Privacy Notice

Who is responsible

HALTSEAL Inc., a Delaware corporation ("HALTSEAL," "we," or "us"), operates haltseal.com and is responsible for the personal information we collect through this website and direct HALTSEAL inquiries.

This notice covers website visits, business inquiries, and privacy or security reports. Customer assessments and other services have separately agreed scopes and data handling terms. This notice does not replace those terms or remove any rights you have under applicable law.

For privacy questions or requests, email scott@haltseal.com with "HALTSEAL Privacy" in the subject line, or use the Contact form. Our Legal Notice identifies the company and its registered office.

Information we handle

Website requests. When your browser requests a page or download, our hosting and delivery providers process technical information to deliver and protect that request. This can include your IP address, browser information, requested address, request time, and response or security information. Cloudflare provides website delivery and security services.

Inquiries you send. The Contact form collects your email and message, with optional name and company. The Assessment form collects your work email, company and workflow description. We store the message, a receipt reference, submission time and review status. Email inquiries include the information and attachments you choose to send. Opening an email link does not itself send a message.

Demo bookings. Our Book a demo links open Calendly's scheduling page. Calendly collects your name, email and optional preparation note to arrange the meeting; HALTSEAL receives the booking details you choose to submit. Calendly's own terms and Privacy Notice apply on its website. You can use the Contact or Assessment form, or email us instead.

Optional AI guide. Hana is an AI-generated guide powered by Anam. We load Anam's widget from unpkg only when you open the guide. Opening it sends technical request information to those providers, including your network address and browser information. Starting a conversation sends the text you enter and, if you allow microphone access, your audio to Anam and its service providers to generate replies. Conversations may be recorded and transcribed, and session records may be available to HALTSEAL through Anam. We do not promise confidential or unrecorded conversations, or zero data retention. Keep questions non-confidential and do not share payment records, account details, credentials or personal information about others. Closing the guide ends its connection; it does not delete records already processed. You can use Contact, the Assessment form or email instead, and use the privacy contact above for requests concerning a conversation.

Form security. We use a keyed hash of your network address for short-lived submission limits and a keyed message fingerprint to recognize repeat submissions. The inquiry database does not store your raw network address. Expired limit records are removed during a later successful submission.

Privacy and security reports. We handle your contact details, the issue you describe, related correspondence, and the minimum information needed to investigate, respond, or verify a request.

Browser preferences and the demonstration. The website stores your theme preference in your browser's local storage under haltseal-theme. You can remove it through your browser's site-data settings. The public demonstration uses synthetic information and runs in your browser. It does not initiate payments or ask you to submit real payment records.

SDK sandbox and workflow outline. Starting the separate SDK sandbox sends fixed demo requests to HALTSEAL's Cloudflare Worker. A random session key isolates synthetic attempt history and request results in Cloudflare storage. It is held in browser memory; choosing Save to workspace temporarily carries the key in this tab’s sessionStorage until saving succeeds or it is cleared on a workspace visit after expiry; expired keys cannot access the fixture; downloaded records do not include it. Only fixed demo identities are accepted. The session expires after 15 minutes and stops after 80 calls. A daily rotating hash of the network address is used to limit session starts; raw network addresses are not stored in the sandbox database. Cloudflare still processes request and security information as described above. The Pricing page's workflow choices stay in browser memory until you choose to include them in your pilot request; they are not analytics or a payment decision. That request uses the existing inquiry service and collects company, email and the note you submit.

Please keep initial inquiries to business context. Do not send credentials, private keys, account details, payment records, or other people's personal information. If an assessment requires sensitive or confidential material, arrange the scope and a suitable transfer channel with us first. Security reports should follow the Responsible Disclosure Policy.

Pilot purchases

When you choose online checkout, Stripe collects payment, checkout email and billing details. Before payment, HALTSEAL collects the customer legal name, authorized contact name and contact email you supply. We send your contact email to Stripe to prefill checkout; you may change the billing email there without changing the named customer or its original authorized contact. In Cloudflare commercial storage we keep an opaque order reference, the full accepted agreement and offer, their version and document digest, the acceptance notice and time, Stripe session and payment references, checkout email, confirmation status and the setup outline you submit. Earlier orders retain the original records actually collected; this update does not reconstruct missing acceptance details. We do not collect card numbers. A necessary Secure, HttpOnly browser cookie keeps access to the order for up to 30 days. A random checkout retry key stays in this tab’s sessionStorage to resume an ambiguous checkout without creating a second purchase; you can clear it in site-data settings.

