Privacy policy

Information we collect

• Account information. When you sign in with Google, we receive your account identifier, name, email address, and profile image, and store account and session information to keep you signed in.
• Workspace content. We process the messages, prompts, files, custom tools, automation instructions, and other content you provide, together with AI responses and tool results generated while carrying out your requests.
• Connected services. If you connect a Google or other third-party service, we receive authorization tokens and the data made available through the permissions you grant. Signing in with Google does not by itself connect your Gmail, Drive, or other services.
• Operational information. Our services process network and request information, errors, and execution records to operate, secure, and troubleshoot Halo.
• Website analytics. When enabled, we use Google Analytics to measure visits to our marketing pages, campaign sources, and early access actions, including bookings and waitlist signups. Google Analytics uses cookies and receives browser and network information. We do not send your name, email address, booking answers, or workspace content as analytics event data. Our booking provider, Cal.com, processes the details you submit when scheduling a call.
• Updates and support. We receive information you send us for support. If you subscribe to Halo updates, your email address is processed by our newsletter provider, Buttondown; you can unsubscribe using the link in an update.

Google data and permissions

You choose which integrations to connect and authorize them through Google's consent screen. The data Halo can access depends on the permissions you grant and your own access to that service. Depending on the integration, permissions may allow Halo to read, create, edit, share, or delete data.

• Gmail and Calendar: messages, threads, drafts, labels, mail settings, calendars, and events for email and scheduling tasks and automations.
• Drive, Docs, Sheets, Slides, Forms, and Tasks: files, document contents, spreadsheets, presentations, forms and responses, and tasks for finding information and completing work.
• People, Chat, Photos, and YouTube: contacts and profile details; chat spaces, membership, and messages; selected or app-created photos and albums; and channel, video, playlist, comment, and membership information for the connected features you use.
• Search Console, Classroom, Workspace administration, Apps Script, BigQuery, and Google Cloud: site and search data, course and roster information, administrative resources and reports, scripts, query data, and cloud resource information for the corresponding integration. Organization and administrator restrictions still apply.

We use this information to provide the features you request, maintain your connections, run your configured automations, and display and preserve your work. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Halo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

AI processing and sharing

Halo sends prompts, relevant conversation context, and tool results to the AI provider used for your request. This can include Google data retrieved while carrying out your instructions. Our hosted AI service currently uses Together AI. See Together AI's privacy policy for its handling of information. Custom tools and extensions may use additional providers you configure.

We use infrastructure providers to host Halo, its databases, workspaces, and execution archives. These currently include Google Cloud and exe.dev. Information may also be sent to a connected service when needed to perform an action you request or an automation you configure. Connecting a service does not make its data public.

We may disclose information when required by law or necessary to address fraud, abuse, or security threats. We limit human access to Google user data to cases permitted by Google's Limited Use requirements, such as your affirmative agreement, security investigations, or legal obligations.

Storage, security, and retention

Hosted Halo stores account and connection information in its service databases and workspace content in your workspace. Integration credentials stored by Halo's credential service are encrypted at rest. We use HTTPS for hosted service connections.

Halo records full agent execution archives, including conversation context, tool arguments and results, model requests, and responses. These records may contain information from connected Google services. Archives are stored in the workspace and, for configured hosted workspaces, uploaded to private cloud storage. Conversation and execution archives currently have no automatic expiry. Revoking a connection does not delete content already saved in conversations, files, or archives.

We retain stored information until it is deleted or no longer needed to provide the service, protect its security, or meet legal obligations. You can request deletion of your account and associated hosted data by emailing us. Backup copies and storage recovery copies may remain until their recovery periods expire; data subject to a legal retention obligation may be retained as required.

Your choices

You can choose not to connect an integration, disconnect it in Halo, or revoke Halo's access in your Google Account connections. Revoking access stops future Google API access through that authorization; it does not undo actions already performed. To request access to, correction of, or deletion of information we hold, contact team@libretto.sh.

Halo uses session cookies and local storage to support sign-in and application preferences. If you self-host Halo or use third-party extensions, the operator of that installation or extension controls its own configuration and data handling. This policy describes the services we operate.

Changes and contact

We will update this page when our practices change and revise the date above. For questions about this policy or your information, contact Cashew Labs at team@libretto.sh.