HaloSuite Privacy Policy

Version 1.0. Effective Not yet effective — draft awaiting launch date.

This policy explains what personal information HaloSuite collects, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to the HaloSuite app, the website at halosuite.ai, our emails and our support.

"HaloSuite", "we" and "us" mean HaloSuite, a trade name of its operator, whose identity is kept on record and given where the law requires. The controller of your personal information is HaloSuite (hello@halosuite.ai). Email is the way to contact us about anything in this policy: hello@halosuite.ai.

The short version

• HaloSuite is a business tool. We collect what we need to run your account and your workspace, keep it secure, and support you.
• Your workspace content belongs to your business. For information about your customers and contacts, your business decides what is collected and why, and we process it on your behalf.
• AI features run on your own AI provider key. The text Halo needs is sent to that provider under your account.
• We do not sell personal information, we do not use it for targeted advertising, and we do not use your content to train AI models.
• Mobile numbers and text-message consent are never shared with third parties for their marketing.
• HaloSuite is not for anyone under 18.
• You can ask us to see, correct, export or delete your information at hello@halosuite.ai.

1. Two roles: our data and your business's data

• Information about you as a user (your account, your use of HaloSuite, your agreements with us, your support requests): we decide how it is used. We are its "controller" (in US state law terms, the "business").
• Information your business puts into HaloSuite about other people (leads, customers, contacts, appointment bookers, people who fill in your forms, people you email or text): your business decides how it is used, and we process it only to provide HaloSuite to your business. For that information we are your "processor" or "service provider", under our Data Processing Addendum. If you are one of those people and want to exercise your privacy rights, please contact the business that uses HaloSuite; we will help them respond.

2. What we collect

You give us:

• Account details: name, email address, password (stored only as a secure hash), two-factor authentication settings (the secret is encrypted), the invite code you used, your role, and your workspace's name.
• Business profile: what your business sells, to whom and where, its timezone, postal address, brand details and the claims you approve Halo to make.
• Workspace content: leads, contacts and their details (such as names, email addresses, phone numbers, companies and notes), sales pipeline, appointments and tasks, campaigns, drafts of emails, posts, texts and web pages, files you upload, invoices and payment requests, automations, conversations with Halo, and things you ask Halo to remember.
• Agreements: when you sign the Beta Confidentiality Agreement or accept other documents, we record which version you accepted and a fingerprint (SHA-256 hash) of its text, your typed name, the time, your account, your IP address and browser details, and your invite code.
• Support messages: what you send to hello@halosuite.ai.

When you connect another service (you choose which, and the service shows its own permission screen first):

• Your AI provider (for example Anthropic or OpenAI): your API key, stored encrypted, and records of your AI usage (such as the amount spent, the model and the time) so we can enforce the spending cap you set.
• Google: if you sign in with Google, your name, email address and Google account ID. If you connect Google Calendar, your calendars' events and free/busy times so Halo can book and avoid conflicts. If you connect Gmail, permission to send email from your address; reading your inbox is only requested where that feature is switched on and you agree to it on Google's screen.
• Meta (Facebook and Instagram), LinkedIn and X: account and page identifiers, access tokens (stored encrypted), and the posts and basic engagement data needed to publish and check what was posted for you.
• QuickBooks: the accounting records needed for the features you use, such as customers, invoices and payments.
• Plaid: read-only bank transaction data from the accounts you link (see "Bank data through Plaid").
• Twilio: your own Twilio account ID, auth token (stored encrypted) and sending number, and the texts sent and received through it.

Collected automatically:

• Technical and security data: IP address, browser and device type, pages and features used, request times, errors, sign-in events, and an activity history of important actions in your workspace (the audit log).
• Email delivery events: whether an email was delivered, bounced or marked as spam, and unsubscribe requests, so we stop sending to people who opted out.
• Browser storage: see "Cookies and browser storage".

From public or business sources, when you ask: if you use lead search, business listing details (such as a business's name, address, phone number, website and rating) from Google Places. Some utility tools you can run look up public information you enter, for example the location of an IP address or whether an email address has a Gravatar picture.

Please do not put government ID numbers, payment card numbers, health information or children's information into HaloSuite.

3. Why we use it

• To provide HaloSuite: run your account and workspace, generate drafts and plans with your AI provider when you ask, send and publish what you approve, sync connected services, and show you results.
• To keep it safe: verify sign-ins, require two-factor authentication, enforce approvals, spending caps and the emergency stop, detect abuse, spam and fraud, and investigate problems.
• To support you: answer your requests and, when you ask us to look into a problem, look at the parts of your workspace needed to help.
• To send service messages: email verification, password resets, security alerts, copies of agreements you sign, and important notices about the beta.
• To improve HaloSuite: understand which features are used and where things break, using usage and error information. We do not use your workspace content or data from connected services to train AI models.
• To tell you about HaloSuite: during the beta we send only service messages. If we later send product news, every such email will have an unsubscribe link and our postal address, and you can opt out at any time.
• To meet legal obligations and protect our rights: keep records the law requires, respond to lawful requests, and establish or defend legal claims.

