--- title: "How Helix handles your voice - Helix" description: "What happens to your voice during a Helix check: the analysis runs on your own device, the audio is discarded, and nothing is sent to or stored by Helix." source: "/privacy/voice-check" updated: "2026-09-17" --- # How Helix handles your voice Last updated 17 September 2026 - Version 1.5 A business you're using has asked you to complete a quick voice check, to confirm your age, confirm it's really you, or confirm you're a real person rather than an automated bot. That check is powered by Helix Capsule. This notice explains, in plain terms, what happens to your voice when you do it. The short version: your voice is processed on your own device and is not sent to us or kept by us. The rest of this notice fills in the detail. ## 1. What the check does Depending on what the business has switched on, the Helix voice check may do one or more of the following: - Estimate your age from the sound of your voice, to confirm whether you meet an age requirement. - Confirm it's you, by comparing your voice to a voice you set up earlier with that business. - Detect a synthetic or recorded voice, to stop someone using AI-generated or pre-recorded audio to impersonate a person, or replaying a recording of someone else. - Confirm you're a real person rather than an automated bot. You'll usually be asked to say a few words or read out some digits shown on screen. ## 2. The most important point: it happens on your device The analysis of your voice runs on the device you're using, your phone, tablet or computer, inside the Helix software running there. The three checks that involve your voice all run there and not on our servers: estimating your age, confirming it's you, and detecting a synthetic or recorded voice. The bot check works differently. It doesn't analyse your voice at all. It looks at ordinary technical signals from your browser to tell a real person apart from an automated script, and a specialist provider runs it for us. That means your device's internet address is visible to that provider, and to us, while the check is being served. This is true of any website you visit. It isn't used for anything to do with your age or your voice, and it isn't kept in our records of the check. Your recorded audio is processed on your device and then discarded. It is not transmitted to Helix and we do not store it. We do not receive a copy of your voice, a transcript of what you said, or a "voiceprint" of how you sound. The only things that leave your device are the outcome of the check and the figures the software used to reach it. For example, "meets the age requirement: yes/no," along with how confident the software was. These are sent back to the business so it can let you proceed. This is a deliberate design choice. It means there is no central store of people's voices at Helix to be lost or misused. ## 3. Voice sign-in and voice matching (only if the business uses it) If you set up voice sign-in with a business, the software creates a private reference of how your voice sounds so it can recognise you next time. Like the live check, this reference is created and held on your own device. We do not receive it or store it. It's kept in your browser's storage in encrypted form, and the key that unlocks it is held by your device's own security hardware or passkey system rather than by us or by the browser. On devices that don't support that, no reference is stored at all and voice matching simply doesn't run. This reference is the one thing from a voice check that sticks around. It stays on your device until you clear the site's data or remove the passkey you set up, at which point the key is gone and what's left can't be unlocked by anyone, including us. ## 4. Who is responsible for your data Two organisations have a role, and which is which matters. The business you're using decides to run the check and acts on the result, for example deciding whether to let you in. In data-protection terms it is the controller of the check. If you have questions about why you were asked to verify, or you want to exercise your rights over the outcome, that business is your first point of contact. Helix (H3lix AI Ltd.) provides the software that performs the check. For the live check, Helix acts as a processor on the business's instructions. Because the check runs on your device and nothing identifying reaches us, we do not hold a record that we could connect to you from the check itself. For the outcome monitoring described in Section 7, Helix is the controller, and you can contact us about it directly at . ## 5. Your rights, and why some of them work differently here You have rights over your personal data under data-protection law (such as the UK GDPR and similar laws), including the rights to access it, correct it, and ask for it to be deleted. The honest position for the voice check is this: because nothing from the check is stored by us in a way that identifies you, Helix is not able to find "your" data and act on it. There is no stored record of you here to retrieve, correct or delete. This is a consequence of the privacy-protective design, not a way of avoiding your rights. Under data-protection law (UK GDPR Article 11), where an organisation genuinely cannot identify you from the data it holds, it isn't required to collect extra information about you just to make those rights actionable. What this means in practice: - **For the check itself:** there is no stored voice data at Helix to access or delete. - **For the voice reference, if you set up voice sign-in:** it's on your device, not ours, so it's yours to remove. Clearing the site's data or removing the passkey removes it. See Section 3. - **For the decision and your account with the business:** the business holds your account and acted on the result, so requests about the outcome, including asking a person to look again at a decision you think is wrong, go to the business, which is the controller. ## 6. Children Some Helix checks exist specifically to help confirm whether a user meets an age requirement, which means children may encounter them. The same on-device, nothing-retained design applies: a child's voice is processed on the device and discarded, and Helix does not keep it. Where a check produces an "under-age" result, that result is handled the same transient way as any other and is returned to the business to act on. Where a business uses voice matching, the same on-device voice reference described in Section 3 applies, and it stays on the child's own device in the same way. Its purpose there is protective: it helps stop someone else completing an age check on a child's behalf. Helix's fuller approach to children's data is set out in its Data Protection Impact Assessment and certification materials. ## 7. International handling Because the voice analysis happens on your device, the sensitive part, your voice, does not travel to our servers at all, wherever you are. What does reach our infrastructure in the United States is limited to two things. The technical signals needed to run a check securely, including the bot check described in Section 2. And a record of each check's outcome: which age band the software returned and how confident it was, held against a short-lived random session identifier. We use those records to check that the software keeps working as it should across all groups of speakers, and to spot coordinated attempts to defeat a check. Helix decides how this monitoring works and a business cannot switch it off, so Helix is the controller for it. The session identifier expires after an hour, and the records are kept for up to six months. They cannot be traced back to you by us, but until they are deleted we treat them as personal data and protect them accordingly. Where any of this involves data covered by UK or EU law, it is handled under an approved transfer arrangement. The precise mechanism is set out in our Privacy Notice at . ## 8. Questions - About why you were asked to verify, or about your account or the decision: contact the business whose service you're using (the controller). - About how the Helix check works, or about this notice: contact Helix at , or read our Privacy Notice at . ## Sitemap See the full [sitemap](https://helix.id/sitemap.md) for all pages.