Halo Privacy Policy

Effective date: 2026-05-28 Last updated: 2026-05-28

1. Who we are

Halo ("Halo," "we," "us," or "our") is an iOS and Android application that uses computer-vision analysis of self-portrait photos ("selfies") to provide personalized skincare and grooming reflections, routines, and progress tracking.

Halo is operated by:

• Legal entity: Halo (individual sole proprietorship operated from Italy)
• Postal address: Available by request via [email protected]
• Contact email: [email protected]
• Data Protection Officer (DPO) / EU representative: [email protected]

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to the Halo mobile app, our website at https://usehaloapp.com, and any related services that link to this policy (together, the "Service").

If you do not agree with this policy, please do not use Halo.

2. The short version

We try to keep our data practices as simple as possible. Here's the short version:

• What we collect: your email + name, your profile answers (skin sensitivity, climate, goals, concerns), the photos you take during scans, and the analysis results we generate from them. We also collect basic device + usage data.
• What we do with it: read your skin, generate personalized routines, track your progress over time, and personalize the coach.
• Who sees it: Halo's systems, plus our analysis partner OpenAI (which processes your selfies for the AI vision step), our cloud storage provider Supabase (which stores your data), and Apple / Google (for sign-in + payments). We do not sell your personal information to anyone. We do not share it with advertisers or data brokers.
• Special category data: your selfies contain biometric facial features. We process them only with your explicit consent (the "Allow and continue" screen before your first scan), only to deliver the Service, and we delete them when you delete your account.
• Your control: you can delete your account from inside the app at any time. That deletes your photos, your scan history, and all related data.
• Children: Halo is for people 16+. We do not knowingly collect data from anyone under 13.

The rest of this document is the full version.

3. What information we collect, and why

3.1 Information you provide

Account information

• Email address (from Apple Sign-In, Google Sign-In, or email-OTP)
• First name (collected during onboarding)
• A unique user identifier issued by our identity provider (Supabase Auth)

Onboarding profile answers

• Gender identity (optional, can be "Prefer not to say")
• Climate where you live (tropical, humid, temperate, arid, cold)
• Skin sensitivity (low / medium / high) — safety-critical, gates which ingredients we suggest
• Sleep quality (poor / average / good)
• Budget tier preference (budget / mid / premium / luxury)
• Skincare goals (multi-select from ~9 options)
• Skin concerns (multi-select from ~10 options)
• Whether you maintain a beard
• "Where did you hear about us?" (TikTok, Instagram, friend, etc. — used only to understand our growth)

Face photos ("selfies")

• Each scan captures one photo via the device camera. We process this photo with our analysis pipeline (see Section 4) to produce scores and observations about your skin.
• This is biometric data and is considered sensitive under GDPR, CCPA/CPRA, BIPA, and similar laws. We only collect it after you explicitly tap "Allow and continue" on the consent screen shown before your first scan.

Coach messages

• Text you send to the Halo Coach feature, and Halo's text replies.

Subscription state

• If you start a trial or paid subscription, we receive a record from Apple or Google (an anonymous purchase token, the plan you selected, the status, and the renewal date). We do not receive your credit card number — that is handled by Apple or Google.

3.2 Information we generate from what you provide

When you take a scan, we run analysis (described in Section 4) and generate:

• Numeric scores for hydration, skin texture, redness, eye area, glow, and an overall score (0–100)
• A bounded "visual age reading" (an AI estimate, not a medical assessment — see Section 9)
• Observed concerns (short text descriptions of what the analysis saw)
• Ingredient-level recommendations (categories, never product brands)
• Personalized routine steps (morning / evening / weekly)

We also derive:

• Streak count, XP, and level (engagement state)
• Achievement unlocks (e.g. "7-day streak")
• Progress deltas between scans

3.3 Information we collect automatically

Device + technical information

• Approximate device type (e.g. iPhone 15 Pro)
• Operating system version
• App version
• Crash reports (anonymized stack traces)
• Approximate language / region (from device locale)

Usage information

• Which screens you visit and when
• Which features you use (scans, routines, coach, progress)
• When you complete onboarding
• When you check off routine steps

We use this for product reliability and to improve the experience. We do not use device or usage information to build advertising profiles, and we do not share it with advertising networks.

