Privacy
Version 1.0 · in force 2 September 2026
This is HALO's first privacy policy, published before launch and written by the team that built the product rather than by outside counsel. A lawyer will review it. Nothing in it is a placeholder or an aspiration — every collection, use and disclosure described here is one the software actually performs today, and where a practice is not yet settled this page says so instead of covering the gap with a general clause.
THE SHORT VERSIONWhat this comes down to
We hold what we need to pay you and to prove the numbers. We show a production your work, not your address. We do not sell anything to anybody, and there is no tracking on this site at all.
- There are no analytics, no advertising pixels and no third-party trackers on any HALO page. The typefaces are served from our own domain so that not even a font provider learns you were here.
- We set three cookies, all first-party, all of which do one job: keeping you signed in.
- If you connect a social account, we read a limited, named set of things about your recent public posts. We do not read your messages, your drafts or your followers' details.
- A production that hires you sees your public profile and the posts you made for their film. It never sees your postal address, your payout email, your total earnings or anything about your other campaigns.
- You can disconnect a platform yourself, from your profile, and it deletes what we read from it. To delete your account, email us and we do it. Section 7 says exactly what happens either way.
1Who we are, and who this covers
HALO is a managed marketplace for independent film marketing. Productions fund a fixed pool; creators post about the film and are paid for verified views; a person at HALO checks every account and every post.
This policy covers everyone who uses filmsonhalo.com and the HALO platform: creators, people at a production, and anyone who just reads the site. Where a section applies to only one of those, it says so.
For most of what is described here HALO is the controller — we decide what is collected and why. There is one exception worth naming: when a production runs a campaign, the production and HALO each decide some things about the campaign data independently, and we are separate controllers for those purposes rather than one acting for the other. A production cannot instruct us to hand over data this policy says we do not hand over.
Contact for anything in this document: privacy@filmsonhalo.com.
2What we collect
Four sources: what you type, what you connect, what the ledger records, and the small amount a web server sees whether it wants to or not.
What you give us
| Thing | When | Why it is required |
|---|---|---|
| Handle and platform | Signup | It is the account a person verifies, and the account your posts have to come from. |
| Email address | Signup | Signing in, and every notice about your money. Also the address a PayPal payout goes to unless you give us a different one. |
| Password | Signup | Stored only as a salted hash. The value you typed is never written to the store, to a log, or to any response. |
| Postal address | Signup | Tax and anti-fraud. It is one of the things that lets a person confirm two accounts are not the same person twice. No production ever sees it. |
| Country, follower count, niches | Signup | Matching you to films, and the checks a reviewer runs. |
| Display name, headline, bio, links, picture | Your profile, optional | What a production sees when it is deciding whom to invite. All of it is yours to change or clear. |
| Screen recordings and screenshots you upload | Submitting a post, or appealing | Evidence for the view count when we cannot read it from the platform. Gate 4 takes a short video of your analytics; an appeal takes a still. |
What we create about you
The ledger is the product, so most of what HALO knows about you is a record of what happened: slots held, posts submitted, which of the six checks each post passed, what was awarded, what was paid, and when. These entries are append-only — that is the feature that lets a production audit a report and lets you contest a decision — so they are corrected by adding a correcting entry, never by editing history.
What a web server sees anyway
Your IP address and the country your request arrived from are recorded at signup, and used for rate limiting and to spot one person opening many accounts. We also store a device fingerprint your browser generates at signup for the same reason. Our hosting provider keeps ordinary request logs.
What we get from a connected platform
See section 4. It is a short and specific list.
