Privacy Policy

This Privacy Policy explains how Halite Intelligence Corp. ("Halite Intelligence," "Hallie," "we," "us" or "our") collects, uses, shares and protects information when you use the Hallie app (on iOS, Android or the web at hal.haliteintelligence.com), Hallie event sites (at events.haliteintelligence.com) and related services (together, the "Service"). Hallie covers products across categories such as beauty, personal care, fashion, accessories, home, health and wellness, and this policy applies to all of them. It applies together with our Terms of Service.

We collect information you provide directly, including:

• Account information (name, email, phone, birthday or age range, gender, city, country)
• Your answers to preference quizzes, in any category
• Products you enter, save or buy, including brand, type, size, shade, price, rating and photos
• Products you view, save or buy at brands' booths on event sites and the ratings shown to you
• Daily log entries and product feedback
• Friends you invite with your referral link and who joins with it
• Messages you send to Hallie's AI assistant
• Any consent choices you make

We also collect information automatically, including device and usage information.

With your consent, Hallie uses your profile and activity to personalize your experience and shares relevant information with participating partner brands, so they can recommend for you and serve you better. Sharing is brand by brand: a brand only ever sees people who agreed to share and who visited its booth or viewed, saved or bought its products. It never sees what you told Hallie about other brands and never sees anyone who hasn't interacted with it.

"Participating partner brands" means brands, retailers, event exhibitors and the hosts of events Hallie runs a site for, in any category Hallie covers, including beauty, personal care, fashion, accessories, home, health and wellness.

What a brand can receive

• Your name and contact details (email address and phone number)
• Your age range or birthday, gender, city and country
• Your quiz answers in the brand's categories, your style answers and your Hallie Vibe
• Characteristics you choose to tell us, such as skin or hair type, sizes, allergies or sensitivities
• What you did with that brand: products you viewed, saved or bought, the ratings shown to you and when
• What you are shopping for in its categories and its own products in your Hallie collection
• Other products you use, described only by type and price band, never by brand or product name

A brand sees this in its Halite dashboard and may download it as a customer file. Depending on the brand's arrangement with Halite, it may receive some of this information or all of it.

How brands may use it

Brands may use this information only to recommend products to you, to follow up on your visit, and, where you agreed to receive offers, to market to you. They may not sell it, use it for unrelated purposes or combine it to identify people who have not shared with them. They agree to these limits with Halite.

Withdrawing

You can turn sharing off at any time from your Privacy Dashboard. From then on you no longer appear in any brand's dashboard or in any later download. A file a brand downloaded before then stays with that brand, under its own privacy policy; to have it deleted, ask the brand or write to us and we will pass your request on.

Hallie runs sites for events (at events.haliteintelligence.com, as Hallie IRL) where you can create or sign in to your Hallie profile, take preference quizzes and explore the participating brands. A profile you create on an event site is a Hallie account, covered by this policy and our Terms, and you can use it in the Hallie app.

To sign up on an event site you agree to our Terms and this Privacy Policy, and to share your profile with the brands whose booths you visit there, including any sensitive details you choose to give in your answers, as described above. Receiving offers from Hallie and those brands is a separate choice: a second tick you can leave empty, which changes nothing else about your account.

The host of an event is also a participating partner. It may receive the information above for the people who joined its event and what they did across the event (the brands they visited and the products they viewed, saved or bought), for engagement and marketing related to its events, under the same limits as brands.

Your Hallie profile is meant to go with you. You can connect it to other apps and services, including AI assistants, AI shopping agents and apps built by developers on Hallie's platform (for example through "Connect with Hallie"), so they can understand what you like and shop for you or with you.

A connection is made only when you choose it, for that app or agent. Before you connect, you are shown what it is asking to see or do, such as reading your profile, your preferences and interests or adding products and notes to your Hallie account, and it receives only what you approve. A connected app or agent may use this information only to provide the service you connected it for, as its agreement with Hallie allows, and its own privacy policy also applies to what it receives.

You can see every connection, what it can access and its recent activity, and disconnect it at any time from your Privacy Dashboard or Connectors. Disconnecting stops any further access; information an app or agent has already received stays subject to its own privacy policy.