3.4 Information we do NOT collect

For clarity:

• We do not collect your real-time location.
• We do not collect contacts, photo library content, or other apps' data.
• We do not collect your IP address beyond what's incidental to API requests.
• We do not run any third-party advertising SDKs.
• We do not use Facebook Pixel, TikTok Pixel, Google Analytics for Firebase, or similar ad-tech.

4. How we use the information

We use your information only to deliver and improve Halo. Specifically:

We do not use your data for:

• Selling to third parties
• Advertising or marketing networks
• Training general-purpose AI models that benefit anyone other than you
• Generating publicly-shareable profiles or social features

5. How your selfies are processed (the important part)

Because selfies are biometric data, we want to be specific about what happens to them.

5.1 The lifecycle of a scan

1. You tap "Begin" on the scan screen. Your iPhone or Android device's camera captures one photo.
2. The photo is uploaded over HTTPS to our private storage bucket on Supabase. The bucket is configured so that only your account can read it (row-level security policies enforced at the storage layer).
3. Our backend requests a short-lived signed URL (valid for ~10 minutes) and sends it, along with anonymized profile context (gender, climate, skin sensitivity, goals, concerns), to OpenAI's Vision API for analysis. We send no identifying information — OpenAI receives the photo and the profile context, not your name, email, or user ID.
4. OpenAI returns a structured JSON response (scores, observed concerns, recommendations). We validate and store this in our database, linked to your account.
5. We do not include the photo in any other downstream processing. The Coach feature reads your latest scan's scores and observations, not the photo itself.

5.2 OpenAI's role

OpenAI is a Sub-Processor for the AI vision and language analysis. Under our agreement with OpenAI:

• They process the photo + profile context solely to return the analysis result to us.
• They do not use your data to train their models. (OpenAI's API terms expressly prohibit training on API customer data unless the customer opts in. We have not opted in.)
• Data is retained on OpenAI's side for a maximum of 30 days for abuse-monitoring purposes, after which OpenAI deletes it.
• OpenAI is a Sub-Processor under the GDPR; their Data Processing Addendum is published at openai.com/policies/data-processing-addendum.

If OpenAI ever changes their data practices in a way that would meaningfully impact your privacy, we will update this policy and (where required) notify you in-app.

5.3 What we do with the photo after analysis

• The photo is stored in your private folder on Supabase Storage.
• The photo is never displayed to anyone outside of you.
• The photo is never shared with any party other than OpenAI (transient, for the analysis call) and Supabase (storage).
• When you delete your account (see Section 8), every photo in your folder is permanently removed.
• If you take a new scan, the prior scan's photo is retained (so the progress timeline can reference it).

5.4 What we will never do

• We will never use your selfie for advertising.
• We will never train an AI model on your selfie that benefits other users.
• We will never share your selfie with any data broker, social network, ad network, or analytics provider.
• We will never combine your selfie with publicly-available facial datasets to identify you elsewhere.

6. Who we share information with

We share data with the following categories of recipients, each for a specific purpose:

6.1 Service providers (Sub-Processors)

Each Sub-Processor is bound by contractual data-protection terms aligning with GDPR Art. 28 (where applicable) and our equivalent obligations under CCPA / CPRA.

6.2 We do not sell your personal information

Under the California Consumer Privacy Act (CCPA / CPRA) and similar U.S. state laws, "sale" includes sharing data for cross-context behavioral advertising. We do not sell your personal information in any sense of the word. We do not share it for cross-context advertising. We do not let advertisers use it to target you.

6.3 Legal disclosures

We may disclose personal information if required by law, court order, or to protect the rights, property, or safety of Halo, our users, or others. We will challenge overbroad requests and (where lawful) notify you of legal requests for your data.

6.4 If we change ownership

If Halo is acquired, merged, or sold, your data may be transferred to the acquirer. The acquirer must continue to honor this Privacy Policy or notify you of changes before any new uses begin.

