Privacy Policy

1. Who We Are

HALT Technologies Ltd is the data controller for your personal data. We are responsible for deciding how and why your data is processed.

HALT Technologies Ltd is a company registered in England and Wales. Company registration number: 17184366.

Registered address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Contact email: privacy@halt-app.com

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration reference is: ZC138678.

2. What Data We Collect

We only collect data that is necessary to provide the HALT service. Here is a full breakdown of every category of data we collect:

2.1 Account Data

• First name and last name
• Email address
• Password (stored using one-way encryption — we cannot see or recover your password)
• Phone number (optional, provided during account setup)
• Account creation date and time
• Subscription status (active, inactive, trial)

2.2 Security and App Access Data

• PIN code (stored using one-way encryption — we cannot see your PIN)
• Login timestamps and session data
• Password reset requests and timestamps
• IP address (collected automatically by our infrastructure providers)
• Authentication tokens (used to keep you logged in securely)

2.3 Financial Data (via Open Banking)

When you connect your bank account using Open Banking (provided by our Open Banking provider), we collect and store:

• Your bank account balance
• Your transaction history, including merchant names, amounts, dates, transaction types, and transaction categories assigned by your bank
• Bank connection metadata — which bank you connected, when the connection was established, and when it expires
• Open Banking access tokens (encrypted, used to refresh your bank data)

This data is accessed on a strict read-only basis. We do not have the ability to move, transfer, initiate payments, or modify your bank account or funds in any way.

2.4 Spending Rules and Behaviour Data

• Spending rules you create (category, spend limit, visit frequency, session time)
• Rule change history and 48-hour lock request timestamps
• Weekly spending limit you set
• Whether the weekly limit is currently unlocked
• Your discipline streak start date and current streak length
• Your personal best (highest streak)
• Challenge mode data — challenge length (90, 180 or 365 days), start date, end date
• Rule breach events and the date they occurred
• Notice period data (pending rule change requests)

2.5 Technical and Device Data

• Device type (iPhone, Android phone, etc.)
• Operating system and version
• App version
• Error logs and crash reports
• Network request logs (used for debugging and security)

2.6 Website and Waitlist Data

• Email addresses submitted via the waitlist form on halt-app.com
• IP address and browser information collected by Netlify (our website host) as part of standard server logs
• Email engagement data (open and click tracking) collected by Resend, our email provider

2.7 Payment Data

Subscription payments are processed exclusively via Apple App Store and Google Play Store in-app purchase systems. HALT does not store, process, or have access to any payment card data, bank account details, or billing information. We receive and store:

• Confirmation that a subscription is active or has been purchased
• Subscription status updates from Apple or Google

3. How We Use Your Data

We use your data only for the purposes listed below. We do not use your data for advertising or sell it to any third party.

• To create and manage your HALT account
• To verify your identity when you log in
• To display your bank balance and categorised transaction history in the app
• To track your spending against your rules and notify you of breaches
• To maintain your discipline streak and challenge progress
• To enforce the 48-hour rule lock mechanism
• To process and manage your subscription via Stripe
• To send you transactional emails (account confirmation, password reset, subscription notices)
• To notify you of changes to these terms or our privacy policy
• To detect and prevent fraud and unauthorised account access
• To diagnose technical issues and improve app performance
• To comply with our legal obligations

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract: Most of our processing is necessary to deliver the HALT service you signed up for — including managing your account, displaying your transactions, tracking your rules, and processing payments.
• Consent: Connecting your bank account via Open Banking requires your explicit consent. You can withdraw this consent at any time by disconnecting your bank in the app.
• Legitimate interests: We process certain data (such as error logs and security data) based on our legitimate interest in maintaining a secure and functional service. We have balanced this against your privacy rights.
• Legal obligation: We may process and retain certain data where required by law, such as for fraud prevention or regulatory compliance.

5. Open Banking

We use Finexer Limited as our Open Banking provider. Finexer is authorised and regulated by the Financial Conduct Authority (FCA) under the Payment Services Regulations 2017. HALT Technologies Ltd acts as a registered agent of Finexer for the purpose of providing Account Information Services (AIS) to users. Finexer acts as a data processor on our behalf.

When you connect your bank:

• You are redirected to your bank's secure login page to authorise read-only access
• Our Open Banking provider retrieves your transactions and balance and passes them to HALT
• We store your transaction data in our secure database to power the app features
• We store an encrypted access token to allow periodic data refreshes

You can revoke Open Banking access at any time from within the HALT app or directly through your bank's own settings. Revoking access will limit certain app features but will not affect your account or subscription.

We do not share your transaction data with any other third party.

6. Subscription and Payments

Subscription payments are processed exclusively via Apple App Store and Google Play Store in-app purchase systems. HALT does not store, process, or have access to any payment card data, bank account details, or billing information. All payment processing is managed entirely within Apple and Google's secure payment infrastructure, both of which are PCI-DSS compliant.

