent to OpenAI to generate the result you asked for. Transactional email — receipts and account notices — is sent through Resend. Payment data goes to Tap Payments as described above.

We do not sell personal data, and we do not share it for advertising.

You can export the content you create from the dashboard at any time, and you can ask us to delete your account and its data by emailing reply@smarthinkerz.com.

We hold no formal security certification. We are not SOC 2 or ISO 27001 audited, and we publish no uptime guarantee, because we do not currently operate the monitoring that would make such a figure meaningful. If you need any of these for a procurement process, tell us rather than assuming — we would rather lose the sale than misstate this.

If you believe you have found a security issue, email reply@smarthinkerz.com with enough detail to reproduce it. Please give us a reasonable chance to fix it before disclosing it publicly.