Halo AI Privacy Policy

Thank you for choosing Halo AI. Product Studio, Inc. (“Product Studio,” “we” or “us”) is the data controller responsible for your personal data under this Policy. We are committed to protecting your privacy and this Policy explains what personal data we collect, how we use it, and the choices you have.

If you do not agree with this Policy, please discontinue use of the Service. Capitalized terms not defined here have the meanings given in the Halo AI Terms of Service.

1. Information We Collect

1.1 Account and Contact Information

When you create or manage an account, we collect:

• Name, username, and profile information you provide.
• Email address and authentication details (including identifiers from Apple, Google, or other sign-in providers).
• Billing information, such as payment token identifiers, if you purchase a subscription.

1.2 Creative Content

“Creative Content” means the following categories of data you submit to or that the Service generates on your behalf:

• Source media: images, photographs, and video you upload directly to the Service or import from a connected third-party storage service (e.g., Apple iCloud, Google Drive).
• Prompts and instructions: text prompts, style descriptions, editing instructions, and other written input you provide to direct the Service.
• AI-generated outputs: images and video produced by the Service in response to your inputs.
• Derived data: representations we generate from the foregoing during processing, including without limitation image embeddings, style encodings, facial or body geometry measurements, and other model input or intermediate representations. Derived data is personal data and is treated as Creative Content for all purposes of this Policy.

Creative Content does not include payment information, account credentials, or device and usage data, which are addressed separately in Sections 1.1 and 1.3.

We store Creative Content to provide features such as history, editing, and collaboration. We may also use Creative Content to train, fine-tune, or evaluate our AI models, and to generate personalized recommendations, where you have not opted out. See Sections 5 and 6 for details and opt-out instructions.

1.3 Device and Usage Information

We automatically collect technical data when you access the Service, including:

• Device type, operating system, app version, and browser information.
• IP address, approximate location (based on IP), and system language.
• Diagnostics such as crash logs, performance data, and interaction events.
• Advertising identifiers and behavioral signals used to measure and serve interest-based advertisements. See Section 7 for opt-out options.

1.4 Cookies, Tracking Technologies, and Global Privacy Control

On the web, we use cookies, local storage, pixels, and similar tracking technologies to remember preferences, maintain sessions, measure engagement, and serve or measure interest-based advertisements. You can adjust browser settings to limit cookies, but some features may not function correctly without them. A full list of cookies and their purposes is available in our Cookie Settings tool.

We honor Global Privacy Control (GPC) signals. If your browser or device transmits a GPC signal indicating that you have opted out of the sale or sharing of personal information, we will treat that signal as a valid opt-out request under the California Consumer Privacy Act and process it accordingly. You do not need to submit a separate opt-out request if you have enabled GPC.

1.5 Support and Communications

When you contact hello@product.studio or submit in-app feedback, we collect the information you provide, including attachments and transcripts, to respond and improve our services.

2. How We Use Your Information

We use the collected data to:

• Provide, personalize, and maintain the Service.
• Generate and deliver AI-created photos and videos based on your inputs.
• Process payments and manage subscriptions.
• Communicate with you about updates, security alerts, and support responses.
• Monitor usage, troubleshoot issues, and protect against fraud or abuse.
• Train, fine-tune, and evaluate our AI models using your Creative Content where you have not opted out. See Section 5.
• Generate personalized content recommendations through automated processing of your Creative Content and usage patterns (profiling). See Section 6.
• Serve and measure interest-based advertisements based on your usage behavior and, where permitted, device advertising identifiers. See Section 7.
• Send you marketing communications about Halo AI features, promotions, and news where you have provided consent or we have a legitimate interest. See Section 14.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal Basis for Processing (EEA, UK, and Switzerland)

Where GDPR or equivalent laws apply, we process personal data on the following legal bases:

• Performance of a contract - providing the Service you requested.
• Legitimate interests - maintaining and improving the Service, securing infrastructure, direct marketing to existing customers (subject to your right to object under Article 21).
• Consent - AI model training on your Creative Content; profiling for personalized recommendations; behavioral advertising tracking; marketing communications to new subscribers; analytics cookies where required by local law. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Compliance with legal obligations - responding to lawful requests, tax and financial reporting requirements.

4. Sharing Your Information

We do not sell your personal data for monetary consideration. We share information with the following categories of recipients, and in each case we disclose only the categories of personal data necessary for that purpose:

• Cloud hosting and infrastructure providers (e.g., AWS, Google Cloud): we share Creative Content, account data, and device/usage data to store and process your data on our behalf.
• Analytics providers: we share device/usage data and pseudonymous identifiers to measure Service performance and user behavior.
• Customer support platforms: we share account data and support communication content to enable us to respond to your inquiries.
• Payment processors: we share account data and transaction identifiers (not full payment card numbers) to process payments.
• Advertising partners: we share device advertising identifiers, behavioral signals, and hashed email addresses to deliver and measure interest-based advertisements. See Section 7 for opt-out options.
• Third-party integrations you enable (e.g., publishing to social platforms or cloud storage): we share the specific Creative Content you choose to export, and you can disconnect integrations at any time.
• Legal authorities: when disclosure is necessary to comply with law, protect our rights, prevent fraud, or respond to lawful process.
• Business transfer parties: in the event of a merger, acquisition, or asset sale, we will notify you before personal data is transferred and becomes subject to a different privacy policy.

