Privacy Policy

1. Who We Are

Halvin is operated by a limited liability company currently in formation. The operator's legal name, registered address and registration number will be published on this page, and are available on request from support@halvin.dev.

2. Scope & Effective Date

This Privacy Policy applies to personal information processed by Halvin through our web applications, APIs, user interfaces, and customer communications.

This policy is effective as of 2026-11-10 (Version 1.0).

3. Data We Collect

We collect only the personal information strictly necessary to provide, secure, and operate our services:

GitHub Profile Information: When you sign in via GitHub OAuth, we receive your GitHub ID, username (login), and avatar URL.

Session Data: We issue a cryptographically signed HTTP session cookie strictly required to maintain your authenticated session.

Imported Jules Archive Data: When you import legacy or exported Jules archives, we store your connected repository identifiers, past sessions, patch diffs, scheduled tasks, memories, and environment variable names. Environment variable values are encrypted with per-record encryption keys before being stored; plaintext secret storage is never used.

Task Logs and Artifacts: We store execution logs, generated code diffs, and task artifacts created during asynchronous task execution.

Subscription and Billing Identifiers: We store plan status and Stripe customer and subscription identifiers. We never receive or process credit card numbers or banking payment details directly; all payments are processed through Stripe.

• GitHub OAuth profile: user ID, login username, and avatar URL
• Cryptographically signed session cookie
• Imported Jules archive data: repositories, sessions, patches, scheduled tasks, memories, and encrypted environment variable values
• Task execution logs and generated code artifacts
• Stripe customer and subscription IDs, and active plan status (no payment card numbers)

4. Purposes and Legal Bases for Processing

Under the General Data Protection Regulation (GDPR) and international privacy laws, we process personal data under the following legal bases:

Performance of a Contract (GDPR Art. 6(1)(b)): To provide and operate the Halvin cloud coding agent, manage user accounts, run coding tasks, and deliver requested features according to our Terms of Service.

Legitimate Interests (GDPR Art. 6(1)(f)): To maintain platform security, prevent abuse and fraud, detect and resolve bugs, and ensure network and system stability.

Legal Obligation (GDPR Art. 6(1)(c)): To satisfy statutory tax, accounting, and regulatory compliance obligations.

Consent (GDPR Art. 6(1)(a)): Where you explicitly grant consent for specific optional processing activities, which you may withdraw at any time.

5. Sub-processors

We engage trusted third-party sub-processors to provide essential hosting, computation, payment, and repository infrastructure. Each sub-processor is subject to contractual data protection terms consistent with GDPR standards:

We promise to publish and update a current list of all sub-processors on this page before transferring personal data to any new provider.

• Cloudflare — Edge compute, D1 database, R2 object storage, network hosting, and email routing infrastructure.
• Stripe — Payment processing, checkout, subscription management, and billing operations.
• GitHub — OAuth authentication, repository access, and pull request integration.
• AI model and inference provider (selected per deployment) — processes the task prompts and code context strictly needed to run a task.

6. International Transfers

Where personal data is transferred across international borders, including outside the European Economic Area (EEA) and the United Kingdom, we implement appropriate safeguards. We rely on the European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum to govern international data transfers.

7. Data Retention

We retain personal data only for as long as required to fulfill the purposes for which it was collected or to comply with legal requirements:

Session cookies and active session records expire after an absolute maximum duration of 30 days.

Imported Jules archive data, repository configurations, and account profiles are retained until you request deletion of your account.

Task execution logs and diagnostic artifacts are automatically purged after 90 days.

Billing, tax, and transaction records are retained for the mandatory statutory periods prescribed by applicable financial laws.

8. Security

We maintain industry-standard administrative, physical, and technical safeguards to protect your personal information:

All external data transmissions are encrypted using Transport Layer Security (TLS).

Environment variable values and sensitive secrets are stored using per-record AES-GCM encryption; secrets are never stored in plaintext.

Infrastructure access follows least-privilege principles, and user tasks are executed in isolated execution environments.

9. Your Rights

Under the GDPR and applicable data protection legislation, you have significant rights regarding your personal data:

You have the right to request access to your personal data, rectification of inaccurate data, erasure (the right to be forgotten), restriction of processing, data portability, and the right to object to processing. Where processing is based on consent, you may withdraw your consent at any time.

You also have the right to lodge a complaint with your competent data protection supervisory authority.

To submit a data subject rights request, please email support@halvin.dev. We target responding to all verified requests within 30 days.

10. California Privacy Rights (CCPA / CPRA)

This section provides additional disclosures required under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

California residents have the right to know what personal information we collect, use, and disclose; the right to request deletion of their personal information; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising their privacy rights.

To exercise any of these CCPA rights, please submit your request to support@halvin.dev.

11. Cookies

Halvin uses strictly necessary session cookies only. These cookies are essential to verify your identity and keep you signed in while navigating the service.

We do not deploy advertising cookies, behavioral tracking scripts, or third-party marketing cookies.

12. Children

Halvin is not directed to anyone under 16 years of age. We do not knowingly solicit or collect personal information from individuals under 16. If we discover that personal data from anyone under 16 has been collected, we will take immediate steps to delete it.

13. Changes to this Policy

We may modify this Privacy Policy periodically. The effective date (2026-11-10) and document version (1.0) will be updated accordingly. Material changes will be prominently announced on this page prior to becoming effective.