Privacy Policy
This Privacy Policy explains how Halor collects, uses, and protects your personal data when you visit our website, subscribe to our newsletter, or interact with our content.
We've written this policy in plain English. It applies to subscribers and visitors in Singapore, Hong Kong, Australia, and New Zealand — Halor's MVP launch markets. Subscribers from other jurisdictions are welcome, but our data practices are designed for those four.
1. Who we are (the data controller)
Halor is operated by [Halor Pte. Ltd. — confirm registered entity name], registered in [registered office address], business registration number [UEN / business registration number].
Where this Policy refers to "Halor," "we," "us," or "our," it refers to that entity.
2. Privacy contact
For any privacy question, request, or complaint, contact us at privacy@halor.app. We aim to respond within 30 days.
You may also reach our Data Protection Officer via the same address.
3. The personal data we collect
We collect the minimum data needed to deliver the newsletter and run the waitlist:
- Email address — when you sign up via our embedded signup form on halor.app or via Substack.
- Free-text answer to one segmentation question — when you sign up, we ask "What's your single biggest health question right now?" Your answer is optional. If you answer, we store the text alongside your email.
- Server logs — IP address, browser / device data, and standard request metadata, captured automatically by our hosting provider for security and operational purposes.
- Aggregate analytics — anonymized usage data (page views, signup conversion rate, email open / click rates). We do not build individual profiles pre-launch.
We do not collect health, biomarker, or lab data through this website. The Halor mobile app stores your health data on your device and, only if you enable backup, in your own iCloud. It is never transmitted to our servers. The app has its own privacy policy, available in the app and at halor.app/app-privacy once published.
4. Sources of data
All data we hold about you comes either directly from you (signup form, email reply, free-text segmentation answer) or is generated automatically when you interact with our website or emails (server logs, open / click events). We do not buy, rent, or scrape personal data from third parties.
5. Why we collect your data (purposes)
We use your data for the following purposes:
- Newsletter delivery — sending you our weekly newsletter and any related transactional emails (welcome, unsubscribe confirmation).
- Waitlist management — keeping a record of who has signed up and notifying you when the Halor app launches in your market.
- Future product launch communications — sending you early access details, founding-subscriber announcements, and related updates when the app launches.
- Aggregate analytics — understanding which content resonates and how to improve future issues.
- Compliance and security — detecting abuse, securing infrastructure, and meeting our legal obligations.
We do not use your data for behavioural advertising, do not sell or rent your data, and do not share it with third-party marketers.
6. Legal basis for processing
The legal basis depends on your jurisdiction:
- Singapore (PDPA): consent, given when you submit the signup form, plus reasonable purposes for processing necessary to deliver the service you requested.
- Hong Kong (PDPO): consent under the Personal Information Collection Statement embedded in our signup flow, aligned to the six Data Protection Principles.
- Australia (Privacy Act / APP): APP 3 (collection by lawful and fair means with consent), APP 5 (notification at point of collection), APP 6 (use limited to disclosed purposes).
- New Zealand (Privacy Act 2020): IPP 1 (lawful purpose), IPP 3 (notification of collection), IPP 10 (use limited to disclosed purposes).
If you withdraw consent, we will stop using your data for the affected purposes. Some processing (e.g., compliance recordkeeping) may continue where another legal basis applies.
7. Who we share your data with
We share your data only with service providers that help us run the newsletter and waitlist:
- Beehiiv (newsletter delivery, signup form embed) — US-hosted. beehiiv.com/privacy.
- Substack (secondary newsletter platform, used as a content discovery surface) — US-hosted. substack.com/privacy.
- Hosting provider for halor.app — [hosting provider — confirm].
- Email transactional provider for welcome and password emails — [provider — confirm if separate from Beehiiv].
We do not sell your data. We do not share it with advertisers or marketing networks.
When the Halor mobile app launches, additional service providers (e.g., Supabase for backend storage, Stripe for payment processing) may be added; this Policy will be updated and you will be notified of material changes.