All service providers and processors are bound by contractual obligations to process data only on our instructions, implement appropriate security measures, and not use data for their own purposes.

We do not share your Google or YouTube data with third parties except to provide and support the Service, in accordance with the Google API Services User Data Policy (including the Limited Use requirements).

5. AI Model Training

Halo AI uses machine learning models to generate and transform photos and videos. To improve the quality and relevance of these models, we may use your Creative Content as training data where you have not opted out.

Specifically:

• What we train on: Source media, prompts, AI-generated outputs, and derived data as defined in Section 1.2, as well as your interactions with generated outputs (e.g., saves, regenerations, feedback).
• How it is used: Training data may be used to improve general model performance and to evaluate model safety and quality.
• De-identification: Where feasible, we apply technical safeguards to reduce the identifiability of training data. Derived representations such as embeddings may be used in de-identified form.
• Your opt-out right: You may opt out of having your Creative Content used for AI model training at any time via Settings -> Privacy -> AI Training, or by contacting hello@product.studio. Opting out does not affect your Service access. We will cease using newly submitted content for training within 30 days of your opt-out.
• Limitation on erasure from model weights: Where Creative Content has already been incorporated into trained model weights prior to your opt-out or deletion request, complete removal from those weights may not be technically feasible. In such cases, we will: (a) isolate and cease further use of the identified data in future training runs; (b) flag the relevant model versions for scheduled retraining that excludes your data; and (c) notify you of the limitation and estimated timeline for remediation where we are able to do so. Raw source data and derived data stored in our databases will be deleted on your request regardless of model training status.

6. Personalized Recommendations and Automated Processing

Halo AI uses automated processing of your Creative Content and usage patterns to generate personalized content suggestions and style recommendations (the 'Recommendation Model'). This constitutes profiling as defined under GDPR Article 4(4).

6.1 How the Recommendation Model Works

The Recommendation Model analyzes your uploaded images, prompts, editing choices, and interaction history to predict style preferences and surface content suggestions tailored to you. It uses the derived data described in Section 1.2 (including style encodings and embeddings) as inputs.

6.2 Significance and Your Rights

The Recommendation Model does not make solely automated decisions that produce legal or similarly significant effects on you - its outputs are suggestions only, and you retain full control over what content you create or use. Accordingly, Article 22 of the GDPR (which restricts solely automated decision-making with significant effects) does not apply to this processing.

However, you have the following rights with respect to profiling:

• Right to object (GDPR Article 21): You have the right to object at any time to processing of your personal data for profiling purposes, including for personalized recommendations. To exercise this right, contact hello@product.studio or use Settings -> Privacy -> Personalization. We will stop profiling-based processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to opt out of consent-based profiling: Where we rely on consent as the legal basis for profiling (see Section 3), you may withdraw consent at any time via Settings -> Privacy -> Personalization without affecting the quality of core Service features.

7. Advertising and Tracking

We use tracking technologies and third-party advertising partners to show you interest-based advertisements and to measure ad performance.

7.1 What We Collect for Advertising

• Device advertising identifiers where you have granted permission.
• Behavioral signals such as features used, content viewed, and session activity.
• Hashed email address for audience matching on advertising platforms.

7.2 Third-Party Ad Partners

We may share the above data with ad partners. Each partner's use of data is governed by their own privacy policies.

7.3 Your Opt-Out Choices

• iOS: Settings -> Privacy & Security -> Tracking -> disable tracking for Halo AI.
• Android: Settings -> Privacy -> Ads -> opt out of Ads Personalization.
• Web: Use our Cookie Settings tool or visit optout.networkadvertising.org.
• GPC: If your browser transmits a Global Privacy Control signal, we will treat it as an opt-out from sharing for advertising purposes. See Section 1.4.

8. Data Retention

We retain personal data for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Approximate retention periods:

• Account and profile data: Life of your account plus 2 years after deletion, unless a longer period is required by law.
• Creative Content (source media, prompts, outputs, derived data): Life of your account. If you opt out of AI training, we cease using retained Creative Content for that purpose within 30 days. See Section 5 for the model weight erasure limitation.
• Advertising and analytics data: Up to 13 months from collection, consistent with industry standards.
• Support communications: 3 years from the date of resolution.

When data is no longer required, we delete or anonymize it. You may request deletion at any time by contacting hello@product.studio.

9. Data Security

We use technical, organizational, and administrative safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. No online service is completely secure; please use strong passwords and notify us immediately of suspected account compromise. In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you and, where required, the relevant supervisory authority within the timeframes required by applicable law (72 hours under GDPR).

