Privacy Notice

Who is responsible

HALTSEAL Inc., a Delaware corporation ("HALTSEAL," "we," or "us"), operates haltseal.com and is responsible for the personal information we collect through this website and direct HALTSEAL inquiries.

This notice covers website visits, business inquiries, and privacy or security reports. Customer assessments and other services have separately agreed scopes and data handling terms. This notice does not replace those terms or remove any rights you have under applicable law.

For privacy questions or requests, email scott@haltseal.com with "HALTSEAL Privacy" in the subject line, or use the Contact form. Our Legal Notice identifies the company and its registered office.

Information we handle

Website requests. When your browser requests a page or download, our hosting and delivery providers process technical information to deliver and protect that request. This can include your IP address, browser information, requested address, request time, and response or security information. Cloudflare provides website delivery and security services.

Inquiries you send. The Contact form collects your email and message, with optional name and company. The Assessment form collects your work email, company and workflow description. We store the message, a receipt reference, submission time and review status. Email inquiries include the information and attachments you choose to send. Opening an email link does not itself send a message.

Demo bookings. Our Book a demo links open Calendly's scheduling page. Calendly collects your name, email and optional preparation note to arrange the meeting; HALTSEAL receives the booking details you choose to submit. Calendly's own terms and Privacy Notice apply on its website. You can use the Contact or Assessment form, or email us instead.

Optional AI guide. Hana is an AI-generated guide powered by Anam. We load Anam's widget from unpkg only when you open the guide. Opening it sends technical request information to those providers, including your network address and browser information. Starting a conversation sends the text you enter and, if you allow microphone access, your audio to Anam and its service providers to generate replies. Conversations may be recorded and transcribed, and session records may be available to HALTSEAL through Anam. We do not promise confidential or unrecorded conversations, or zero data retention. Keep questions non-confidential and do not share payment records, account details, credentials or personal information about others. Closing the guide ends its connection; it does not delete records already processed. You can use Contact, the Assessment form or email instead, and use the privacy contact above for requests concerning a conversation.

Form security. We use a keyed hash of your network address for short-lived submission limits and a keyed message fingerprint to recognize repeat submissions. The inquiry database does not store your raw network address. Expired limit records are removed during a later successful submission.

Privacy and security reports. We handle your contact details, the issue you describe, related correspondence, and the minimum information needed to investigate, respond, or verify a request.

Browser preferences and the demonstration. The website stores your theme preference in your browser's local storage under haltseal-theme. You can remove it through your browser's site-data settings. The public demonstration uses synthetic information and runs in your browser. It does not initiate payments or ask you to submit real payment records.

SDK sandbox and workflow outline. Starting the separate SDK sandbox sends fixed demo requests to HALTSEAL's Cloudflare Worker. A random session key isolates synthetic attempt history and request results in Cloudflare storage. It is held in browser memory; choosing Save to workspace temporarily carries the key in this tab’s sessionStorage until saving succeeds or it is cleared on a workspace visit after expiry; expired keys cannot access the fixture; downloaded records do not include it. Only fixed demo identities are accepted. The session expires after 15 minutes and stops after 80 calls. A daily rotating hash of the network address is used to limit session starts; raw network addresses are not stored in the sandbox database. Cloudflare still processes request and security information as described above. The Pricing page's workflow choices stay in browser memory until you choose to include them in your pilot request; they are not analytics or a payment decision. That request uses the existing inquiry service and collects company, email and the note you submit.

Please keep initial inquiries to business context. Do not send credentials, private keys, account details, payment records, or other people's personal information. If an assessment requires sensitive or confidential material, arrange the scope and a suitable transfer channel with us first. Security reports should follow the Responsible Disclosure Policy.

Pilot purchases

When you choose online checkout, Stripe collects payment, checkout email and billing details. HALTSEAL stores an opaque order reference, accepted offer and terms version, Stripe session and payment references, checkout email, confirmation status and the setup outline you submit in Cloudflare commercial storage. We do not collect card numbers. A necessary Secure, HttpOnly browser cookie keeps access to the order for up to 30 days. A random checkout retry key stays in this tab’s sessionStorage to resume an ambiguous checkout without creating a second purchase; you can clear it in site-data settings.

Resend sends transactional setup instructions to your checkout email and order/setup notifications to HALTSEAL. Stripe sends the paid invoice. Payment processing and mail records remain subject to those providers’ policies. A daily hash of the network address limits checkout starts; raw addresses are not stored in the order database. Cloudflare processes delivery and security information separately. When available, you can claim an order in a workspace using the same verified email. Commercial records remain separate from free evaluation data and are retained as needed for delivery, refunds, accounting and legal obligations. Orders whose payment session Stripe confirms expired are scheduled for cleanup after seven days. Uncertain or delayed payments are kept for reconciliation. Contact us about order-record access or deletion.

