Privacy Policy

Last updated 2026-09-19

What we collect, why we are allowed to, who else sees it, and how to take it back. This policy covers this website (unhalt.app) and the application (app.unhalt.app).

1.Who is responsible

[NOM] ([FORME JURIDIQUE]), SIREN [SIREN], [ADRESSE], is the data controller for the personal data described here. For any question or request about your data, write to [EMAIL].

2.What we collect

On this website, no account and no cookies. Each visit to the home page adds one to an anonymous daily count kept by the application: the request carries the page’s name and nothing else — no cookie, nothing that identifies you or your device (like any request, it passes through the application host’s technical logs, section 6). The links from here into the application carry a tag saying you came from this website, which is recorded on your account if you create one. The email address you type into the sign-up field is passed to the application’s sign-up page as part of the link, and is only stored if you go on to create an account there.

Before launch, this site ran a waiting list. If you joined it, your email address was collected with double opt-in and held by Brevo (section 5). It is used only to tell you Unhalt is open, and every such email carries an unsubscribe link.

In the application, once you have an account:

Usage is recorded by our own server, through the sign-in session the application already uses. Nothing extra is stored in your browser for it, and it is not shared with any analytics company. The application’s sign-in page is counted the same anonymous way as this website’s home page.

Anonymous feedback is stored without your account attached. To enforce the five-minute limit between messages, we briefly record that your account sent one; that record is deleted after five minutes and is never linked to the message.

We do not collect a name, a postal address, a phone number, or anything about you beyond the above. We do not buy data about you from anyone.

3.Why, and on what legal basis

• To provide the service you signed up for — your account, your projects, the AI planning features, your subscription. Legal basis: performance of our contract with you (GDPR art. 6(1)(b)).
• To keep the service secure and working — technical logs, abuse prevention. Legal basis: our legitimate interest in a service that stays up and is not abused (art. 6(1)(f)).
• To improve Unhalt — reading the feedback you send us. Legal basis: our legitimate interest in improving the service (art. 6(1)(f)). Sending feedback is optional.
• To understand how Unhalt is used — how many people visit and try it, where they come from, how many subscribe, and how often and how long the application is used. We look at totals and medians. The one place we look at individuals is a short list of paying customers who have not opened the application for two weeks (email, last visit, subscription date), so we can check in with them personally. Legal basis: our legitimate interest in running and improving the service and looking after our customers (art. 6(1)(f)). You can object at any time — see section 7.
• To meet our accounting obligations — invoices and payment records. Legal basis: legal obligation (art. 6(1)(c)).
• To send you service emails — your account confirmation, password-reset links you ask for, and notice of changes to the terms or our prices. These are not marketing and cannot be unsubscribed from separately: without the confirmation email there is no account to begin with.
• To send you the two emails the law requires about your subscription — the written confirmation of what you subscribed to, sent once you subscribe, and, on the yearly plan, the reminder sent between three months and one month before each renewal telling you the date, the amount and that you may choose not to renew. Legal basis: legal obligation (art. 6(1)(c); articles L221-13 and L215-1 of the French Consumer Code). Like the other service emails, these cannot be unsubscribed from while you have a subscription.
• To tell waiting-list members that Unhalt is open — on the basis of the consent you gave when you joined (art. 6(1)(a)), which you can withdraw with the unsubscribe link at any time.

We do not use your data for advertising, we do not sell it, and we do not carry out automated decision-making that produces legal effects for you.

4.AI processing — read this one

Unhalt’s core features are built on a third-party AI model. That means the text you write is sent to Anthropic PBC, in the United States, and processed there: your idea conversation, the project summary written from it, your project and task titles, the plan changes you describe, and your style profile.

It is processed to produce your result and is not used to train Anthropic’s models. The transfer outside the European Union is covered by the European Commission’s standard contractual clauses.

The practical consequence is worth stating plainly: do not put anything in Unhalt that you would not send to a third-party service — no passwords, no identity documents, no confidential information belonging to someone else.

