Operated by GTM Software Labs, Inc. (“haloplane,” “we,” “us,” “our”). This Privacy Policy describes how GTM Software Labs, Inc., an Ontario corporation operating as haloplane, collects, uses, discloses, and protects personal information in connection with the haloplane platform (the “Service”), our website at haloplane.ai, and our interactions with you. It applies to all users of the Service and visitors to our website.
This Privacy Policy should be read together with our Terms of Service, Acceptable Use Policy, and, where applicable, our Data Processing Addendum. Capitalized terms not defined here have the meanings given in the Terms of Service.
GTM Software Labs, Inc. is the organization responsible for the personal information described in this Privacy Policy. You can reach us at:
GTM Software Labs, Inc.
Email: legal@haloplane.ai
For the purposes of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), we are the organization accountable for the personal information in our possession or custody, including information transferred to third parties for processing on our behalf.
Our privacy officer can be reached at legal@haloplane.ai.
We collect personal information in the following categories:
2.1 Account information. When you sign up for the Service, we collect your name, email address, company name, and role or title. If you sign up using a corporate authentication provider, we receive the information that provider shares with us.
2.2 Payment information. When you subscribe to a paid Plan or purchase Credit packs, our payment processor, Stripe, Inc., collects your payment method details (such as credit card number, expiration date, and billing address). We do not receive or store your full payment card number. We receive from Stripe a confirmation of payment, the last four digits of your card, card type, and billing address for invoicing and tax purposes.
2.3 Usage information. We collect information about how you use the Service, including Credit consumption, features accessed, session duration, and actions taken within the Service. This information is associated with your account.
2.4 Customer Data containing personal information. You may submit Customer Data to the Service that contains personal information about your employees, partners, customers, or other individuals. You are the controller of that personal information, and our processing of it on your behalf is governed by the Data Processing Addendum where applicable.
2.5 Communications. If you contact us by email or through any contact form, we collect the information you provide in that communication.
2.6 Website analytics. When you visit haloplane.ai, we use Google Analytics to collect information about your visit, including pages viewed, time on site, referral source, browser type, device type, operating system, and IP address. Google Analytics uses cookies and similar technologies to collect this information. See Section 8 for details on how we handle cookies, including how we obtain consent from visitors in the European Union and United Kingdom.
2.7 Information we do not collect. We do not intentionally collect sensitive personal information such as health information, biometric data, government-issued identification numbers, or information about children. The Service is not directed to individuals under the age of majority in their jurisdiction.
We use personal information for the following purposes:
3.1 To provide the Service. We use your account information and Customer Data to operate the Service, authenticate your access, process your requests, generate Platform Intelligence and Outputs, and deliver the features of your Plan. Identifiable personal information within Customer Data is used solely to provide, secure, and support the Service to the customer that submitted it.
3.2 To process payments. We use payment-related information to charge fees for your Plan and Credit pack purchases, manage billing, and comply with tax obligations.
3.3 To communicate with you. We use your email address to send transactional communications, including account confirmations, billing receipts, Credit usage alerts, renewal notices, security alerts, and service updates. We may also send product announcements and other communications related to the Service. You may opt out of non-transactional communications at any time by using the unsubscribe link in those emails or by contacting us at legal@haloplane.ai.
3.4 To improve the Service using de-identified data only. We may use aggregated and de-identified data that does not identify you or any individual for product improvement, including quality assurance of Outputs and refinement of haloplane’s own prompts, rubrics, and methodology, and for broader analytical and product development purposes. We do not use identifiable personal information from Customer Data for haloplane’s own product improvement or any purpose other than delivering, securing, and supporting the Service to the customer that submitted it.
3.5 To secure the Service. We use personal information to detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service and Acceptable Use Policy.
3.6 To comply with law. We use personal information as necessary to comply with applicable legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims.
3.7 Website analytics. We use analytics data to understand how visitors use our website, improve our website content and performance, and measure the effectiveness of our communications. For visitors located in the European Union or United Kingdom, analytics data is collected only after consent is obtained, as described in Section 8.
The Service uses artificial intelligence, including large language models provided by our AI Service Providers, to process Customer Data and generate Platform Intelligence and Outputs.
4.1 Three categories of data. As described in the Terms of Service, the Service processes data in three layers: (i) Customer Data, which you submit and which you own; (ii) Platform Intelligence, which the Service’s AI agents generate as intermediate analytical work product and which haloplane owns; and (iii) Outputs, which are the final deliverables surfaced to you and which you own. This Privacy Policy governs personal information that may be present in Customer Data and Outputs. Platform Intelligence does not contain identifiable personal information because personal information is de-identified before it is incorporated into Platform Intelligence that haloplane retains.
4.2 AI Service Providers. Customer Data submitted to the AI Features is processed by our AI Service Providers. We require our AI Service Providers, by contract, not to train their models on your Customer Data processed through the Service. A current list of our AI Service Providers and other Subprocessors is maintained at haloplane.ai/subprocessors.
4.3 Probabilistic processing. The AI Features operate probabilistically and may produce results that are inaccurate or incomplete. Outputs may contain information that appears to be personal information but is generated rather than sourced from your Customer Data. You are responsible for verifying Outputs before relying on them, including any personal information they may contain.
4.4 De-identification and cross-customer protection. haloplane de-identifies personal information before incorporating any intermediate work product into Platform Intelligence that haloplane retains. This means that the analytical asset haloplane builds across its customer base does not contain identifiable personal information from Customer Data. Confidential business information (other than personal information) embedded in Platform Intelligence remains subject to haloplane’s confidentiality obligations under the Terms of Service, and haloplane will not use Platform Intelligence in a manner that reveals one customer’s Confidential Information to another customer.
