Halo Privacy Policy

Effective date: November 12, 2026 · Last updated: October 13, 2026

This policy explains how Huzi, Inc. ("Halo," "we," "us") collects, uses, and shares personal information. It covers the huzihalo.com website and dashboard, conversations with the Halo assistant by text/iMessage and web chat, Halo Communities, and the rest of the Halo service (the "Services").

Three quick orientations:

• If you're a Halo customer (a real estate professional using Halo), this whole policy applies to you. It also applies if you texted Halo, for example through a partner's keyword, but haven't bought anything yet.
• If you visited a website Halo hosts for a real estate professional — for example, an agent's site on a *.huzi.site address or the agent's own domain — the agent is responsible for that site and for the information you submit on it. We process that information on the agent's behalf. See "Visitors to Customer Websites" below.
• We do not sell personal information, and we do not share it for targeted advertising.

1. Information We Collect

Account and identity. Name, email address, phone number(s) and iMessage address(es) you message us from, and profile photo/headshot. If you start by texting us, we create a provisional account keyed to your phone number or iMessage address.

Professional and brand profile. Information you provide to power your marketing: real estate license type/number/state, brokerage name/address/phone, MLS membership, service areas, bio and business story, social media links, brand colors and logos, and your answers to our brand questionnaire.

Messages and conversations. The content of your conversations with the Halo assistant — over iMessage/text and web chat — including attachments you send. We retain conversation history so the assistant has context and so we can provide support, audit quality, and keep records of instructions and orders.

Content you upload or point us to. Property photos, headshots, logos, documents (such as PDFs you host on your site), listing details and notes, and — when you give us a listing URL — property information and photos retrieved from that public listing page at your direction.

Payment and transaction information. Payments are processed by Stripe. We receive and store transaction records (amounts, dates, subscription status, order details) and Stripe identifiers, but we do not store full card numbers. Participants in our affiliate and partner programs also have Stripe Connect account identifiers, commission and payout records, and records of the customers attributed to them; customers who sign up with an affiliate code or through a partner have a record of that attribution.

Agreements and choices. Which version of our Terms and other agreements you accepted, when and how you accepted it (for example, a checkbox at checkout), and your IP address at that moment; the notices we sent you about them; and your choices about texts, calls, and promotional messages, including opt-outs. We keep your opt-out history even if you later opt back in.

Community information. If you join a Community: your profile and the parts of it you choose to show, your application answers (which may include license details), your posts, comments, direct messages, event activity, introduction requests, and membership payments. Your map location is your city. If you choose "Use my location," your device's location is sent to Mapbox only to find your city, and we don't store it.

Technical and usage information. IP address, browser/user-agent, login and verification events (verification codes are stored hashed), and server logs. For published customer sites, we derive aggregate visitor analytics from our web server logs (which include visitor IP addresses and user agents).

Cookies. The Halo app uses a single essential authentication cookie (token) to keep you signed in. We do not use advertising or cross-site tracking cookies on the Halo app. (Customer websites may contain analytics or advertising tags that the site owner chose to install — those are governed by the site owner's own notices.)

2. Where Information Comes From

Directly from you (messages, uploads, forms, checkout); automatically from your device and our logs; from our messaging provider (message delivery metadata); from Stripe (payment events); from public listing pages you ask us to import; and from visitors who submit forms on your published sites.

3. How We Use Information

• Provide the Services — run the assistant, build and host your sites and videos, deliver your leads, process payments, and keep your account working.
• Generate content with AI — see Section 4.
• Communicate with you — service and account messages by text and email (login codes, order updates, lead alerts), service calls about your account, support, and — only with your separate consent — promotional texts and calls, including calls that use an artificial or AI-generated voice. You can opt out of these at any time.
• Safety and integrity — spam and abuse screening (including automated screening of lead submissions), fraud prevention, security monitoring, and enforcing our Terms.
• Improve the Services — internal analytics, troubleshooting, and quality review of assistant conversations by authorized staff.
• Legal — complying with law and protecting rights.

4. AI Processing

Halo is built on third-party AI providers. Content needed to fulfill your requests — including conversation messages, photos, listing details, brand information, and lead submissions (for spam screening and summaries) — is processed by:

• AI model providers accessed through OpenRouter (the specific text and vision models vary and may change as we improve the product); and
• fal.ai for image generation/editing (including virtual staging) and video generation.

In Communities, AI sorts posts, and the Community's assistant can read the posts, comments, profiles, events, and Library resources visible to you, along with your own profile and a summary of your Halo workspace, to answer your questions. Your conversations with the assistant aren't shown to the Community's owner.

These providers process data under their own terms, which permit them to use it only to provide their service to us. We do not sell your content for AI training, and we do not use your content to train our own foundation models. Authorized Halo staff may review conversations and generated content for support, safety, and quality purposes.

5. When We Share Information

Service providers (subprocessors). We share information with vendors that help us run the Services, only as needed for their function:

Affiliates who referred you. If you subscribe using another customer's affiliate code, that customer sees only program totals, such as how many of their referrals converted and what they earned. They never see your name, email, phone number, account status, conversations, sites, leads, or payment details, and we won't confirm to them whether you are their referral.

Partners who referred you. If you reach Halo through a partner organization (for example, by texting its keyword or using its link), that partner's authorized managers can see your name, subscription plan and status, and sign-up date. If the partner has signed an agreement with us that limits how it may use your information, we also share your phone number and email with it, including by sending them to the partner's own systems (such as its CRM) when you first reach us. Our first text to you says so. The partner may use this information to track its referrals and to support you, and may not sell it or share it further. A partner may call or text you for marketing, including with an artificial or AI-generated voice, only if you separately agree to hear from that partner. When you opt out of texts from Halo, we tell each partner that received your number. If you are an affiliate or partner, we share with Stripe what it needs to pay you.