Resend sends transactional setup instructions, accepted-terms links and order details to your checkout email, and order/setup notifications to HALTSEAL. Your private order copy includes the customer/contact details and full accepted agreement; keep a downloaded copy secure. The contact email and Stripe billing email may differ, and we retain both for their stated order purposes. Stripe sends the paid invoice. Payment processing and mail records remain subject to those providers’ policies. A daily hash of the network address limits checkout starts; raw addresses are not stored in the order database. Cloudflare processes delivery and security information separately. When available, you can claim an order in a workspace using the same verified email. Commercial records remain separate from free evaluation data and are retained as needed for delivery, refunds, accounting and legal obligations. Orders whose payment session Stripe confirms expired are scheduled for cleanup after seven days. Uncertain or delayed payments are kept for reconciliation. Contact us about order-record access or deletion.

Evaluation workspace

When workspace sign-in is enabled, Clerk processes your email address, verification attempts, session identifiers and technical security information to create and authenticate your account. When you choose Google sign-in, Google and Clerk exchange your basic profile and email information for authentication. Its necessary cookies and browser storage maintain your session. Cloudflare stores your verified email, saved synthetic results, workflow outlines and pilot progress in a private account workspace. We verify the authenticated account on each private request. Workflow configurations include selected system names, route labels, the shared payment-reference label and decision owner. These are setup plans; selecting a system does not connect a provider, grant access or import payment data. You may download a setup brief for your engineer. Do not include confidential payment records or credentials in workflow outlines.

A separately reviewed personal native sandbox connection retains a signed, secret-free observation in the same private account store: workflow and obligation identifiers, collector and engine digests, attempt states, approval revisions, execution-intent names, timestamps and evidence digests. HALTSEAL verifies the reviewed collector signature and scope. No bank account details, provider credentials, raw provider responses or source approval documents are uploaded through this connection. These observations follow the same account access, deletion and 180-day inactivity expiry. Removing an observation does not reset the separately retained payment engine. The Workspace does not initiate provider payments.

Clerk sends authentication codes. Where configured, Resend sends one transactional welcome email with the next setup steps; a minimal account-level delivery or suppression marker remains after evaluation-data expiry or deletion to avoid duplicate messages. This is not a marketing subscription. A pilot request also submits your verified email, company and workflow context to our existing restricted inquiry service. Workspace request storage and a confirmed owner-inbox receipt are shown separately. Commercial scope, invoice and payment records remain separate from the free evaluation account.

You can export or delete evaluation data in workspace Settings. Workspace results, outlines and pilot references expire after 180 days without account activity; requests enforce this limit even if scheduled cleanup is delayed. Deleting evaluation data does not delete your authentication account, already submitted inquiries, commercial records or provider logs and backups. Contact the privacy address below about those records or account deletion. Provider processing may occur outside your country under our service arrangements.

Workflow Evaluation Kit requests retain your verified account email, saved workflow snapshot, selected SDK language, readiness confirmations, accepted evaluation license hash and timestamp, access review note, review reference and grant expiry. These records use the same account verification and Cloudflare storage described above. Authorized HALTSEAL operators review readiness and grant scoped download access; customer code and local kit reports are not uploaded through this flow. Access expires after 30 days unless renewed. Kit request records expire after 180 days without your kit activity and are removed when you delete evaluation data. Deletion or withdrawal blocks future downloads and does not remove already downloaded copies from your devices.

Company workspaces. Creating a company workspace keeps its name, verified member emails, hashed account identifiers, roles, invitation hashes, timestamps and company activity records in Cloudflare. Current authorized members share its configuration plans and examples according to their roles. Sandbox and Production plans use separate storage, revisions and activity labels; choosing Production does not activate payment control. Join links expire after seven days and can be withdrawn. The private link token is shown to its creator; a pending link may remain in this tab’s sessionStorage through sign-in, and is cleared after acceptance or sign-out. Company, environment and workflow selection stores identifiers in this tab and its navigation history, rather than saved workflow contents.

Personal records stay separate. An explicit, reviewed mapping copies a configuration plan into a company Sandbox and records the source and destination references; it transfers no native binding, source payment approval or reserved authority. Company evaluation plans and examples expire after 180 days without activity in that environment, including when delayed cleanup runs. Company ownership, membership and administrative activity are separate account and operating records. Export the current workspace from Settings; an authorized company Owner can contact the privacy address about shared company records or account metadata. Removing membership blocks future access, and does not remove copies a member previously downloaded.