We use the information we collect to:

• Provide, operate and maintain the Service
• Personalize recommendations and content
• Process points, rewards and payouts
• Communicate with you about your account
• Analyze usage with our own first-party backend systems to improve the Service
• Detect, prevent and address fraud, abuse and security issues
• Comply with legal obligations

Hallie may use automated systems, including artificial intelligence, to analyze your profile, products, logs and preferences to generate personalized recommendations and to power the Ask Hallie chat assistant. This is part of the personalization described above, not a separate use of your information. AI-generated content is based on the information you provide and may not always be accurate — you should use your own judgment before acting on any recommendation. Hallie does not use AI to make decisions that produce legal or similarly significant effects about you.

If you connect a Gmail account, Hallie uses it only to find products you have bought. It looks only at emails that appear to be order confirmations or receipts, uses only real order confirmations and skips everything else, including marketing emails, shipping updates, newsletters and personal messages. Access is read-only: Hallie never sends, deletes or changes your email.

Hallie keeps no emails. Each order confirmation is read once by automated systems, including an AI service provider acting on our behalf, to pull out the products and order details (shop, order number, date, product, shade, size and price). The email itself is then discarded. Hallie keeps only those details, the names of any items in the order it doesn't track, so it can show you what it left out and a record of which emails it has already read so it never reads one twice. No one at Hallie reads your email.

Hallie's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Gmail account at any time from Connectors → Gmail. Disconnecting removes Hallie's access with Google and deletes products still waiting for your review; products you have already added stay on your shelf.

• Encrypted in transit. Everything sent between the Hallie apps, our website and our servers travels over encrypted HTTPS (TLS) connections.
• What Google shares with Hallie. When you connect Gmail, Google tells Hallie the email address of the account you connected, which Hallie uses to show it under Connectors and to avoid connecting the same inbox twice. Google also grants read-only access to that mailbox. While the account stays connected, Hallie checks it regularly for new order confirmations and adds what it finds to your review list. Nothing goes on your shelf until you approve it.
• Google access is read-only and encrypted. The read-only token Google gives Hallie is stored encrypted at the application layer (Fernet: AES encryption with an HMAC integrity check), with the key kept separately from the database. We never store the short-lived access tokens Google issues from it.
• No emails stored. Order confirmations are read once, by automated systems, and the email itself is discarded. Only the product and order details described above are kept. No one at Hallie reads your email.
• Passwords are stored only as salted bcrypt hashes, never in readable form.
• AI processing. The AI service provider that reads order confirmations does so on our behalf, under terms that do not allow it to use the data to train its models. Hallie does not use Gmail data to train AI models and never uses it for advertising.
• Restricted access. Access to production systems is limited to authorized Halite Intelligence personnel who need it to run the Service.
• Disconnecting. When you disconnect a Gmail account, Hallie revokes its access with Google straight away and deletes the stored token, along with any order products still waiting for your review. Products you have already added to your collection stay there.
• Deleting your account deletes your Gmail connections and everything found in them.
• Partner brands. If you choose to share your information with participating partner brands, products you add to your shelf from your orders are included in the same way as any other product on your shelf.

Some information you choose to provide — such as health-related skin conditions, allergies, sensitivities, dietary needs, health and wellness goals or other information that may be considered sensitive or special-category data under applicable privacy laws — receives extra protection. Hallie only processes this information with your separate, explicit consent, collected during onboarding in the app or when you agree at sign-up on an event site, and manageable at any time from your Privacy Dashboard.

Hallie does not ask you to identify your race or ethnicity. Where you tell us about skin or hair characteristics (for example, to get product matches formulated for melanin-rich skin), we treat that as a product preference, not as a request for your racial or ethnic origin. If Hallie ever collects racial or ethnic origin directly, it will be disclosed and consented to separately from this section.

Hallie uses a single, necessary session cookie to keep you signed in. We do not use third-party advertising or tracking cookies. As described above, we do analyze user activity using our own first-party backend systems.

This section applies to California residents.