5.Who else processes your data

These providers process personal data on our behalf, under contract, and only on our instructions:

Beyond these providers, we disclose data only where the law requires it.

Google sits slightly apart from that list. If you choose to sign in with Google, Google is not processing data on our behalf — it is acting on its own account as your identity provider, under its own privacy policy. In practice, Google learns you use Unhalt, and we receive your email address, name and profile picture link from Google (see the Account row above). If you would rather avoid that, sign in with an email and a password instead.

6.How long we keep it

• Everything in your account: for as long as the account exists. Delete the account and it goes with it — projects, versions, tasks, history and style profile all cascade. Two copies outlast it for a limited time: our database provider’s backups, which expire on its backup cycle, and the text already sent to our AI provider, which it keeps only for its own limited retention period. Invoices are kept as described below.
• Usage records: the record of each visit is deleted 13 months after the visit; your last visit, signup source and task completion dates are kept for as long as the account exists. All of them are deleted with the account. The daily page totals contain nothing about you and are kept as statistics.
• Feedback: anything you sent under your name is deleted with your account. Anonymous feedback is not attached to your account; it is deleted 24 months after it was sent.
• Invoices and payment records: 10 years, because French commercial law requires it. These survive account deletion; they contain your email, the amounts, and the dates — nothing you wrote in the app.
• Waiting-list addresses: until you unsubscribe, or until the list is closed after launch, whichever comes first.
• Technical logs and sign-in records: kept by our hosts and our authentication provider for their own limited retention periods, and used only for security and troubleshooting.

7.Your rights, and the two that are one click away

Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Two of these are built into the product rather than made into a request you have to write:

• Access and portability — the account page in the app downloads everything we hold about you as one JSON file, immediately.
• Erasure — the same page deletes your account and everything in it, and cancels any subscription as it goes. Section 6 says what outlasts it for a limited time.

Feedback is the one exception to that download: once sent, it cannot be read back from any account, yours included. To get a copy of feedback you sent under your name, write to [EMAIL].

Objecting to usage measurement — write to [EMAIL]. We will stop recording your visits and delete the ones already recorded; your account keeps working exactly as before.

For anything else — correction, restriction, objection — write to [EMAIL] and we will answer within one month. If you are not satisfied with our answer you can complain to the French data protection authority, the CNIL (cnil.fr), or to the supervisory authority where you live.

8.Cookies

Unhalt sets no tracking cookies and uses no third-party analytics, on this website or in the application. There is no advertising pixel, no tag manager and no third-party script following you around; the one third-party script is Stripe’s, on the application’s payment page, described below. This is why you have not been asked to accept anything.

What is stored in your browser is:

• in the application, authentication cookies set by Supabase, which keep you signed in — strictly necessary for the service to work, and exempt from consent for that reason;
• on the application’s subscription page, once you choose a plan, Stripe’s payment script sets two cookies (__stripe_mid, kept for one year, and __stripe_sid, 30 minutes) used only to detect payment fraud — necessary to process the payment you asked for, and exempt from consent for that reason;
• two local preferences — the theme you chose in the application, and the language you chose on these legal pages — which never leave your browser.

We do measure how Unhalt is used ourselves, as described in sections 2 and 3 — in the application through the sign-in session you already have, and on this website and the sign-in page as anonymous page counts. Neither stores anything in your browser. If we ever add measurement that does, or that involves a third party, we will ask for your consent first and update this page before doing so.

9.Security

Data is encrypted in transit. Access to your rows is enforced in the database itself through row-level security, so one account cannot read another’s data even if the application were to ask it to. Payment card data never reaches our systems at all — Stripe handles it end to end. Administrative keys are held server-side only and are never sent to the browser.

No system is perfectly secure. If a breach affects your personal data and is likely to put your rights at risk, we will notify you and the CNIL as the GDPR requires.

10.Children

Unhalt is not intended for people under 16. We do not knowingly collect their data; if you believe a child has created an account, write to [EMAIL] and we will delete it.

11.Changes

If we change this policy we will update the date at the top of the page, and for any change that materially affects you we will tell you by email before it takes effect.