8. International transfers of data
Your data is processed and stored on systems located outside your country of residence. Specifically:
- Beehiiv and Substack are US-based and store data on US infrastructure.
- Our hosting provider operates infrastructure in [primary region — confirm].
This means your data leaves the APAC region. We rely on the following safeguards:
- Singapore (PDPA): transfers are made only to recipients that provide a comparable standard of protection or where consent has been obtained.
- Hong Kong (PDPO): Section 33 (cross-border transfer) is currently suspended, but we disclose transfers in this Policy to align with best practice.
- Australia (APP 8): we take reasonable steps to ensure overseas recipients comply with the APPs, and we remain accountable for those overseas recipients' handling of your data.
- New Zealand (IPP 12): we notify you of overseas storage in this Policy.
9. How long we keep your data
| Data category | Retention |
|---|---|
| Active subscriber email and segmentation answer | Until you unsubscribe |
| Unsubscribed email | 30 days after unsubscribe (suppression list compliance), then deletion |
| Server logs | 90 days |
| Aggregate analytics | Indefinite (anonymized; not tied to individuals) |
| Free-text segmentation answers (if not deleted earlier on request) | 24 months from collection |
You may request earlier deletion at any time (see § 10).
10. Your rights
Depending on your jurisdiction, you have some or all of the following rights:
- Right to access — request a copy of the personal data we hold about you (all four jurisdictions).
- Right to correction — request that we correct inaccurate or incomplete data (all four).
- Right to deletion / erasure — request deletion of your data, subject to legal obligations to retain certain records (all four).
- Right to data portability — receive your data in a structured, machine-readable format (AU and NZ).
- Right to withdraw consent — for any processing based on consent, you may withdraw it at any time (all four).
- Right to object to direct marketing — you can opt out of marketing emails using the unsubscribe link in any email (all four).
- Right to lodge a complaint with the supervisory authority:
- Singapore: Personal Data Protection Commission (PDPC) — pdpc.gov.sg
- Hong Kong: Office of the Privacy Commissioner for Personal Data (PCPD) — pcpd.org.hk
- Australia: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au
- New Zealand: Office of the Privacy Commissioner — privacy.org.nz
To exercise any right, email privacy@halor.app. We aim to respond within 30 days.
11. Cookies and tracking
For details on the cookies we use, see our Cookie Policy.
In summary: we use strictly necessary cookies (session, security), performance cookies (anonymized analytics), and functional cookies (preferences). We do not use third-party advertising or behavioural targeting cookies. The Beehiiv embed on our signup form sets cookies — those are disclosed in the Cookie Policy.
You can manage cookies via your browser settings. A consent banner is shown to first-time visitors and lets you choose which optional cookies to accept.
12. Children and minors
Halor is intended for adults aged 18 and older. We do not knowingly collect personal data from anyone under 18.
If you believe a child under 18 has subscribed, contact privacy@halor.app and we will delete the data promptly.
13. Security
We protect your data using:
- TLS encryption for data in transit between you and our infrastructure
- Access controls limiting which team members can view subscriber data
- Periodic review of third-party providers' security posture
- Standard safeguards offered by Beehiiv and Substack (see their respective security pages)
No system is perfectly secure. If we detect a breach affecting your data, we will notify you and the relevant supervisory authorities within the time frames required by your jurisdiction (72 hours under SG PDPA; mandatory NDB scheme under AU; notifiable privacy breach scheme under NZ).
14. Changes to this Policy
We may update this Policy. When we do:
- The "Last updated" date at the top changes.
- For material changes (e.g., a new third-party recipient, a new data category), we will email subscribers and post a notice on halor.app.
- For minor changes (e.g., clarifying language), we update the date but do not separately notify.
Continued use of halor.app or continued subscription after a material change constitutes acceptance of the revised Policy.
15. Cross-references
This Policy works alongside:
If there is any conflict, the document specifically addressing the topic governs.
16. Contact
For privacy queries, requests, or complaints: privacy@halor.app.
For all other inquiries: hello@halor.app.