Privacy Policy

Last updated: 6 October 2026.

Who we are

Halo is operated by [OPERATOR NAME], [POSTAL ADDRESS], Luxembourg. Contact: privacy@gethalostore.com.

What we collect and why

a) Waitlist. Your name and email, to send your invite. Legal basis: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by emailing us.

b) Creator accounts. Your email, your password (stored hashed by our authentication provider) or your Google sign-in identity, plus the profile, listings and images you add. Legal basis: performance of our contract with you (Art. 6(1)(b)).

c) Storefront visitors. When someone clicks Buy or Book, we record that a click happened and when. No IP address, device ID or other personal data is stored.

d) Abuse prevention. A salted hash of the IP address used for waitlist submissions, deleted within 24 hours. Legal basis: our legitimate interest in preventing spam (Art. 6(1)(f)).

Service providers

Hosting, database, authentication and file storage are provided by Lovable and Supabase. Google processes your data only if you choose Continue with Google. Data may be processed outside the EEA; where it is, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

Retention

Waitlist data is kept until you receive your invite or ask us to delete it, and no longer than 24 months. Account data is kept until you delete your account. Rate-limit hashes are kept for 24 hours.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw your consent. Email privacy@gethalostore.com. You can also complain to the CNPD (Commission nationale pour la protection des données), Luxembourg's data protection authority, at cnpd.public.lu.

Cookies and storage

We only use what is strictly necessary to keep creators signed in. We use no analytics or advertising trackers.

Payments

Halo never processes payments. Purchases happen on the creator's own store, under that provider's privacy policy.