7. International transfers

Halo is operated from Italy (within the European Union). Your data is stored on our cloud infrastructure (Supabase) and processed by our AI sub-processor (OpenAI), some of which is hosted in the United States. Even when you use Halo from inside the EU, parts of your data are therefore transferred to the United States for the AI vision step.

For EU/UK users, transfers are conducted under the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. Where additional safeguards are required, we rely on encryption in transit (TLS) and encryption at rest, plus access controls limiting which staff can view data.

You can request a copy of the SCCs by emailing [email protected].

8. Your rights

You have the following rights with respect to your personal information. These rights apply globally; some are codified more strongly in specific jurisdictions (GDPR for EU/UK, CCPA/CPRA for California, similar laws elsewhere).

8.1 Right to access

You can request a copy of the personal information we hold about you. Most of this information is already visible to you inside the Halo app (your profile, your scans, your routines, your streak). For a full machine-readable export, email [email protected] and we'll provide it within 30 days.

8.2 Right to delete

You can delete your account at any time from inside the app: Settings → Delete account. This permanently removes:

• Your profile
• All your scans, scan photos, and analysis results
• Your routines and step completions
• Your progress timeline
• Your subscription record
• Your achievement history and streak
• Your Coach message history
• Your authentication identity

After deletion, your data cannot be recovered. We do not retain a backup copy.

You can also delete your account by emailing [email protected]. We'll process the request within 30 days.

Some information may be retained briefly after deletion for security and fraud-prevention purposes (typically less than 30 days), and indefinitely where retention is legally required (e.g. tax records of paid subscriptions).

8.3 Right to correct

If any information we hold about you is inaccurate, you can correct most of it in-app (Settings, or by re-running onboarding) or by emailing [email protected].

8.4 Right to portability

You can request your data in a machine-readable format (JSON). Email [email protected].

8.5 Right to withdraw consent

You can:

• Withdraw consent to face-image processing at any time by deleting your account.
• Disable daily affirmation notifications in Settings → Notifications.
• Revoke camera or notification system permissions in your device's Settings app.

Withdrawal does not affect any processing carried out before withdrawal.

8.6 Right to object / restrict

You can object to or restrict our processing of your data for any legitimate-interest purpose (such as analytics) by emailing [email protected].

8.7 Right not to be discriminated against

We will not deny you service, charge you more, or provide a lesser service if you exercise any of these rights.

8.8 California-specific rights (CCPA / CPRA)

If you are a California resident, you have:

• The right to know what personal information we collect, use, disclose, and share
• The right to delete personal information collected from you
• The right to correct inaccurate personal information
• The right to opt out of the "sale" or "sharing" of personal information (note: we do not sell or share for cross-context advertising)
• The right to limit the use and disclosure of sensitive personal information (your face data is sensitive PI under CPRA; we use it only for the Service)
• The right to non-discrimination

You can exercise these rights via the in-app deletion flow or by emailing [email protected]. We do not require you to verify your identity beyond signing in to your account.

8.9 Illinois-specific rights (BIPA)

If you are an Illinois resident, the Illinois Biometric Information Privacy Act ("BIPA") gives you specific rights regarding biometric identifiers. We:

• Obtain your written informed consent before capturing biometric data (the in-app "Allow and continue" screen serves this purpose, and your acceptance is stored with a timestamp).
• Have a public, written retention and destruction schedule (this Privacy Policy, Section 10).
• Will destroy your biometric identifiers when you delete your account (Section 8.2) or when the initial purpose of collection has been satisfied or 3 years has elapsed since your last interaction with the Service, whichever is earlier.
• Do not sell, lease, trade, or otherwise profit from your biometric data.