3Why we hold each thing
If you are in the UK or the EU, the right-hand column is the lawful basis under Article 6 of the GDPR. If you are not, it is still an honest account of why we have it.
| Purpose | What it uses | Basis |
|---|---|---|
| Running your account and paying you | Identity, email, payout details, the ledger | Performance of a contract |
| Verifying an account is a real person | Handle, address, IP, device fingerprint, platform data | Legitimate interests — a marketplace that does not check is a marketplace that pays fraud |
| Checking a post against the six gates | The post, its metrics, your screen recording | Performance of a contract; legal obligation as regards disclosure |
| Showing your profile to a production | What you chose to put on your profile, plus your delivery record | Performance of a contract |
| Emails about your slots and money | Email address | Performance of a contract. These are service messages, not marketing, and there is no marketing list. |
| Tax reporting and record keeping | Identity, address, amounts paid | Legal obligation |
| Fraud, abuse and rate limiting | IP, device fingerprint, account patterns | Legitimate interests |
4Connected accounts — TikTok, Instagram and Facebook
Connecting is optional. It reads a narrow, named slice of your recent public activity so we do not have to ask you to film your own analytics. You can disconnect at any time, and disconnecting deletes what we pulled.
You can use HALO without connecting anything. If you do not connect, you tell us your view count and upload a short screen recording of your own analytics, and a person checks it. Connecting is faster and it is how the engagement rate on your profile gets filled in.
What we ask the platform for
| Platform | Permissions requested | What we actually read |
|---|---|---|
| TikTok | Login Kit, and read access to your own videos and their metrics | Your public handle, display name and profile picture; and for your most recent 20 posts: the post's link, the date, and its views, likes, comments and shares. |
| instagram_business_basic, instagram_business_manage_insights | The same short list: handle, display name, picture, and for your most recent 20 posts the link, date, views/reach, likes, comments and shares. A professional account is needed; a linked Facebook Page is not. | |
| Read access to insights for the Page you nominate | The same list, for posts on that Page. |
What we do not read, ever
- Your direct messages, drafts, or anything not publicly posted.
- Your followers, their identities, or their contact details.
- Your email or phone number as held by the platform.
- Anything at all about accounts other than the one you connected.
- Anything from before the window — we take the most recent posts, not your history.
What we do with it
Three things, and nothing else. It fills in the reach, engagement rate and posting cadence shown on your profile. It answers the fourth of the six gates — whether the view count on a HALO submission is real — without you filming anything. And it is what lets a production make an informed decision instead of guessing.
Two numbers on your profile come from two different places and HALO never mixes them. Anything derived from a connected account is labelled as coming from the platform; anything derived from work you did on HALO is labelled as coming from HALO. Where a number came from travels with the number, on every screen it appears on.
Disconnecting
There is a Disconnect control on your profile page. When you use it we stop making requests immediately, revoke our access with the platform, and delete the figures we derived from it. Your HALO account, your ledger history and any money owed to you are untouched — those are ours and yours, not the platform's.
You can also revoke HALO's access from inside TikTok, Instagram or Facebook. If you do, our access ends at the platform and we delete what we pulled the next time we notice, which is within 24 hours.
Data obtained from these platforms is used solely as described here, is not sold, is not shared with any other production or creator, and is not used for advertising or for training any model.
6What we never do
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. In the specific sense those words carry under California law: no, on both counts. Some creator-discovery products do this and disclose it; HALO does not do it.
- We do not train models on your content or your data, and we do not licence it to anyone who does.
- We do not run advertising, so nothing here is ever used to target you.
- We do not give a production your postal address or your payout email. Not on request, not for tax, not for a dispute. If a production needs to reach you it does so through HALO.
- We do not show any creator what another creator earned.
7Deleting your data
Two different things, and you can do either without asking us. Disconnecting a platform removes what we pulled from it. Closing your account removes you.
To remove data obtained from TikTok, Instagram or Facebook
Sign in, open Profile, and press Disconnect on the connected platform. We revoke our access and delete the reach, engagement and cadence figures obtained through that platform's API immediately. You can reach the same outcome from the platform's own app-permissions screen; we act on that within 24 hours.
To close your HALO account
Email privacy@filmsonhalo.com from the address on your account, or write to us from inside HALO, and we will close it. There is not yet a button for this — closing an account means releasing a slot somebody may be waiting on and paying out a balance, and until that is one press we would rather a person did it than a half-built flow. When you ask:
- Your profile stops being visible to any production immediately.
- Money already earned is still yours. We pay out whatever you are owed in the next payout run, including where the balance is under the usual $20 minimum. Closing an account never forfeits a balance.
- A slot you are currently holding is released, so that the production can offer it to someone else.
