Halo Privacy Policy

Effective date: September 7, 2026 · Last updated: September 11, 2026

This policy explains how Huzi, Inc. ("Halo," "we," "us") collects, uses, and shares personal information. It covers the huzihalo.com website and dashboard, conversations with the Halo assistant by text/iMessage and web chat, and the rest of the Halo service (the "Services").

Three quick orientations:

• If you're a Halo customer (a real estate professional using Halo), this whole policy applies to you.
• If you visited a website Halo hosts for a real estate professional — for example, an agent's site on a *.huzi.site address or the agent's own domain — the agent is responsible for that site and for the information you submit on it. We process that information on the agent's behalf. See "Visitors to Customer Websites" below.
• We do not sell personal information, and we do not share it for targeted advertising.

1. Information We Collect

Account and identity. Name, email address, phone number(s) and iMessage address(es) you message us from, and profile photo/headshot. If you start by texting us, we create a provisional account keyed to your phone number or iMessage address.

Professional and brand profile. Information you provide to power your marketing: real estate license type/number/state, brokerage name/address/phone, MLS membership, service areas, bio and business story, social media links, brand colors and logos, and your answers to our brand questionnaire.

Messages and conversations. The content of your conversations with the Halo assistant — over iMessage/text and web chat — including attachments you send. We retain conversation history so the assistant has context and so we can provide support, audit quality, and keep records of instructions and orders.

Content you upload or point us to. Property photos, headshots, logos, documents (such as PDFs you host on your site), listing details and notes, and — when you give us a listing URL — property information and photos retrieved from that public listing page at your direction.

Payment and transaction information. Payments are processed by Stripe. We receive and store transaction records (amounts, dates, subscription status, order details) and Stripe identifiers, but we do not store full card numbers. Participants in our affiliate and partner programs also have Stripe Connect account identifiers, commission and payout records, and records of the customers attributed to them; customers who sign up with an affiliate code or through a partner have a record of that attribution.

Technical and usage information. IP address, browser/user-agent, login and verification events (verification codes are stored hashed), and server logs. For published customer sites, we derive aggregate visitor analytics from our web server logs (which include visitor IP addresses and user agents).

Cookies. The Halo app uses a single essential authentication cookie (token) to keep you signed in. We do not use advertising or cross-site tracking cookies on the Halo app. (Customer websites may contain analytics or advertising tags that the site owner chose to install — those are governed by the site owner's own notices.)

2. Where Information Comes From

Directly from you (messages, uploads, forms, checkout); automatically from your device and our logs; from our messaging provider (message delivery metadata); from Stripe (payment events); from public listing pages you ask us to import; and from visitors who submit forms on your published sites.

3. How We Use Information

• Provide the Services — run the assistant, build and host your sites and videos, deliver your leads, process payments, and keep your account working.
• Generate content with AI — see Section 4.
• Communicate with you — service and account messages by text and email (login codes, order updates, lead alerts), support, and — with any consent required by law — promotional messages, which you can opt out of at any time.
• Safety and integrity — spam and abuse screening (including automated screening of lead submissions), fraud prevention, security monitoring, and enforcing our Terms.
• Improve the Services — internal analytics, troubleshooting, and quality review of assistant conversations by authorized staff.
• Legal — complying with law and protecting rights.

4. AI Processing

Halo is built on third-party AI providers. Content needed to fulfill your requests — including conversation messages, photos, listing details, brand information, and lead submissions (for spam screening and summaries) — is processed by:

• AI model providers accessed through OpenRouter (the specific text and vision models vary and may change as we improve the product); and
• fal.ai for image generation/editing (including virtual staging) and video generation.

These providers process data under their own terms, which permit them to use it only to provide their service to us. We do not sell your content for AI training, and we do not use your content to train our own foundation models. Authorized Halo staff may review conversations and generated content for support, safety, and quality purposes.

5. When We Share Information

Service providers (subprocessors). We share information with vendors that help us run the Services, only as needed for their function:

Affiliates and partners who referred you. If you subscribe using another customer's affiliate code, that customer can see your name and account email, whether the commission on your payments is still clearing, and what they have earned from your subscription — never your conversations, sites, leads, phone number, or payment details. If you are attributed to a partner organization (for example, your brokerage), that organization's authorized managers can see your name, email, phone number, subscription plan and status, and sign-up date. Affiliates and partners may use this information only to track their referrals; they agree not to use it for anything else. If you are an affiliate or partner, we share with Stripe what it needs to pay you.

