Privacy

What we hold, and for how long.

Effective 17 September 2026 · Last updated 17 September 2026

1 · Who is responsible

Halo Works, an independent creative studio operated from Ankara, Türkiye, decides what happens to the data described here. Write to hello@haloworks.app and a person — not a ticket system — will answer.

2 · What we collect

Only what you hand us on the form:

• Your product photo — the file you attach.
• Brand name and your name.
• Your email address, so we can send the creatives back.
• Website or Instagram handle, if you choose to give one.
• Anything you write in the notes field.
• Your email, if you join the waitlist — on its own, without anything else attached to it.

We do not ask for a payment card, an address, a phone number, or a date of birth, and we would rather you did not type them into the notes field.

3 · What we measure, and what we refuse to

This site sets no cookies. It does use Vercel Web Analytics, which is cookieless: it does not store anything on your device and does not follow you to other sites. To count repeat visits within a single day it derives a temporary fingerprint from your IP address and browser, then throws it away. We never see your IP address ourselves.

What it tells us: which pages were opened, which site sent you here, rough country, and device type. On top of that we record a handful of events of our own — which section you scrolled to, which button you clicked, how long you stayed, how far down you got, and whether you started the form. That is how we find out where the page loses people.

What we refuse: no session recording, no screen or mouse replay, no heatmap tool, no Meta pixel, no Google Analytics, no advertising tag, and no cross-site tracking. None of what we measure can be traced back to a person.

Our typefaces are served from our own domain, not from Google Fonts. Your browser never contacts a third party to render this page: no font CDN, no script host, no image host. Every file it downloads comes from haloworks.app.

4 · Why we hold it, and on what basis

• To make and send your creatives. You asked us to; that is the performance of what you requested, with your consent.
• To reply to you and to keep a record of what we sent.
• To write to you about Halo Works, if you joined the waitlist or ticked the box on the form: once when the toolkit opens, plus the occasional short note on what we shipped. That is the whole scope — we do not sell your address, rent it, or hand it to anyone else. Every email carries a way out and one word back to us is enough. You never need a reason.

We do not use your data for advertising, profiling, scoring, or any automated decision-making.

5 · Who else sees it

• FormSubmit — the service that turns the form into an email. It processes the submission on its way to our inbox.
• Google (Gmail) — our mailbox provider, where the submission lands and stays.
• The AI providers we use to make the creatives — at the moment Google. Your photo is passed to them to produce your ads, and their own terms govern that processing.
• Vercel — the company that serves this website and runs the cookieless analytics described above.

We do not sell, rent, or trade your data, and we do not hand it to advertisers. These providers are outside Türkiye, mainly in the United States, so sending your data to them is an international transfer. If that is a problem for you, say so before you send a photo and we will find another way.

6 · What we do not do with your photo

We do not sell it. We do not put it in a stock library. We do not use it to train our own models — we do not have any. We do not show it to anyone outside the work we are doing for you, and we do not put your brand in our portfolio without asking first, in writing.

7 · How long we keep it

• Your photo: until the work is delivered and any revisions are done, then up to 12 months in case you come back and ask for more.
• Your email and the message: up to 24 months, so we know who we talked to and what we promised.
• On request: gone within 30 days, sooner in practice.

8 · Your rights

Wherever you are, you can ask us to show you what we hold, correct it, delete it, or send it to you in a portable file. You can withdraw consent at any time. One email is enough — you do not need a form or a reason.

• Türkiye (KVKK): the rights in article 11 apply, and you may complain to the Turkish Data Protection Authority.
• EU and UK (GDPR): access, rectification, erasure, restriction, portability, objection, and the right to complain to your local authority.
• California (CCPA/CPRA): you may ask what we collected and ask us to delete it. We do not sell or share personal information, so there is nothing to opt out of.

9 · Consent, and taking it back

We only email you if you asked us to — by typing your address into the waitlist box or by ticking the box on the form yourself. Nothing is pre-ticked, and nothing is bundled into something else you were doing.

Taking it back is the same weight as giving it: reply stop to any email, or write to us. We remove the address, and there is no confirmation loop to click through.

10 · Security, honestly stated

Submissions travel over HTTPS and land in a mailbox protected by two-factor authentication. We are a small studio, not a bank: we keep the surface small — no database, no dashboard, no third-party plugins beyond the two named above — because the safest data is the data we never stored.

11 · Children

This site is for people running a business. It is not aimed at anyone under 18 and we do not knowingly collect anything from them.

12 · Changes

If this page changes, the date at the top changes too. If a change matters to someone who already sent us a photo, we email them instead of editing quietly.

Anything on this page that is unclear, ask: hello@haloworks.app.