Privacy policy
Version 0.2, 25 September 2026
This policy explains how Halo Club Limited ("Halo Club", "we", "us") collects and uses personal data when you apply to join Halo Club, use the Halo Club app or website, list a home, book a stay or contact us. It also covers the waitlist at haloclub.app. "Member", "host", "guest", "home" and "booking" have the meanings given in the terms of use.
Halo Club is the controller of your personal data. We are registered in England and Wales under company number 17463669 and our registered office is at 71-75 Shelton Street, London, England, WC2H 9JQ. We are registered with the Information Commissioner's Office under number [ICO number]. You can reach us about privacy at hello@haloclub.app.
If you are in the European Union or the European Economic Area, our representative under article 27 of the EU General Data Protection Regulation is [name, address and email]. You may contact them instead of us.
1. The data we collect
When you join the waitlist: your name, your email address and the date you joined.
When you apply for membership: your name, date of birth, contact details, city, occupation and company, how you heard about us, the answers you give in the application (including whether you own a property and where), the photograph you upload and the details of any member who introduced you.
When we verify you: at present we check the details you give us against the identity you present. We plan to use a third-party identity service that asks for a photograph of an identity document (such as a driving licence) and a selfie. That involves facial matching, which is biometric data; we will ask for your explicit consent before it is used and offer another way to verify you if you prefer not to give it. Where you list a home we may also ask for evidence that you own it or are entitled to let it. Where the law of the place where your home is located requires it, we collect your short-term let registration, licence or permit number.
When you list a home: the address, description, photographs, house rules, calendar, pricing, cancellation policy and, for tax reporting, your tax identification number, VAT number if any and the property's land registration number where available.
When you book or host a stay: the dates, the people staying, the price and fees, the messages exchanged, reviews, any reports of problems or damage and the outcome.
When you pay or get paid, once payments are live: your payment method details are collected directly by our payment provider, [Stripe Payments UK Ltd]. We receive confirmation of payment, the last four digits and card type, payout account details for hosts and the information the payment provider needs to verify hosts under its own legal obligations.
When you use the app: device type, app version, operating system and IP address; your push notification token if you allow notifications; and the things you do in the app, such as a search, a listing viewed or a request sent, which we record with the time they happened. We ask for your device's location only when you choose to use a feature that needs it, such as finding your home's address when you list it or finding homes near you, and only while you use it. We do not use advertising trackers.
When you contact us: the content of your message and our reply.
Membership is for people aged 25 or over, and we do not knowingly collect data about anyone under 18.
2. Why we use your data and the legal basis
To run the waitlist and tell you when applications open, we use your waitlist data. The legal basis is your consent, which you can withdraw at any time.
To assess your application and decide on membership, we use your application, verification and introducer data. The legal basis is the steps you ask us to take before entering a contract, and our legitimate interest in a trusted club.
To verify identity and property rights, we use verification data. The legal basis is our legitimate interest in preventing fraud and keeping members safe, and compliance with legal obligations where they apply. For facial matching, when it is introduced, the legal basis will be your explicit consent, which you can withdraw; if you withdraw it we will offer another way to verify you.
To operate your membership, listings, bookings, messaging, reviews and support, we use your account, listing, booking and message data. The legal basis is performing our contract with you.
To collect payments and make payouts through our payment provider, we use payment and payout data. The legal basis is performing our contract with you, and the legal obligations of our payment provider.
To handle cancellations, refunds, damage claims and reports, we use booking, message and payment data. The legal basis is performing our contract with you, and our legitimate interest in resolving disputes fairly.
To read reviews before they are published and to suggest listing copy from what a host has written, we use the text you submit. The legal basis is our legitimate interest in keeping reviews honest and fair and in helping hosts describe their homes. Section 4 says which provider helps with this.
To report hosts' income to tax authorities and comply with short-term rental rules, we use host identity, tax and property data and booking data. The legal basis is legal obligation.
For safety, fraud prevention and enforcing our terms, we use all categories as relevant. The legal basis is our legitimate interest in protecting members and the platform, and legal obligation where it applies.
To send you service messages, such as a request, an acceptance or a code to sign in, we use contact data. The legal basis is performing our contract with you.
To send you news and offers from Halo Club, we use contact data. The legal basis is your consent, or our legitimate interest where you are a member and have not opted out; you can opt out at any time.
To improve the platform and fix problems, we use usage and device data. The legal basis is our legitimate interest in running a reliable service.
Where we rely on our legitimate interests we have considered your interests and rights and concluded that they do not override ours in these cases. You can ask us for details of that assessment.
3. Vetting and automated decisions
Membership decisions are made by a person. When a third-party identity service is introduced, its automated checks will confirm that an identity document is genuine and matches you (with your explicit consent where facial matching is used), and we may use automated screening for fraud signals, but no decision to decline an application or close an account is based solely on automated processing. If you are declined you may ask us to explain the decision and to reconsider.
Reviews are read before publication with the help of an AI service, named in section 4. Its reading informs the club; a person makes the decision to refuse a review, and you are told the reason and may edit and resend it.
Our admission criteria do not include any characteristic protected by law, and we review our decisions to check that this remains true.