Evaluation workspace

When workspace sign-in is enabled, Clerk processes your email address, verification attempts, session identifiers and technical security information to create and authenticate your account. When you choose Google sign-in, Google and Clerk exchange your basic profile and email information for authentication. Its necessary cookies and browser storage maintain your session. Cloudflare stores your verified email, saved synthetic results, workflow outlines and pilot progress in a private account workspace. We verify the authenticated account on each private request. Do not include confidential payment records or credentials in workflow outlines.

Clerk sends authentication codes. Where configured, Resend sends one transactional welcome email with the next setup steps; a minimal account-level delivery or suppression marker remains after evaluation-data expiry or deletion to avoid duplicate messages. This is not a marketing subscription. A pilot request also submits your verified email, company and workflow context to our existing restricted inquiry service. Workspace request storage and a confirmed owner-inbox receipt are shown separately. Commercial scope, invoice and payment records remain separate from the free evaluation account.

You can export or delete evaluation data in workspace Settings. Workspace results, outlines and pilot references expire after 180 days without account activity; requests enforce this limit even if scheduled cleanup is delayed. Deleting evaluation data does not delete your authentication account, already submitted inquiries, commercial records or provider logs and backups. Contact the privacy address below about those records or account deletion. Provider processing may occur outside your country under our service arrangements.

Why we use it

We use information to deliver and secure the website; answer public product questions through the optional AI guide; respond to inquiries; arrange and document business discussions; count received inquiries and those that proceed to substantive workflow review; investigate errors, abuse, and reported vulnerabilities; handle privacy requests; and meet applicable legal or recordkeeping obligations.

Where applicable data protection law requires a legal basis, these activities rely on our legitimate interests in operating a secure website and responding to business communications, subject to your rights; steps you request before entering a contract, where relevant; or our legal obligations. We obtain consent when the law requires it.

Who may receive it

Information may be available to people working for us who need it for the purposes above, and to providers that support website hosting, security, email, and business administration. The inquiry form and restricted review inbox use OpenAI Sites and Cloudflare infrastructure to process and store submissions. The optional AI guide uses unpkg for widget delivery and Anam and its service providers for conversation processing and session records. Professional advisers may receive information where necessary for their work. We may also disclose information when required by law or reasonably necessary to investigate abuse, protect rights, or address a security incident, subject to applicable law.

Anam publishes information about its practices in its Privacy Policy. Its processing of customer product sessions is also subject to the applicable service arrangements. This notice describes HALTSEAL's use of the guide.

If responsibility for HALTSEAL is transferred to another entity, relevant records may be transferred as permitted by law and applicable agreements. We will update this notice and provide any further notice or choice required for that transfer. A change to this page does not itself transfer an existing customer agreement.

We operate from the United States. Service provider infrastructure may process information in other countries. Where applicable law requires safeguards for an international transfer, we use the safeguards required for that transfer. Contact us for information about arrangements relevant to your information.

How long we retain it

Retention depends on the record and its purpose. We consider the time needed to respond to an inquiry or report, the duration of a business relationship, security and investigation needs, applicable legal requirements, and the need to establish or defend legal claims. Sandbox session storage is scheduled for deletion after its 15-minute expiry, and session-start counters at the next UTC day boundary. Expiry is enforced on requests even if scheduled cleanup is delayed. These schedules do not delete Cloudflare request logs or provider backups. Provider logs and backups are also subject to the relevant service arrangements. We delete or de-identify information when it is no longer needed, subject to these requirements.

Your choices and rights

You can choose whether to contact us and what information to provide. We may be unable to answer a request without the information needed to address it. You can clear website data through your browser and ask us to stop nonessential promotional communications.

Depending on the law that applies, you may have rights to access, correct, delete, or obtain a copy of your information; object to or restrict particular processing; withdraw consent where processing relies on it; or complain to a data protection authority. You may also have rights to submit a request through an authorized agent or appeal our response. Contact scott@haltseal.com. We may ask for information reasonably needed to verify and address your request. We will not unlawfully discriminate against you for exercising your rights.

This website is intended for business and technical audiences and is not directed to children. Please contact us if you believe a child has provided personal information through these channels.

Browser signals and cross-site collection

Do Not Track. The public Website does not change its behavior in response to browser Do Not Track signals. We do not configure advertising technology, visitor analytics or website session replay. Anam's optional third-party widget loads only when you open the AI guide; a Do Not Track signal does not change its conversation processing. Internal inquiry-to-review counts use submitted records and staff-recorded review status, not browsing history.

Third-party collection over time and across sites. We do not configure the Website to allow third parties to collect information about visitor activity over time and across unrelated websites or online services for behavioral advertising or cross-site profiling. Cloudflare processes request and security information as our website delivery and security provider, as described above; that processing is governed by our service arrangements and applicable law.

Changes and external sites

We update the dates and version above when this notice changes and provide additional notice when required. Changes take effect when published or on the stated effective date, whichever is later. Material changes to how previously collected information is used will be handled in accordance with applicable law. You can request an earlier version using the privacy contact above.

The notice in effect when information was collected remains relevant to that collection. An operator change does not remove applicable privacy rights or permit us to disregard the commitments made when information was collected.

External websites and services linked from this website have their own privacy practices.