Privacy policy

Last updated: 21 October 2026.

This policy explains how The Halo Protocol (thehaloprotocol.com) collects and uses your personal data when you visit our store, buy a guide, sign up for emails or contact us, and the rights you have.

1. Who is responsible. The Halo Protocol is the controller of your personal data. Contact for all privacy questions and requests: ironorgsupport@proton.me.

2. What we collect. When you buy: your name, email address, billing country and address, order details, and payment confirmation (we never see your full card details; payments are handled by our payment providers). When you sign up for emails: your email address and your consent. When you contact us: your messages and the details you include. When you use the site: technical data such as your IP address, device and browser type, pages viewed and items added to your cart, collected with cookies and similar technologies, as explained in section 6.

3. Why we use it, and our legal basis. To process your order, deliver your guide, send order emails and handle refunds and support, because this is needed to perform our contract with you. To keep tax and accounting records, because the law requires it. To prevent fraud and keep the store secure, based on our legitimate interest in protecting our business and customers. To send you marketing emails and to measure and show you ads, only with your consent, which you can withdraw at any time. Giving your details at checkout is necessary to buy a guide; without them we cannot complete or deliver your order. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share it with. We share personal data only with service providers that help us run the store, under contracts that protect your data: Shopify, which hosts our store, checkout and order emails and delivers the guide files; our payment providers, including Shopify Payments and PayPal; our email provider, used to answer your messages; and, only if you accept marketing cookies, Meta (Facebook and Instagram) for measuring and showing ads. We also disclose data where the law requires it. We do not sell your personal data.

5. International transfers. Some of these providers process data outside the European Economic Area, for example in Canada or the United States. When this happens, the transfer is protected by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.

6. Cookies. We use cookies that are needed for the store and checkout to work. Analytics and marketing cookies, including the Meta pixel, are only used if you accept them in the cookie banner. You can change your choice at any time through the Cookie preferences link at the bottom of every page, or by blocking cookies in your browser settings.

7. How long we keep it. Order and payment records are kept for as long as tax and accounting laws require. Marketing data is kept until you unsubscribe or withdraw consent. Support emails are kept for up to two years after your request is closed. Other data is deleted or anonymised when it is no longer needed for the purposes above.

8. Your rights. You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable format, and to withdraw your consent at any time without affecting earlier use. To use any of these rights, email ironorgsupport@proton.me. We reply within one month. You also have the right to complain to a data protection authority, in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt), or the authority in the EU country where you live. If you live in the United States, you can also opt out of the use of your data for targeted advertising on our data sharing opt-out page, and we honour Global Privacy Control signals.

9. Children. Our store is not intended for anyone under 18, and we do not knowingly collect data about children.

10. Security. We use reputable providers and reasonable measures to protect your data. No method of transmission or storage is completely secure, so please do not send sensitive information by email.

11. Changes. We may update this policy. The latest version, with its date, is always on this page.