Legal bases (for people in the EU, EEA, UK or Switzerland): performing our contract with you (running the Service); our legitimate interests (security, fraud prevention, support, improving the Service, keeping proof of agreements, and telling business users about HaloSuite), balanced against your rights; your consent where we ask for it (for example connecting an account or optional cookies, if we ever use them), which you can withdraw at any time; and legal obligations.

4. AI and your own provider key

HaloSuite's AI features use an API key from a provider you choose, connected to your own account with that provider. When you ask Halo to do something, the instructions, the relevant workspace content and, where needed, data from a service you connected are sent to that provider under your account, only to produce the result you asked for. Your agreement with that provider governs what it does with that data and how long it keeps it. Please read its terms and privacy policy.

We do not send your content to an AI provider under HaloSuite's own account, except where a service on our subprocessor list is marked as doing so. We do not use your content to train AI models, and we do not allow our subprocessors to.

5. Who we share it with

We share personal information only as follows:

• Our subprocessors, who host, run or support HaloSuite for us under contracts that limit their use of the data to that job. The current list, with what each does and where, is at https://halosuite.ai/legal/subprocessors.
• Services you connect, when you tell HaloSuite to use them (for example sending an email through Gmail, posting to Facebook, or texting through your Twilio account). From then on that service's own terms and privacy policy apply to what it receives.
• People you send things to: when you approve an email, text, post or web page, its content goes to its recipients or the public.
• HaloSuite staff and contractors, who need it to run and support the Service, under confidentiality duties. There is no in-app support access: staff look at a workspace's content only when that is needed to run, secure or support the Service, and only as far as needed.
• For legal reasons: to comply with law or a valid legal request, to enforce our terms, or to protect the rights, safety and security of our users, the public or HaloSuite. Where the law allows, we tell you first.
• In a business transfer: if HaloSuite is merged, sold or reorganized (including being moved into a company formed to run it), to the new owner, who must keep this policy's promises for the data it receives. For Google user data this needs your prior consent (see "Google user data").
• With your permission, in any other case.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising.

6. SMS and mobile numbers

HaloSuite lets businesses text their own customers from the business's own Twilio account, and only to people who have agreed to receive texts. We store mobile numbers, text-message consent records (when and how consent was given and the wording shown), opt-outs (STOP) and message history on behalf of the business, to send the texts it approves and to stop texting people who opted out.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers and text-message opt-in data and consent are never sold, rented or shared with anyone for their marketing. The only sharing is with the providers that deliver the texts (such as Twilio) and our subprocessors that host the data, solely to provide the messaging service, and as required by law.

Message and data rates may apply to texts. Message frequency varies by business. Anyone can reply STOP to stop texts from a business, or HELP for help.

7. Google user data

HaloSuite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice:

• We use Google data (from Sign in with Google, Google Calendar and Gmail) only to provide and improve the features you can see in HaloSuite and that you turned on: signing in, scheduling and avoiding double bookings, and sending (and, where switched on, reading replies to) your email.
• We transfer it to others only as needed for those features with your permission (for example, to your own AI provider when you ask Halo to work with your calendar or email), for security, to comply with law, or in a merger, acquisition or sale of assets with your prior consent.
• People do not read it unless you agree for specific data (for example by asking us to look into a problem with it), it is needed for security (such as investigating abuse or a bug), it is required by law, or it is aggregated and anonymized for internal operations.
• We never use it for advertising, never sell it to advertising platforms, data brokers or information resellers, and never use it to decide creditworthiness or for lending.
• We do not use it to develop, improve or train generalized or non-personalized AI or machine learning models.

You can remove HaloSuite's access at any time in HaloSuite (disconnect) and in your Google Account's security settings ("Third-party apps with account access").

8. Meta (Facebook and Instagram) data

If you connect Facebook or Instagram, we receive the account and page details, access tokens and post data needed to publish what you approve and to check that it was posted. We use it only for those features, do not sell it, and do not use it for advertising.

To remove our access and delete that data: disconnect the account in HaloSuite, remove HaloSuite in your Facebook settings under "Apps and Websites", and, if you want the rest of your HaloSuite data deleted too, follow https://halosuite.ai/legal/data-deletion or email hello@halosuite.ai with the subject "Data deletion request".

