Privacy policy
The company details on this page are temporary placeholders. They will be replaced with the final details.
Who is responsible
HaloTag SAS (placeholder), 1 rue de l’Exemple, 75001 Paris, France, is the controller of the personal data described in this policy.
For any question about your data, or to exercise your rights, write to privacy@halotag.app.
What we process
We collect as little as possible. What we process depends on how you use HaloTag.
If you have an account
- Your email address and, if you give it, your first name.
- The devices you are signed in on, with their IP address and browser, and your passkeys, to keep your account secure.
- Your household: its name, its members and the language of its alerts.
- Your profiles: a private name only your household sees, and on the public page only what you choose to show, such as a first name or nickname, a short message, the languages understood and the country for emergency numbers. For a child, at most a birth year.
- Your alert contacts, whose email addresses and phone numbers are encrypted.
- Your tags, the alerts they started and the messages exchanged with finders.
- The browsers where you turned on notifications.
If you are an alert contact
- The email address or phone number a household gave us, encrypted.
- When you confirmed it, and when you confirmed test alerts.
- We send you alerts only after you have confirmed your address or number.
If you scan a tag
- The time of the scan, an approximate country and a technical identifier renewed every day. It is computed from your IP address and browser, which we do not store, and it prevents duplicate alerts and abuse.
- The messages you choose to write to the owner.
- You do not need to give your name, number or email address, and we do not collect your location.
If you visit the website
- Technical logs kept by our host to deliver and protect the service. We use no advertising or analytics trackers.
The message on a profile’s public page is free text, shown to whoever scans the tag. If you write health information in it, such as an allergy or a communication difficulty, write only what helps in the moment.
We do not collect photos, full dates of birth, home addresses or location histories.
Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Running your account, your profiles and your alerts | Performance of our contract with you |
| Alerting your contacts and relaying messages with finders | Legitimate interest in returning what was lost to the people who look after it |
| Helping a child or an adult who may need help | Vital interests of the person concerned |
| Keeping the service secure and preventing abuse | Legitimate interest in protecting the service and its users |
| Notifications on your devices | Your consent, given in your browser and withdrawn at any time |
| Meeting our legal obligations | Legal obligation |
How long we keep it
| Data | Kept for |
|---|---|
| Account, household, profiles, contacts and tags | As long as the account exists |
| Signed-in devices | 30 days after the last use |
| Scans | 30 days |
| Messages between a household and a finder | 7 days after the alert ends |
| Links in test alerts | 7 days |
| Alert history and the security log | As long as the account exists |
Who receives it
Your data is used only by HaloTag SAS (placeholder) and by the providers below, which process it on our behalf under a data processing agreement. We never sell it or use it for advertising.
| Provider | Service | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting and databases | European Union |
| Google (Gmail) | Email delivery | United States |
Notifications reach your devices through your browser’s push service (run by Apple, Google, Microsoft or Mozilla), encrypted so that the service cannot read them.
A finder sees only the public page you set up. They never see your contact details, unless you chose to show your phone number, which is never possible for a child.
Our databases are in the European Union. When a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on its standard contractual clauses. The public page of each tag, limited to what you chose to show, is cached worldwide so that it opens quickly wherever it is scanned.
Your rights
You have the right to access, correct and delete your data, to restrict or object to its processing, to receive it in a portable format and to withdraw your consent at any time.
You can edit your profiles, contacts and tags yourself in your HaloTag space. For anything else, including deleting your account, write to privacy@halotag.app. We answer within one month.
You can also lodge a complaint with a data protection authority: CNIL (Commission nationale de l’informatique et des libertés), or the authority of the country where you live or work.
Children
HaloTag accounts are for adults. A child never has an account: a parent or legal guardian creates the child’s profile and decides what its public page shows.
For a child, the strictest settings apply: the name stays hidden unless the guardian chooses a first name or a nickname, and the household’s phone number is never shown.
Cookies
HaloTag uses only the cookies the service needs. They require no consent and are never used for advertising.
- Session, when you sign in
- Keeps you signed in, for up to 30 days
- Language, when you choose one
- Remembers your language for one year
Security
- Contact details and notification subscriptions are encrypted by the application, with keys kept outside the databases.
- The codes on tags are random and reveal nothing about you.
- Every connection is encrypted, and access to the back office requires strong authentication.
Changes to this policy
We update this page when the way we process data changes. The date at the top shows the current version.