Skip to main content

ADR-0006 — Data ownership commitment

  • Status: Accepted
  • Date: 2026-04-18
  • Decision-makers: Tom Anderson

Context​

Most legacy POS systems (AIM, Lightspeed, Square) make data export hard. Either the format is proprietary, the export costs extra, or the export is gated behind "professional services." This is a vendor-lock-in pattern that hurts trust and limits the shop's freedom.

Helm's positioning depends on being the opposite. The question is whether to enshrine this in a written policy + technical commitment, or leave it informal.

Decision​

Make data ownership a written, code-visible commitment. Specifically:

  1. On-demand full export — Settings → Data → Export button. Generates a .tar.gz containing: full SQL dump, CSV per table, all R2 objects, schema documentation, restoration instructions. Free, no support ticket.
  2. No proprietary format — every export format is open: SQLite dump, CSV, JSON, PDF.
  3. On exit, the shop keeps everything — when a shop terminates the contract, Helm generates the bundle, confirms receipt, then decommissions. The shop owns the bundle.
  4. No third-party data sharing — Kvick will not sell, share, or use shop data for anything except operating that shop's software. (See data ownership principle.)
  5. Customer-side data subject rights — Helm provides flows for the shop to honor erasure requests, access requests, portability requests from the shop's customers.

This is enshrined both in the Master Services Agreement (legal) and in Settings → Data → Your Rights (UI).

Consequences​

Positive:

  • Differentiates Helm from incumbents on a meaningful axis
  • Reduces sales friction with skeptical shop owners
  • Makes the exit ramp clear, which paradoxically reduces churn (people who can leave easily don't feel locked in, and don't leave just to prove they can)
  • Aligns with single-tenant per shop — single-tenant makes export operationally cheap

Negative:

  • Maintenance burden: the export bundle must stay current with schema changes. Mitigation: integration test that generates a bundle and verifies its contents on every release.
  • Some features (cross-shop analytics, AI model training on aggregated data) are off the table by policy
  • Shop owners may export and re-import into a different system, eventually leaving Helm

Mitigations:

  • Off-the-table features are off the table on purpose; they're not what makes Helm valuable
  • Easy exit is a feature, not a bug. Helm's value proposition is the in-product experience, not the data lock-in.

Notes​

This decision interacts heavily with the audit-everything principle — the audit log is part of what the shop owns, and erasure requests must be done in a way that preserves audit integrity (scrub PII fields, keep row IDs).

See also​