8.10 EU / UK-specific rights (GDPR / UK GDPR)

In addition to all the above, you have the right to:

• Lodge a complaint with your supervisory authority (e.g. ICO in the UK, your national DPA in the EU)
• Information about decisions made by automated means (see Section 9)

9. Automated decision-making + the AI estimates

The Service uses AI vision analysis to generate scores and observations from your selfies. These are estimates, not medical assessments. Specifically:

• The "Overall glow" score and per-metric scores are derived from a computer-vision model interpreting your selfie. They are not clinical measurements.
• The "Visual age reading" is bounded to a narrow range (18–45) and calibrated against your stated chronological age when known. It is presented as a wellness reflection, not a medical estimate.
• The Coach generates responses using a language model. Its suggestions are general wellness guidance, not medical advice.

None of these constitute automated decisions with legal or similarly significant effects under GDPR Art. 22. We do not use them to deny you service, alter pricing, or evaluate your eligibility for anything. If you disagree with any analysis result, you can re-scan or contact us.

Under GDPR Art. 22(1), if we ever introduce automated decision-making that produces legal or similarly significant effects, we will tell you in advance and offer human review on request.

10. Data retention

• Account data (email, name, profile answers, subscription state): retained for as long as your account exists. Deleted within 30 days of account deletion.
• Selfies + scan results: retained for as long as your account exists. Deleted immediately on account deletion.
• Coach messages: retained for as long as your account exists. Deleted immediately on account deletion.
• Engagement data (streak, XP, achievements, routine completions): retained for as long as your account exists. Deleted immediately on account deletion.
• Anonymized aggregate metrics (e.g. "X% of users complete onboarding"): retained indefinitely. These cannot be linked back to you.
• Crash reports + anonymized usage logs: retained for up to 12 months.
• Tax + financial records of paid subscriptions: retained as required by tax law (typically 7 years in the U.S.). These are anonymized purchase records — they don't include your face or profile data.

11. Children

Halo's minimum age is 16 and the Service is not directed to children. We do not knowingly collect personal information from anyone under 13 (or the equivalent minimum age in your country: 16 in some EU member states, 13 in most). If you believe we have collected information from a child, contact [email protected] and we will delete it.

We do not allow users under 16 to create accounts — the in-app date-of-birth gate blocks sign-up below that age. Platform-assigned content ratings on the App Store and Play Store may differ from our minimum-age requirement. If you are a parent or guardian and you become aware that a minor has used Halo, you may request immediate deletion at any time.

12. Security

We protect your data with a combination of technical and organizational measures:

• Encryption in transit: all network traffic uses TLS 1.2+
• Encryption at rest: database + storage are encrypted at the provider level (AES-256)
• Authentication: all API access requires a valid Supabase JWT
• Row-level security: storage and database policies enforce per-user isolation — no user can access another user's data even if they intercept API tokens
• Signed URLs: selfie uploads and reads use short-lived (5–10 minute) signed URLs that cannot be guessed or reused
• Access controls: only authorized staff can access production systems, and only when necessary for support, debugging, or compliance

No system is 100% secure. If a data breach occurs that compromises your personal information, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law (e.g. 72 hours under GDPR).

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last updated" date at the top.
• For material changes (e.g. new sub-processors, new categories of data, new purposes), we will notify you in-app and (where required) request your renewed consent before the changes take effect.
• The historical versions of this policy are available on request.

14. Contact

For privacy-related questions, requests, or complaints:

• Email: [email protected]
• Postal: Available by request via [email protected]

For EU/UK users, you may also contact:

• EU representative: Not applicable. Halo is established within the European Union (Italy), so an EU representative under GDPR Article 27 is not required.
• Your local data protection authority (e.g. ICO in the UK, or your national DPA in the EU)

15. Glossary (because legalese is bad)

• Selfie / face photo: a digital image of your face that you capture during a scan in the Halo app.
• Biometric data: information about your physical characteristics. Your selfie is biometric data because it contains facial features that could be used to identify you. We treat it as sensitive and protect it accordingly.
• Sub-Processor: a third-party company we use to deliver part of the Service (e.g. our analysis partner OpenAI or our storage provider Supabase).
• Controller / Processor (GDPR): Halo is the data controller — we decide why and how your data is processed. Our Sub-Processors are data processors — they only handle data on our instructions.