Your published sites. Information you choose to publish on your marketing sites is public — visible to anyone, indexed by search engines, and readable by AI crawlers/assistants (our sites include machine-readable summaries to help AI systems cite you accurately).

Legal and safety. We may disclose information to comply with law or legal process, enforce our Terms, or protect the rights, safety, and property of Halo, our users, or others.

Business transfers. If we're involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy's commitments.

No selling or ad-sharing. We do not sell personal information and do not share it with third parties for cross-context behavioral advertising.

6. Visitors to Customer Websites

Halo hosts marketing websites on behalf of real estate professionals ("customers"). The customer — not Halo — controls their site and is responsible for it.

If you submit a contact or lead form on a customer's site, we collect what you enter (typically name, email, phone, and your message, plus any other fields on that form) along with your IP address and browser information. We use automated tools (including AI) to screen submissions for spam, then deliver your submission to the customer, on whose behalf we store it. We don't use your submission for our own marketing, don't sell it, and don't share it for advertising.

To exercise privacy rights over information you submitted on a customer's site (access, correction, deletion), contact that customer directly — their contact details are on their site. We assist customers in fulfilling such requests, and you can also reach us at support@huzi.ai if you need help identifying the right party.

Customer sites may include third-party analytics or advertising tags chosen by the site owner (for example, Meta Pixel or Google Analytics). Those tools are governed by the site owner's own privacy notice, not this policy.

7. Retention

We keep personal information for as long as needed for the purposes above, then delete or de-identify it. In particular:

• Account and profile data: for the life of your account. After closure we keep it for up to 90 days for wind-down and abuse prevention, then delete or de-identify it, and we delete it sooner on request.
• Conversation history: while your account is active. After closure it is deleted on request, and otherwise within 90 days.
• Site snapshots and media: we keep versions and backups of your sites and media so any version can be restored for the life of your account. After closure, we keep only what is needed to keep a transferred site running and to meet legal obligations.
• Leads: until you delete them or your account closes. You can export them before closing, and for 90 days after by asking us.
• Payment and tax records: as required by law (typically 7 years).
• Affiliate and partner program records (attributions, commissions, payouts, and the terms version you accepted): while you take part, then as long as our payment and tax records (typically 7 years).
• Backups: encrypted-at-rest server backups age out on a rolling schedule.

8. Security

We use industry-standard safeguards: encryption in transit (TLS), access controls and role-based staff access, hashed verification codes, network isolation of internal services, and monitoring. Authorized staff can access accounts (including support access to a customer's workspace) under access controls, for the purposes described in this policy. No system is perfectly secure, so we can't guarantee absolute security — if we learn of a breach affecting your information, we'll notify you as required by law.

9. Your Rights and Choices

Regardless of where you live, you can ask us to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your account and personal information;
• Export your data (including your site content, media, and leads); and
• Opt out of marketing messages — reply STOP to any text (or just tell Halo to stop), or use the unsubscribe link in marketing emails. Service messages (like login codes) continue while you have an account.

To exercise these rights, email support@huzi.ai or ask Halo in your conversation. We'll verify the request is really from you (typically via your registered phone number or email) and respond within the time required by applicable law. We won't discriminate against you for exercising privacy rights. Where required, you may use an authorized agent, and if we deny a request you may appeal by replying to our decision.

10. US State Privacy Disclosures

For residents of states with comprehensive privacy laws (including California, Virginia, Colorado, Connecticut, Texas, and others): the categories of personal information we collect are described in Section 1 (identifiers; professional information; commercial/transaction information; visual content such as photos; internet activity such as logs; and inferences such as AI-generated content summaries); our purposes are in Section 3; and recipients are in Section 5. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not process personal information for profiling that produces legal or similarly significant effects. We do not knowingly collect sensitive personal information beyond what you volunteer in your content, and we don't use it to infer characteristics. Because we don't sell or share personal information, opt-out signals like Global Privacy Control don't change our processing, but we honor the rights in Section 9 for everyone.

11. Children

The Services are for adults (18+) working in a professional capacity. We don't knowingly collect information from children under 13; if you believe a child provided us information, contact support@huzi.ai and we'll delete it.

12. Changes to This Policy

We'll post updates here and update the date above. For material changes we'll notify you by text, email, or in-app notice before they take effect.

13. Contact Us

Huzi, Inc.
support@huzi.ai