10. International Data Transfers

We operate in the United States and may process data using servers or service providers located in other countries. When transferring personal data from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission (controller-to-processor Module 2, or controller-to-controller Module 1, as applicable to each transfer). For transfers from the UK, we use the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs as appropriate. Copies of applicable transfer mechanisms can be requested at hello@product.studio.

11. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data. To exercise any of these rights, email hello@product.studio. We will verify your identity and respond within the timeframes required by applicable law (generally 30 days, with a possible 30-day extension on notice).

11.1 Rights Available to All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations and the model weight limitation described in Section 5.
• Data portability: Receive a copy of your data in a structured, machine-readable format.
• Withdraw consent: Where we process your data on the basis of consent (including AI training, profiling for recommendations, and behavioral advertising), you may withdraw consent at any time via Settings -> Privacy or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

11.2 Rights Under GDPR (EEA, UK, Switzerland)

• Right to restrict processing (Article 18): Request that we limit processing of your data in certain circumstances, for example while a dispute about accuracy is resolved.
• Right to object to legitimate-interest processing (Article 21): Object to processing based on legitimate interests, including direct marketing and profiling for recommendations. We will cease such processing unless we demonstrate compelling legitimate grounds.
• Right not to be subject to solely automated decisions (Article 22): Where we make decisions about you based solely on automated processing that produce legal or similarly significant effects, you have the right to request human review, express your view, and contest the decision. As described in Section 6.2, the current Recommendation Model does not make such decisions - but this right will apply if that changes.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority. See Section 16 for contact details.

11.3 Google/YouTube Account Access

You can revoke Halo AI access to your Google or YouTube account at any time at https://myaccount.google.com/permissions and disconnect external accounts in app settings.

12. Children's Privacy

Halo AI is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided personal data without proper consent, contact us so we can remove it.

13. Third-Party Links and Services

The Service may include links to or integrations with websites and platforms we do not control. This Privacy Policy does not apply to those third parties. Review their policies before providing personal information.

14. Marketing Communications

We may use your name and email address to send you promotional communications about Halo AI products, features, and offers. You can opt out at any time by clicking “Unsubscribe” in any marketing email or by contacting hello@product.studio. We will honor opt-out requests within 10 business days. Transactional and service communications (e.g., billing receipts, security alerts) are not affected by marketing opt-outs.

Where required by law (e.g., CASL for Canadian users, GDPR for EU users), we will obtain your affirmative consent before sending marketing communications.

15. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, the sources, business purposes, and third parties with whom we share it. The categories we collect are: identifiers (name, email, device IDs); commercial information (subscription and transaction history); internet or network activity (usage and behavioral data); visual and audio information (Creative Content, including uploaded images and video); inferences drawn from the above (style profiles, recommendation data); and sensitive personal information as described below.
• Right to Delete: Request deletion of personal information, subject to certain exceptions. See Section 5 for the model weight limitation on deletion of AI training data.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We share personal information with advertising partners for cross-context behavioral advertising. You have the right to opt out by clicking “Do Not Sell or Share My Personal Information” in app settings or our website footer, or by enabling a Global Privacy Control signal in your browser (see Section 1.4).
• Right to Limit Use of Sensitive Personal Information: We collect the following categories of sensitive personal information as defined under CPRA: (a) biometric-adjacent derived data (facial and body geometry measurements extracted from your images - see Section 1.2); and (b) precise geolocation, if you grant location permission. You have the right to direct us to use sensitive personal information only for purposes permitted under CPRA Section 1798.121, including to provide the Service, prevent fraud, and comply with law. To exercise this right, contact hello@product.studio or use Settings -> Privacy.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a CCPA/CPRA request, email hello@product.studio or use the in-app privacy request form. We will verify your identity and respond within 45 days (extendable by 45 additional days with notice).

To submit a complaint about our privacy practices to the California Privacy Protection Agency, visit cppa.ca.gov.

16. Supervisory Authorities

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the relevant supervisory authority for your jurisdiction:

• European Union: Lodge a complaint with your local EU data protection authority. A directory of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
• United Kingdom: Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
• Switzerland: Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at fdpic.ch.
• California, United States: Submit a complaint to the California Privacy Protection Agency at cppa.ca.gov.

We encourage you to contact us first at hello@product.studio so we have the opportunity to address your concern directly.

17. Changes to This Privacy Policy

We may update this Policy to reflect changes in laws, technology, or our practices. When we make material changes, we will notify you by email, in-app notice, or by posting an update on our website, and indicate the “Last updated” date at the top. For material changes affecting AI training, profiling, or advertising data practices, we will provide at least 30 days advance notice and, where required by law, obtain fresh consent. Continued use of the Service after the effective date means you accept the revised Policy.

18. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, contact us at:

Product Studio, Inc.
Data Controller
San Francisco, California, USA
hello@product.studio

We will respond within the timeframes required by applicable law.