Privacy Policy

1. Scope and contact

This policy applies to xHalo account, Story, Mail, Chat, developer, website, and related services that link to it. xHalo is responsible for the processing described here unless another notice says otherwise.

Questions and privacy requests can be sent to support@xhalo.co.

2. Information we collect

Account data includes your email address, display name, profile settings, locale, avatar, authentication-provider identifiers, session records, and security events.

Service data includes projects, drafts, messages, files, prompts, API activity, support requests, and other content you choose to submit. Technical data can include IP address, device and browser information, timestamps, referral URLs, diagnostics, performance events, and interactions with the interface.

3. How we use information

We use information to create and secure accounts; provide, synchronize, and support requested features; prevent abuse; troubleshoot failures; measure reliability; communicate service changes; enforce our Terms; and comply with law.

Depending on the context, processing is necessary to perform our contract with you, protect legitimate security and service interests, comply with legal obligations, or act on your consent. Where consent is the basis, you may withdraw it at any time.

4. Cookies, local storage, and analytics

Essential cookies and browser storage keep you signed in, preserve language and theme choices, remember return paths, and protect sessions. Disabling them may prevent account or product features from working.

We use Microsoft Clarity to understand page performance and interaction patterns such as clicks, scrolling, navigation, heatmaps, and session replay. Clarity may use first- and third-party cookies or similar technologies. Form input content is masked by Clarity controls. Where consent is required, analytics should operate according to the consent signal available for your visit.

5. Security and authentication providers

Cloudflare provides edge security and Turnstile bot protection. Turnstile processes browser and device signals needed to distinguish people from automated traffic and does not read your form entries.

If you choose Google or Microsoft sign-in, we receive the account identifiers and profile details the provider authorizes for authentication. Those providers process data under their own privacy policies.

6. Sharing and service providers

We share information only as needed with infrastructure, security, authentication, analytics, communications, storage, and support providers; with an organization that administers your workspace; when you direct us to share; or when law, safety, or rights protection requires it.

We do not sell your private workspace content. Providers may process information only for their contracted role and subject to appropriate safeguards.

7. International processing

xHalo and its providers may process information in countries other than yours. Where required, we use recognized contractual or legal safeguards for international transfers and consider the sensitivity of the data and provider controls.

8. Retention

We keep account and service data while needed to provide the service and for a reasonable period afterward based on security, legal, dispute, backup, and operational requirements. Retention varies by data type and product.

Microsoft states that Clarity recordings are available to site operators for up to 30 days. Security and abuse records may be retained longer when necessary to protect the service or comply with law.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal data, and to withdraw consent. You may also complain to your local data-protection authority.

Use profile settings where available or email support@xhalo.co. We may need to verify your identity and may retain information when an exception under applicable law applies.

10. Security

We use access controls, encryption in transit, monitoring, rate limits, bot protection, backups, and separation of service responsibilities designed to protect information. No online system is completely secure, so protect your credentials and report suspected compromise promptly.

11. Children

xHalo is not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can investigate and delete it when appropriate.

12. Changes and contact

We may update this policy when services, providers, or legal requirements change. We will update the date above and provide additional notice for material changes when appropriate.

Contact support@xhalo.co for privacy questions, requests, or complaints.