Company sandbox installations. A company administrator can register a collector public key for one supported Sandbox workflow and a pinned package. Cloudflare retains its company/environment/workflow binding, configuration version and digests, collector public keys, expiry and revocation, signed installation receipts, retained lineage and attempt projections, and sandbox API verification timestamps and response digests. The host sends an ephemeral sandbox credential to HALTSEAL over HTTPS for fixed read-only account checks at the Increase sandbox API; our installation store and responses do not retain that credential or raw account bodies. We retain only fictional sandbox account and entity identifiers, not routing or account numbers. The collector evidence is owner-collected; the server API check confirms connection within the supported scope. Company roles do not confer payment approval.

Confirmed installation plans and their native history are operating records retained separately from disposable evaluation examples. Inactivity, reinstalling code, withdrawing a collector key or removing a member does not reset them or the separately retained engine. Standalone evaluation plans and examples still follow the 180-day environment inactivity limit. An authorized company Owner can contact the privacy address about installation operating records and the applicable retention needs. Current members can inspect the installation; removal blocks future access. Previously downloaded copies and retained local engine history are separate.

Reference treasury workflow. For the supported HALTSEAL-owned sandbox application, Cloudflare additionally retains its package pins, source-owner reference, signed native state, historical qualification checkpoint and application audit head and sequence. Full source approvals and local audit logs stay on your host. The installed application sends signed, narrow operation-admission checks against current company access; these checks contain request or attempt identifiers and an approval revision, and do not grant source payment approval. Provider writes run only from the installed host. Its recovery console listens on that host’s loopback address and keeps its private access key in browser memory until locked or closed. Reference reports share the installation operating-record access and retention described above. They do not establish an external customer deployment, independent remote attestation or production permission.

Company workflow operations. Cloudflare retains the latest signed heartbeat, last known journal projection, bounded command-admission identifiers, package pins, recovery coordinator, incident acknowledgement and company action audit. Heartbeat evidence expires after 90 seconds; an old retained observation remains available for diagnosis and does not establish current execution safety. Source approvals and full provider/local audit records remain on your host. Current company members can inspect operating evidence; Owner, Technical admin and Operator roles can assign a current member or acknowledge an incident without granting payment approval. These records share confirmed installation operating-record access and retention. No email or third-party message is added. Private same-host snapshots contain the ledger and signed hashes, excluding credentials, the live witness, configuration and audit files; they stay on your host and do not resume execution automatically.

Company workflow qualification retains a server-generated, secret-free scope and checklist record: company and workflow identifiers, configuration and package digests, collector key reference, fictional account identifiers, source-owner reference, retained lineage and obligation, matching evidence digests, service/meter summary, check time, checking administrator and expiry. Current company members may inspect it; current Owners and technical admins may request a server check. Historical qualification records remain distinguishable from current operating evidence. A record does not grant payment authority or production access. These records follow the separate installed operating-record retention; cancellation or evaluation inactivity does not reset retained payment history.

Company sandbox subscriptions

When monthly sandbox checkout is enabled, only a current company Owner can purchase or manage the company subscription. HALTSEAL sends the company name to Stripe and keeps the company and selected workflow binding, accepted offer and digest, acceptance time and Owner reference, test customer, Checkout and subscription identifiers, current invoice link and payment verification times in Cloudflare. Stripe collects checkout and billing details directly; HALTSEAL does not receive card numbers.

We derive one sandbox usage record for each canonical obligation in accepted signed retained history. The record contains company, environment and workflow identifiers, the obligation coordinate, first observation time, lineage and checkpoint references. Retries and reinstalling do not create another unit. These observations do not generate usage charges. Current company members can read service and usage status; only current Owners manage billing, open invoices or download the operating readout.

Subscription, offer acceptance, offboarding, usage and installation history are separate operating records. Inactivity, cancellation or rejoining the same company does not delete unresolved reservations or reset this history. Contact the privacy address about the applicable retention needs. Local engine stores and independently retained witnesses stay on the installed host; the operating readout does not transfer payment authority.

Optional evaluation emails

Signing in does not subscribe you to marketing. If you choose evaluation tips in Workspace Settings, we use your verified email, selected guidance track and evaluation milestones to send relevant tips and pilot information. This introduction lasts for the first 14 days of your workspace, with at most three messages and at least 48 hours between them. Completed steps are skipped. We do not use email-open tracking to decide your next step.

Cloudflare stores your consent version and time, stage times, send attempts and a minimal per-address suppression and frequency ledger. Ledger object names are hashes; it does not retain raw email or message bodies. Resend processes the email address and message for delivery. Where its signed delivery feedback is connected, we record delivery and stop on bounces, suppression or complaints. Acceptance by the mail provider is recorded separately from confirmed delivery. We recheck account eligibility before background sends.