9. Bank data through Plaid

HaloSuite uses Plaid Inc. ("Plaid") to connect to your bank accounts with read-only access, so HaloSuite can show your transactions and spending. When you link an account, you give your bank login details to Plaid, not to us; we never see or store them. Plaid collects and processes your financial data under the Plaid End User Privacy Policy, and by linking an account you agree that Plaid may do so. We receive transaction data for the accounts you link, use it only to provide HaloSuite's money features to you, and never sell it or use it for advertising.

10. Cookies and browser storage

HaloSuite does not use advertising or analytics cookies, and does not let third parties track you on HaloSuite for advertising. The app uses only what it needs to work:

• browser storage (local and session storage) that keeps you signed in, remembers your theme and onboarding progress, and holds the screen you were on;
• one first-party cookie that remembers whether you opened or closed the side menu.

These are needed for the features you use, so we do not ask for consent for them.

Do Not Track. HaloSuite does not collect information about your activity across other websites over time, and does not let other companies do so through HaloSuite. So Do Not Track browser signals, and Global Privacy Control signals, do not change how HaloSuite works; there is no tracking to switch off. Some images in the app are loaded from our design provider's content network, which, like any website, receives your IP address and browser details when it serves them.

Web pages that a business builds and publishes with HaloSuite (for example a link-in-bio page) may include analytics or advertising tags that the business chose to add. That business is responsible for them and for any consent they require.

11. How long we keep it

Agreement acceptance records. When you accept these terms at sign-up, sign the Beta Confidentiality Agreement or accept another document, we record your account identifier, the document version and its fingerprint (hash), the time you accepted, the name you typed, the invite code you used and, where available, your IP address and browser details. The record is kept even after your account is deleted, because we may need it to establish, exercise or defend legal claims. These records cannot be changed or deleted once written, so they are not shortened when you delete your account.

We may keep information longer where the law requires it, or while it is needed for an investigation or a legal claim.

12. Deleting your data and other choices

• Delete your account or workspace: see https://halosuite.ai/legal/data-deletion for the steps, or email hello@halosuite.ai. Only a workspace owner can delete a workspace.
• Disconnect a service: in HaloSuite, and in that service's own settings.
• Remove your AI key: in your settings, at any time.
• Stop product emails: use the unsubscribe link in any of them. You will still receive service messages such as security alerts.
• Members of a workspace: if you are removed from a workspace, you lose access to it at once. Your own account stays yours, and your name can remain in that workspace's activity history.

13. Your privacy rights

Wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy (including in a portable format);
• correct it;
• delete it;
• stop using it for a purpose you object to, or limit how we use it; and
• withdraw a consent you gave.

Depending on where you live (for example California and other US states with privacy laws, or the EU, EEA, UK or Switzerland), these are legal rights, and you also have the right to appeal our decision and to complain to your data protection authority or attorney general. We will not treat you differently for using your rights.

How to ask: email hello@halosuite.ai from your account address, or tell us how to reach you. We may need to confirm your identity before acting. An authorized agent can ask for you with your signed permission. We answer within 30 days (45 days where US state law allows, and we will tell you if we need more time). If we say no, we will explain why and how to appeal; reply to our answer to appeal.

Selling, sharing and targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and we have not done so in the past 12 months. We also honor Global Privacy Control signals as an opt-out request. We do not use sensitive personal information to infer characteristics about you.

Information about other people in a workspace: if your information is in a business's HaloSuite workspace (for example you are its customer), please contact that business first. If you contact us, we will pass your request to it.

14. Security

We protect personal information with measures that include: encrypted connections (HTTPS); encryption of stored secrets such as access tokens, AI keys and two-factor secrets; two-factor authentication; separation between workspaces so one business cannot reach another's data; approval steps before anything is sent; an emergency stop; spending caps; and activity logs. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.

15. Where your data is processed

HaloSuite's beta is offered to businesses in the United States. HaloSuite runs on servers operated by our hosting provider (see the subprocessor list). Our staff and contractors may access data from outside the United States to run and support the Service, always under the same confidentiality duties and access controls, and some subprocessors operate in other countries (see the subprocessor list). If you are outside the United States, your information is transferred to and processed in countries whose laws may protect it differently from yours. Where the law requires it, we use appropriate safeguards for those transfers, such as the European Commission's Standard Contractual Clauses.

16. Children

HaloSuite is not meant for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

17. Changes to this policy

We will post any new version here with a new version number and effective date. If a change is material, we will tell you by email or in the app before it takes effect. If we want to use information in a new way that needs your consent (for example for Google user data), we will ask first.

18. Contact

Email hello@halosuite.ai. It is the contact for every privacy question and request, and we read every message sent there.