We disclose personal information to the following categories of recipients, and only for the purposes described in this Privacy Policy:
5.1 Subprocessors. We share personal information with our Subprocessors, including AI Service Providers and infrastructure providers, to operate and deliver the Service. Our current Subprocessors are listed at haloplane.ai/subprocessors. We remain accountable for personal information transferred to Subprocessors for processing on our behalf.
5.2 Payment processor. Payment information is collected and processed by Stripe, Inc. Stripe’s handling of your information is governed by Stripe’s own privacy policy.
5.3 Analytics provider. Website analytics data is collected and processed by Google through Google Analytics, subject to the consent requirements described in Section 8. Google’s handling of this data is governed by Google’s privacy policy.
5.4 Legal and compliance. We may disclose personal information where required by law, regulation, legal process, or enforceable governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.
5.5 Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the acquiring entity. We will provide notice before personal information becomes subject to a different privacy policy.
5.6 With your direction. We may disclose personal information where you direct us to or provide consent.
We do not sell personal information. We do not disclose personal information to third parties for their own marketing purposes.
6.1 Hosting locations. The Service is hosted on Amazon Web Services (AWS) infrastructure located in Canada (ca-central-1) and the United States (us-east-1). Customer Data and personal information may be stored and processed in either location.
6.2 Cross-border transfers. Because we use infrastructure and Subprocessors located in the United States, personal information collected in Canada may be transferred to, stored, and processed in the United States. When personal information is in the United States, it is subject to United States law, including laws that may permit government authorities to access it in certain circumstances.
6.3 Safeguards. We protect personal information transferred across borders through contractual obligations with our Subprocessors that require them to protect personal information to a standard comparable to the protections required under Canadian law, and through the administrative, technical, and physical safeguards described in Section 7.
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include:
No method of transmission or storage is completely secure. While we take reasonable measures to protect personal information, we cannot guarantee absolute security.
8.1 What we use. We use cookies and similar technologies on haloplane.ai for the following purposes:
8.2 Consent for visitors in the European Union and United Kingdom. The EU ePrivacy Directive (Directive 2002/58/EC, as amended) and the UK Privacy and Electronic Communications Regulations require prior opt-in consent before non-essential cookies are set for visitors located in the EU or UK. We comply with this requirement as follows:
8.3 Consent for visitors in Canada. Under PIPEDA, implied consent through continued use of the website is sufficient for non-essential analytics cookies, provided the use is disclosed in this Privacy Policy. Canadian visitors are not presented with a cookie consent banner unless required by other applicable law. This Privacy Policy serves as the required disclosure. Canadian visitors may opt out of Google Analytics at any time by adjusting their browser settings or installing Google’s opt-out browser add-on.
8.4 Your choices. Regardless of your location, you can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service. You can also opt out of Google Analytics by installing Google’s opt-out browser add-on, available at tools.google.com/dlpage/gaoptout.
Under PIPEDA, you have the following rights with respect to your personal information:
9.1 Access. You may request access to the personal information we hold about you.
9.2 Correction. You may request that we correct inaccurate or incomplete personal information.
9.3 Withdrawal of consent. You may withdraw your consent to our processing of your personal information, subject to legal or contractual restrictions. Withdrawing consent may affect our ability to provide the Service to you.
9.4 Deletion. You may request deletion of your personal information. We will comply unless we are required or permitted by law to retain it, or unless it is necessary for the purposes for which it was collected.
9.5 How to exercise your rights. To exercise any of these rights, contact us at legal@haloplane.ai. We will respond within 30 days. We may ask you to verify your identity before processing your request.
9.6 Customer Data. If you are an individual whose personal information has been submitted to the Service as part of a customer’s Customer Data, your request should be directed to the customer that submitted it. We will assist that customer in responding to your request as described in the Data Processing Addendum.
10.1 Account information. We retain your account information for as long as your account is active and for a reasonable period after termination for record-keeping, tax, and legal purposes.
10.2 Customer Data. Customer Data, including any personal information it contains, is available for export for 30 days after termination, after which it is deleted in the ordinary course, as described in Section 10.4 of the Terms of Service and in the Data Processing Addendum.
10.3 Platform Intelligence. Platform Intelligence is retained by haloplane as its property and may be retained indefinitely. Platform Intelligence does not contain identifiable personal information because personal information is de-identified before it is incorporated into Platform Intelligence that haloplane retains. Confidential business information (other than personal information) embedded in Platform Intelligence remains subject to haloplane’s confidentiality obligations under the Terms of Service.
10.4 Payment records. We retain payment and invoicing records as required by applicable tax and financial reporting laws.
10.5 Analytics data. Google Analytics data is retained for 14 months, after which it is automatically deleted by Google in accordance with our retention settings.
10.6 Communications. Records of communications with us are retained for as long as necessary to resolve the matter and for a reasonable period after for record-keeping purposes.
The Service is not directed to individuals under the age of majority in their jurisdiction. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it promptly.
We may update this Privacy Policy from time to time. For material changes, we will give at least 30 days’ notice by email to the account holder or by notice in the Service. Non-material changes take effect when posted. The effective date at the top of this Privacy Policy indicates when it was last updated.
If you have a complaint about our handling of your personal information, contact us at legal@haloplane.ai. We will investigate and respond. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
If you have questions about this Privacy Policy or our privacy practices, contact us at:
GTM Software Labs, Inc.
Email: legal@haloplane.ai