Unsubscribe in any evaluation email or turn tips off in Settings. A page visit alone does not unsubscribe you; the confirmation form and the email provider's one-click request do. Workspace requests to contact us or enter checkout pause these tips. Pilot requests and identified checkout orders also stop them. When a reply, separate inquiry or booking is received, our founder stops this automated introduction as part of handling it. We keep a minimal suppression record after deletion or expiry so future background jobs do not revive unwanted mail; contact us about that record. Authentication codes, the one-time account welcome and necessary order messages are separate. Previously collected accounts are not enrolled without an explicit new choice.

Why we use it

We use information to deliver and secure the website; answer public product questions through the optional AI guide; respond to inquiries; arrange and document business discussions; count received inquiries and those that proceed to substantive workflow review; investigate errors, abuse, and reported vulnerabilities; handle privacy requests; and meet applicable legal or recordkeeping obligations.

Where applicable data protection law requires a legal basis, these activities rely on our legitimate interests in operating a secure website and responding to business communications, subject to your rights; steps you request before entering a contract, where relevant; or our legal obligations. We obtain consent when the law requires it.

Who may receive it

Information may be available to people working for us who need it for the purposes above, and to providers that support website hosting, security, email, and business administration. The inquiry form and restricted review inbox use OpenAI Sites and Cloudflare infrastructure to process and store submissions. The optional AI guide uses unpkg for widget delivery and Anam and its service providers for conversation processing and session records. Professional advisers may receive information where necessary for their work. We may also disclose information when required by law or reasonably necessary to investigate abuse, protect rights, or address a security incident, subject to applicable law.

Anam publishes information about its practices in its Privacy Policy. Its processing of customer product sessions is also subject to the applicable service arrangements. This notice describes HALTSEAL's use of the guide.

If responsibility for HALTSEAL is transferred to another entity, relevant records may be transferred as permitted by law and applicable agreements. We will update this notice and provide any further notice or choice required for that transfer. A change to this page does not itself transfer an existing customer agreement.

We operate from the United States. Service provider infrastructure may process information in other countries. Where applicable law requires safeguards for an international transfer, we use the safeguards required for that transfer. Contact us for information about arrangements relevant to your information.

How long we retain it

Retention depends on the record and its purpose. We consider the time needed to respond to an inquiry or report, the duration of a business relationship, security and investigation needs, applicable legal requirements, and the need to establish or defend legal claims. Sandbox session storage is scheduled for deletion after its 15-minute expiry, and session-start counters at the next UTC day boundary. Expiry is enforced on requests even if scheduled cleanup is delayed. These schedules do not delete Cloudflare request logs or provider backups. Provider logs and backups are also subject to the relevant service arrangements. We delete or de-identify information when it is no longer needed, subject to these requirements.

Your choices and rights

You can choose whether to contact us and what information to provide. We may be unable to answer a request without the information needed to address it. You can clear website data through your browser and ask us to stop nonessential promotional communications.

Depending on the law that applies, you may have rights to access, correct, delete, or obtain a copy of your information; object to or restrict particular processing; withdraw consent where processing relies on it; or complain to a data protection authority. You may also have rights to submit a request through an authorized agent or appeal our response. Contact scott@haltseal.com. We may ask for information reasonably needed to verify and address your request. We will not unlawfully discriminate against you for exercising your rights.

This website is intended for business and technical audiences and is not directed to children. Please contact us if you believe a child has provided personal information through these channels.

Browser signals and cross-site collection

Do Not Track. The public Website does not change its behavior in response to browser Do Not Track signals. We do not configure advertising technology, visitor analytics or website session replay. Anam's optional third-party widget loads only when you open the AI guide; a Do Not Track signal does not change its conversation processing. Internal inquiry-to-review counts use submitted records and staff-recorded review status, not browsing history.

Third-party collection over time and across sites. We do not configure the Website to allow third parties to collect information about visitor activity over time and across unrelated websites or online services for behavioral advertising or cross-site profiling. Cloudflare processes request and security information as our website delivery and security provider, as described above; that processing is governed by our service arrangements and applicable law.

Changes and external sites

We update the dates and version above when this notice changes and provide additional notice when required. Changes take effect when published or on the stated effective date, whichever is later. Material changes to how previously collected information is used will be handled in accordance with applicable law. You can read the previous published version or request other earlier versions using the privacy contact above.

The notice in effect when information was collected remains relevant to that collection. An operator change does not remove applicable privacy rights or permit us to disregard the commitments made when information was collected.

External websites and services linked from this website have their own privacy practices.