• All payment information is entered directly within Apple or Google's secure payment systems
• We receive only a subscription status confirmation — no financial instrument details are shared with HALT
• Apple and Google may retain your billing information in accordance with their own privacy policies

Apple's privacy policy: apple.com/legal/privacy
Google's privacy policy: policies.google.com/privacy

7. Email Communications

We use Resend to send transactional emails on our behalf (account confirmation, password reset, subscription updates). Resend may collect email engagement data including whether an email was opened or a link was clicked.

We will only ever send you emails that are directly related to your account and the HALT service. We do not send marketing emails unless you have explicitly opted in.

Resend's privacy policy: resend.com/legal/privacy-policy

8. Data Sharing

We do not sell, rent, trade, or share your personal data with any third party for their own commercial purposes. We share data only with the following service providers who process it on our behalf:

• Finexer Limited — Open Banking data retrieval (FCA authorised, HALT acts as registered agent)
• Apple App Store / Google Play Store — Subscription payment processing (no card data shared with HALT)
• Supabase — Secure cloud database and authentication infrastructure (Ireland, eu-west-1)
• Netlify — Website hosting and content delivery
• Resend — Transactional email delivery
• Sentry — Application error monitoring (non-sensitive technical data only)
• Mixpanel — Usage analytics (EU region, non-sensitive behavioural data only, no financial data)
• Google Workspace — Business email (used by HALT staff only)

All third-party providers are required to handle your data securely, use it only for the purposes we specify, and comply with applicable data protection law. We do not transfer your data outside the UK or European Economic Area without appropriate safeguards in place.

We may disclose your data to law enforcement or regulatory authorities if required to do so by law or in connection with legal proceedings.

9. Data Retention

We retain your personal data only for as long as necessary. Here is how long we keep different types of data:

• Account data: Retained for as long as your account is active. Deleted within 30 days of account deletion.
• Transaction data: Retained for up to 13 months to support year-on-year comparisons. Deleted within 30 days of account deletion.
• Rule and streak data: Retained for the lifetime of your account. Deleted within 30 days of account deletion.
• Payment records: Retained for 7 years to comply with HMRC and financial record-keeping obligations.
• Error logs: Retained for up to 90 days for debugging purposes.
• Waitlist data: Retained until you unsubscribe or request deletion.
• IP address logs: Retained for up to 30 days by our infrastructure providers.

If you cancel your subscription but do not delete your account, your data remains stored in accordance with the above schedule. If you delete your account, all personal data will be removed within 30 days except where we are legally required to retain it.

10. Data Security

We take the security of your data seriously, particularly given that HALT handles financial information. Our security measures include:

• All passwords and PINs are hashed using one-way encryption — they cannot be reversed or seen by anyone
• All data in transit is encrypted using HTTPS/TLS
• All data at rest is encrypted in our database infrastructure (Supabase)
• Row-level security (RLS) policies ensure users can only access their own data — not other users' data
• Open Banking access tokens are encrypted and stored securely
• Open Banking access is strictly read-only — we have no ability to initiate transactions
• Access to production systems is limited to authorised personnel only
• We conduct regular security reviews of our infrastructure and third-party providers

11. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at privacy@halt-app.com.

• Right of access: You can request a copy of all personal data we hold about you (known as a Subject Access Request). We will respond within 30 days.
• Right to rectification: You can ask us to correct any inaccurate or incomplete data we hold about you.
• Right to erasure: You can ask us to delete your personal data. We will comply unless we are legally required to retain certain records.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format so you can transfer it to another service.
• Right to object: You can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds to continue.
• Right to withdraw consent: Where processing is based on consent (such as Open Banking), you can withdraw consent at any time. This will not affect the lawfulness of processing before withdrawal.
• Rights related to automated decision-making: HALT does not make decisions about you using solely automated processing that produces legal or similarly significant effects.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully:

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

12. Cookies and Tracking

The HALT website (halt-app.com) uses only strictly necessary cookies required for the site to function. We do not use advertising cookies, tracking cookies, or analytics cookies.

Our email provider (Resend) may use tracking pixels to record whether emails are opened or links are clicked. This helps us ensure our emails are being delivered correctly. You can disable image loading in your email client to prevent this tracking.

The HALT mobile app does not use cookies. Session data is managed using secure authentication tokens stored on your device.

13. Children's Privacy

HALT is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has created an account or provided us with personal data, please contact us immediately at privacy@halt-app.com and we will delete the data without delay.

14. Third-Party Links

Our website and app may contain links to third-party websites or services (such as your bank's website via Open Banking). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing any personal data.

15. Changes to This Policy

We may update this Privacy Policy from time to time as our service evolves or legal requirements change. When we make significant changes, we will notify you by email and display a notice in the app at least 14 days before the changes take effect. The date at the top of this page will always show when it was last updated.

Continued use of the HALT service after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

For any privacy-related questions, data requests, or concerns, please contact our privacy team:

We aim to respond to all privacy enquiries within 5 working days and will always respond within 30 days as required by UK GDPR.