Categories Collected

• Identifiers
• Contact information
• Device information
• Purchase history
• Preference information
• Preference profile
• Routine and product usage information
• User-generated content
• AI recommendation history

Business Purposes

• Personalization
• Customer support
• Security
• Analytics
• Product improvement
• Fraud prevention
• AI recommendation generation

Categories of Third Parties

• Participating partner brands and event hosts
• Apps, AI agents and developers you choose to connect
• Payment processors
• Cloud hosting providers
• Customer support vendors
• Analytics providers
• Email providers

Your California Rights

Subject to certain exceptions, you have the right to:

• Know what personal information we collect, use and share
• Access the personal information we hold about you
• Delete your personal information
• Correct inaccurate personal information
• Opt out of the sale or sharing of your personal information, if applicable
• Limit the use of sensitive personal information, if applicable
• Data portability
• Not be discriminated against for exercising these rights

Sharing your information with participating partner brands, as described above, may be considered "sharing" under the CPRA. You can exercise your choices at any time on our Your Privacy Choices page.

This section applies to individuals in the European Economic Area and the United Kingdom.

Contract

• Create and maintain your account
• Provide the Service
• Process points, rewards and payouts

Consent

• Sharing information with partner brands and event hosts, brand by brand
• Sharing information with apps and AI agents you connect
• Processing sensitive information
• Marketing communications
• AI personalization, where required

Legitimate Interests

• Security
• Fraud detection
• Product improvement
• Analytics
• Service maintenance

This section applies to people in Nigeria, under the Nigeria Data Protection Act 2023 ("NDPA") and the General Application and Implementation Directive 2025. Halite Intelligence Corp. is the data controller for the Hallie app and Hallie event sites. Brands and event hosts that receive your information with your consent are controllers of what they receive.

Why we process your information (lawful bases)

• Consent: sharing with brands and event hosts, sensitive information, marketing and connected apps and agents. You can withdraw it at any time.
• Contract: creating your account, running the Service and handling points, rewards and payouts.
• Legal obligation: keeping the records the law requires and responding to lawful requests.
• Legitimate interests: security, fraud prevention and improving the Service, never overriding your rights.

Your rights

Under the NDPA you have the right to:

• Be told how your information is used (this policy)
• Get a copy of your information and have it in a portable format
• Correct information that is wrong or incomplete
• Have your information deleted
• Restrict or object to processing, including marketing and profiling
• Withdraw consent at any time, without affecting what was done before
• Not be subject to decisions based solely on automated processing that significantly affect you

You can do most of this yourself from your Privacy Dashboard (download your data, change your consents, delete your account). For anything else, write to hallie@haliteintelligence.com. We reply within 30 days. When you withdraw sharing or delete your account, we stop showing you to brands straight away and pass on deletion requests for files brands have already downloaded.

Complaints

If you are unhappy with how we handle your information, tell us first and we will try to put it right. You can also complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Hallie's database is hosted in the European Union (the Netherlands). Some of the service providers that process information for us are in the United States: OpenAI (AI features, under terms that do not allow it to train on your data), Resend (email) and Google Firebase (app notifications). Brands and event hosts you share with may be in Nigeria or elsewhere. So your information is likely to be processed outside your country.

We transfer personal information only where the law allows it: to countries recognized as giving adequate protection, under data processing terms with each provider that include contractual safeguards such as Standard Contractual Clauses or, where neither applies, with your consent. For people in Nigeria, transfers follow Part VIII of the Nigeria Data Protection Act 2023. You can ask us for details of the safeguard used for a particular transfer.

• Your account and profile are kept while your account is open. When you delete your account, your profile, answers, products, activity and connections are deleted.
• What we keep after deletion: a one-way, unreadable fingerprint of your email, so sign-up bonuses can't be claimed twice.
• Your Halite record. Halite, the platform brands use, keeps a record for your email of what you shared with brands. Deleting your Hallie account doesn't delete it on its own: write to us and we will delete it too.
• Consent records (what you agreed to and when) are kept while your account is open, as proof of your choices.

You can delete your account at any time from your Privacy Dashboard.

If a security incident affects your personal information, we act at once to contain it. Where the law requires, we notify the relevant regulator, including the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put people's rights at risk, and we tell the people affected without undue delay, in plain words, with what happened and what they can do.

Marketing is your choice: on an event site it is its own tick at sign-up, and anywhere you can turn marketing from Hallie or from brands off. You can manage your consent choices, download your data and delete your account at any time from your Privacy Dashboard. See also Your Privacy Choices.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date, and where required, we will seek renewed consent.

Halite Intelligence Corp. — questions about this policy or your data can be sent to hallie@haliteintelligence.com.