How we handle your data.

Helix & Frame is a design operations firm headquartered in Riyadh, Kingdom of Saudi Arabia. References to "we," "us," or "our" mean Helix & Frame. References to "you" mean any visitor to helixandframe.com or recipient of our communications.

When you submit the lead-magnet form, contact form, or otherwise email us, we collect the information you choose to share — typically your name, work email, company, role, and the message you write. We do not collect government identifiers, payment data, or special-category personal data through this site. Server-side, we record standard request logs (IP address, browser type, request path, timestamp) for security and abuse prevention; these are retained for 30 days and not linked to any submitted form.

We use the information you submit to (a) deliver the content you requested (e.g. The Operating Brief), (b) respond to your inquiry, and (c) follow up with one short business message in the days after. We do not subscribe you to a newsletter. We do not share, sell, or rent your data to third parties for marketing.

We rely on a small number of vetted sub-processors to operate this site and deliver email: Vercel (hosting), Resend (transactional email delivery), and Zoho Mail (our business inbox). Each is bound by its own terms and processes data only on our instructions. We do not transfer your data outside this scope.

Form submissions are delivered to our Zoho Mail inbox (EU data centre) and held there as part of our normal business correspondence. Resend processes the email-in-transit in its EU region and retains delivery logs for up to 30 days.

We retain your contact information for as long as it remains commercially relevant — typically 24 months from your last interaction — after which it is deleted, unless a contract or legal obligation requires longer retention. You can ask us to delete your data sooner at any time.

Under Saudi Arabia's Personal Data Protection Law, you have the right to (a) access the personal data we hold about you, (b) request correction of inaccurate data, (c) request deletion of your data, (d) withdraw consent for any processing based on consent, and (e) complain to the Saudi Data & Artificial Intelligence Authority (SDAIA) if you believe your rights have been violated. To exercise any of these rights, email chat@helixandframe.com. We respond within 30 days.

We use a single, privacy-first analytics tool that records aggregate, anonymised page views — no cross-site tracking, no advertising cookies, no fingerprinting. The cookie banner on this site lets you accept or decline analytics at any time. Declining does not affect site functionality.

We may update this policy as our practices evolve or as the law requires. Material changes will be reflected in the "last updated" date at the top of this page. Continued use of the site after a change means you accept the updated policy.

Questions, requests, or concerns? Email chat@helixandframe.com. Postal mail: Helix & Frame, Riyadh, Kingdom of Saudi Arabia.