- Your identity data, profile, uploaded recordings and screenshots, and platform data are deleted.
- Ledger entries are retained in a form that no longer identifies you — the amounts and the checks stay, because a production's report of a past campaign has to keep adding up, and because tax law requires us to keep a record of what we paid.
We answer a deletion request within 30 days, and normally the same day.
8How long we keep it
A retention table rather than a paragraph, because "as long as necessary" is not an answer.
| What | Kept for |
|---|---|
| Data pulled from a connected platform | Until you disconnect, or 90 days after your last activity on HALO, whichever comes first. Refreshed, not accumulated — we hold the current window, not a history. |
| Your profile and account | While the account is open, then deleted on closure. |
| Screen recordings and screenshots submitted as evidence | 12 months after the submission is decided, then deleted. An appeal extends it until the appeal closes. |
| Ledger entries and payment records | 7 years, for tax and audit. De-identified when the account closes. |
| Signup IP and device fingerprint | 24 months, then deleted. These exist to catch duplicate accounts, which is a signup-time problem. |
| Emails we sent you | The record that we sent it: 24 months. The content is the notice itself. |
| Support correspondence | 24 months from the last message. |
| Server logs | As kept by our hosting provider, which is 30 days at the time of writing. |
9Your rights
These rights come from different laws depending on where you live, but HALO does not sort people by jurisdiction before deciding whether to be reasonable. Ask, and we will do it, whoever you are and wherever you are.
- See what we hold. A copy, in a machine-readable file.
- Correct it. Most of it you can correct yourself in Account.
- Delete it. Section 7.
- Take it elsewhere. The same export, which is yours to do what you like with.
- Object, or ask us to restrict what we do with it. Including anything we do on the basis of legitimate interests.
- Withdraw consent where we relied on it — which, in practice, means disconnecting a platform.
- Not be discriminated against for asking. Using any of these does not affect your standing on HALO, your tier, or what you are paid.
Write to privacy@filmsonhalo.com. We will confirm it is you — usually by replying to the address on the account — and answer within 30 days, extendable once by a further 60 where a request is genuinely complex, and we will tell you if that happens.
If you are in California
The categories we collect are set out in section 2; the sources, purposes and recipients in sections 2, 3 and 5. We collect identifiers, commercial information, internet activity, geolocation at country level, professional information and user-generated content. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no "Do Not Sell or Share" link to give you — there is nothing behind it. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. You have the rights listed above and we will not treat you differently for using them.
If you are in the UK or the EU
The lawful bases are in section 3. You have the right to complain to your national supervisory authority, and we would rather you told us first so we can fix it. HALO's servers and processors are in the United States, so using HALO involves transferring your data there; we rely on the standard contractual clauses with our processors for that.
11Security
Passwords are salted and hashed, and the plain value exists only inside the function that receives it. Sessions are signed and expire. Everything is served over HTTPS with HSTS, and a link that carries a credential is never issued over plain HTTP. Uploads are capped and content-addressed. Access to the operator console is limited to named people.
No system is perfect, and a page that claims otherwise is lying. If something goes wrong that affects you, we will tell you — quickly, in plain words, and with what we know rather than after we have finished deciding how it sounds.
If you find a vulnerability, write to security@filmsonhalo.com. We will not threaten you for it.
12Age
HALO is for adults. You must be 18 or over to hold an account, because holding one means entering a contract and being paid. We do not knowingly collect anything from anyone under 18, and if we find out we have, we delete it and close the account. If you believe a minor has an account, tell us at privacy@filmsonhalo.com.
If a person under 18 appears in a post you make for a campaign, you need the consent of their parent or guardian. That is your responsibility and it is in the terms.
13Changes
When this changes we will change the version and date at the top, and keep the previous version available. If a change means we start doing something materially different with data we already hold, we will email you before it takes effect rather than after — a policy you have to re-read to discover a change is not notice.
14Contact
Privacy, access, correction and deletion:
privacy@filmsonhalo.com
Security: security@filmsonhalo.com
Everything else: hello@filmsonhalo.com
See also the Terms of Service and the guide to saying a post is paid.