LEGAL

Privacy Policy

⚠️ Draft template — not yet reviewed by a solicitor. Complete the {{...}} placeholders and have it reviewed before launch. It reflects how the product actually handles data, but is not legal advice.
Last updated: 8 September 2026

H.A.L. (“we”, “us”) is a product operated by Cadence Limited, registered at 19 Peel Road, Douglas, Isle of Man IM4 4LR. This policy explains what personal data we handle and your rights over it. It covers our website and the H.A.L. application.

Controller vs processor

For your account, your users and your website activity, we act as the controller. For the merchant, contact, introducer and document data you upload into the platform, you are the controller and we act as your processor under a Data Processing Agreement.

What we collect

  • Account data — name, work email, role and team.
  • Usage & security data — sign-in events, audit logs, IP and device information.
  • Customer data you upload — merchants, contacts, introducers, deals and documents (processed on your behalf).
  • Website data — enquiries you send us and essential cookies.

We do not store raw payment card numbers.

Lawful basis

We rely on contract (to provide the service), legitimate interests (security, product improvement and B2B communication) and, where required, consent (non-essential cookies). Where we process customer data as your processor, you set the lawful basis.

Sub-processors

We use a small set of vetted providers: Supabase (database, authentication and storage), Vercel (application hosting), Postmark (transactional email), and — only when you enable AI features with your own key — your chosen AI provider. We confirm regions and the current list on request.

International transfers

Where data moves outside the UK/EEA, we rely on Standard Contractual Clauses or the UK IDTA.

Retention

We keep account data for the life of your account. Operational records are held to a scheduled retention policy (for example: identity documents for anti-money-laundering periods, activity logs for a limited window, audit logs with personal fields scrubbed after a set period). Data is archived before deletion so the process is reversible.

Your rights

You may request access, correction, deletion, portability or restriction of your personal data, and object to certain processing. Contact us at privacy@talktohal.com. You also have the right to complain to your data-protection authority.

Contact

Data-protection and general queries: admin@talktohal.com.