Partner-branded site checkers. Some partners offer our AEO Site Checker on their own web address, for example a lender or a brokerage. If you ask one of those checkers to text you your report, we share your phone number, the website you checked and its report with that partner, and that partner may contact you about it. The partner is named in the consent you give on that page.

Communities. If you join a Community, other members can see your posts and comments with your name and photo, and the parts of your profile you choose to show, including your city on the map but never your exact location. A post you share anonymously through Collective Learning appears to other members as "Halo Community member"; the Community's owner, managers, and moderators can still see that you wrote it. Your email and phone number stay hidden from other members unless you turn them on. The Community's owner and managers can also see your account email, your application answers, your membership payments, and your event attendance and feedback. Direct messages go to the person you send them to, and moderators see a message only if someone reports it. If you request an introduction to a vendor, we share the details the request form lists. If you contact a vendor through its public profile, we email the vendor your name, email, phone number, and message. In a private Community, membership payments are processed by Stripe on the Community owner's own Stripe account, so the owner receives your payment details as the seller. Halo staff can view any Community for support and safety.

Your published sites. Information you choose to publish on your marketing sites is public — visible to anyone, indexed by search engines, and readable by AI crawlers/assistants (our sites include machine-readable summaries to help AI systems cite you accurately).

Legal and safety. We may disclose information to comply with law or legal process, enforce our Terms, or protect the rights, safety, and property of Halo, our users, or others.

Business transfers. If we're involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy's commitments.

No selling or ad-sharing. We do not sell personal information and do not share it with third parties for cross-context behavioral advertising.

6. Visitors to Customer Websites

Halo hosts marketing websites on behalf of real estate professionals ("customers"). The customer — not Halo — controls their site and is responsible for it.

If you submit a contact or lead form on a customer's site, we collect what you enter (typically name, email, phone, and your message, plus any other fields on that form) along with your IP address and browser information. We use automated tools (including AI) to screen submissions for spam, then deliver your submission to the customer, on whose behalf we store it. We don't use your submission for our own marketing, don't sell it, and don't share it for advertising.

To exercise privacy rights over information you submitted on a customer's site (access, correction, deletion), contact that customer directly — their contact details are on their site. We assist customers in fulfilling such requests, and you can also reach us at support@huzi.ai if you need help identifying the right party.

Customer sites may include third-party analytics or advertising tags chosen by the site owner (for example, Meta Pixel or Google Analytics). Those tools are governed by the site owner's own privacy notice, not this policy.

7. Retention

We keep personal information for as long as needed for the purposes above, then delete or de-identify it. In particular:

• Account and profile data: for the life of your account. After closure we keep it for up to 90 days for wind-down and abuse prevention, then delete or de-identify it, and we delete it sooner on request.
• Conversation history: while your account is active. After closure it is deleted on request, and otherwise within 90 days.
• Site snapshots and media: we keep versions and backups of your sites and media so any version can be restored for the life of your account. After closure, we keep only what is needed to keep a transferred site running and to meet legal obligations.
• Leads: until you delete them or your account closes. You can export them before closing, and for 90 days after by asking us.
• Payment and tax records: as required by law (typically 7 years).
• Affiliate and partner program records (attributions, commissions, payouts, and the terms version you accepted): while you take part, then as long as our payment and tax records (typically 7 years).
• Agreement, notice, and opt-out records: for the life of your account and up to 7 years after it closes, so we can show what you agreed to and honor your choices.
• Backups: encrypted-at-rest server backups age out on a rolling schedule.

8. Security

We use industry-standard safeguards: encryption in transit (TLS), access controls and role-based staff access, hashed verification codes, network isolation of internal services, and monitoring. Authorized staff can access accounts (including support access to a customer's workspace) under access controls, for the purposes described in this policy. No system is perfectly secure, so we can't guarantee absolute security — if we learn of a breach affecting your information, we'll notify you as required by law.

9. Your Rights and Choices

Regardless of where you live, you can ask us to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and personal information;
• Export your data (including your site content, media, and leads); and
• Opt out of marketing messages and calls — reply STOP to any text (or tell Halo in your own words to stop), say so during a call, or use the unsubscribe link in marketing emails. Service messages (like login codes) continue while you have an account.

To exercise these rights, email support@huzi.ai or ask Halo in your conversation. We'll verify the request is really from you (typically via your registered phone number or email) and respond within the time required by applicable law. We won't discriminate against you for exercising privacy rights. Where required, you may use an authorized agent, and if we deny a request you may appeal by replying to our decision.

10. US State Privacy Disclosures

For residents of states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Texas, and others): the categories of personal information we collect are described in Section 1 (identifiers; professional information; commercial/transaction information; visual content such as photos; internet activity such as logs; and inferences such as AI-generated content summaries); our purposes are in Section 3; and recipients are in Section 5. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not process personal information for profiling that produces legal or similarly significant effects. We do not knowingly collect sensitive personal information beyond what you volunteer in your content, and we don't use it to infer characteristics. Because we don't sell or share personal information, opt-out signals like Global Privacy Control don't change our processing, but we honor the rights in Section 9 for everyone.

11. Children

The Services are for adults (18+) working in a professional capacity. We don't knowingly collect information from children under 13; if you believe a child provided us information, contact support@huzi.ai and we'll delete it.

12. Changes to This Policy

We'll post updates here and update the date above. For material changes we'll notify you by text, email, or in-app notice before they take effect, and we may ask you to review and accept the updated policy when you next sign in or make a purchase.

13. Contact Us

Huzi, Inc.
support@huzi.ai