4. Who we share your data with
Other members see your member card: your first name, your photo, your city, your rating and how long you have been a member. They never see your contact details. When you host, a guest sees your listing and your messages; on the map the home's location is approximate, and your exact address and arrival instructions are shared with a guest only once their stay is confirmed. When you book, the host sees your member card, the names of the people staying and your messages. Reviews that have been published are visible to members.
Service providers act on our instructions, and each is bound by contract to use your data only to provide its service to us. They are: Supabase, which hosts our database, sign-in, file storage and the server functions the app runs, with our data held in its European Union region; Resend, which sends our emails, such as a welcome code or a booking confirmation; Expo, which delivers push notifications to your device; Mapbox, which draws the maps and finds addresses, and receives the address you type and your device's IP address for that purpose; and Anthropic, whose AI reads reviews before they are published and suggests listing copy from what a host has written, and which does not use the text sent to it to train its models.
Planned providers will be added here before they are used: Twilio, to send codes by text message; [Stripe Payments UK Ltd], our payment provider, which will act as an independent controller for the purposes of its own regulatory obligations, including host verification and fraud prevention, under its own privacy notice; and a third-party identity service for licence and selfie checks.
Tax and public authorities receive data where the law requires, including HM Revenue and Customs under the UK reporting rules for digital platforms, tax authorities in EU member states under the DAC7 rules, the national short-term rental data entry points required by EU Regulation 2024/1028 and city registration authorities in the United States where local law requires a platform to verify or report listings. We tell hosts what we report about them.
Professional advisers, insurers and, if the business is sold or reorganised, the buyer receive data under confidentiality obligations.
Law enforcement and others receive data where we are required to by law, or where it is necessary to protect the safety of a member or the public, to enforce our terms or to defend legal claims.
We do not sell your personal data and we do not share it with advertisers.
5. International transfers
We are based in the United Kingdom and our database is held in the European Union. Members, homes and some of our providers are in the European Economic Area and the United States.
Transfers between the United Kingdom and the European Economic Area are covered by the adequacy decisions in force in both directions. Transfers to providers in the United States (Resend, Expo, Mapbox and Anthropic, and planned providers once they are used) are made to organisations certified under the EU-US Data Privacy Framework and its UK Extension, or under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses for data about people in the United Kingdom and the EU Standard Contractual Clauses for data about people in the European Economic Area, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep your data
Waitlist data: until we have written to you about applications opening or you ask us to remove you, and in any case no longer than two years.
Declined applications: [12 months] after the decision, so that we can answer questions about it, then deleted.
Identity documents and verification results: the document image is deleted [30 days] after verification; the result and the reference number are kept for the life of your membership and [6 years] afterwards where needed for legal claims or regulatory duties.
Membership, listing, booking, payment and messaging records: for the life of your membership and 6 years afterwards, which is the period in which legal claims can be brought and tax records must be kept in the United Kingdom. Information about business hosts collected under the Digital Services Act is deleted six months after the hosting relationship ends unless another legal duty requires it to be kept.
Tax reporting records: [5 years] from the end of the reporting period, as required by the platform reporting rules.
Usage and device data: [24 months], after which it is deleted or anonymised.
7. Your rights
Under the UK GDPR you have the right: to ask us for a copy of your personal data; to have inaccurate data corrected; to have data deleted where we no longer need it; to restrict or object to certain uses; to receive data you gave us in a portable format; not to be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you; and to withdraw consent where we rely on it. You can exercise these rights by emailing hello@haloclub.app, and you can delete your account from the app's settings. We will respond within one month, and we may ask you to confirm your identity first.
You have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk). If you are in the European Union or the European Economic Area you may complain to the authority in the country where you live. We would welcome the chance to address your concern first.
8. Security
We protect your data with encryption in transit and at rest, access controls limited to staff who need access, logging and contractual obligations on our providers. Each member's own record is protected in the database by rules that let only that member read it; what another member sees comes from a separate view that carries only the member card. No system is perfectly secure; if a breach affects your data and is likely to put your rights at risk, we will tell you and the regulator as the law requires.
9. Cookies and similar technologies
The app sets no cookies. It stores on your device only what it needs to keep you signed in, to remember your settings and to deliver notifications you have allowed. The website at haloclub.app sets no cookies, runs no analytics and carries no advertising or tracking. The cookies page says more. If this changes we will update this policy and, where the law requires, ask for your consent.
10. The website and the waitlist
This section covers haloclub.app, the page where you can join the waitlist. It is short because we collect very little.
If you join the waitlist, we keep the name and email address you give us, and the date you gave them. That is all. The site sets no cookies, runs no analytics and carries no advertising or tracking of any kind.
We use them for one purpose: to write to you when applications to Halo Club open. We rely on your consent, which you give by submitting the form and can withdraw at any time.
Only the Halo Club team sees the waitlist. We do not sell, rent or share it. Your details are held under contract by the companies that host our website and database on our behalf, and are not used by them for anything else.
We keep them until we have written to you about applications opening, or until you ask us to remove you, whichever comes first, and in any case for no longer than two years.
You can ask us what we hold about you, to correct it or to delete it, and you can withdraw your consent whenever you like. Write to hello@haloclub.app from the address you signed up with and we will do it promptly.
11. Members in California
If you are a California resident, the California Consumer Privacy Act may give you rights to know, delete and correct personal information and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising. The categories of personal information we collect and the purposes are described in sections 1 and 2. To exercise your rights, email hello@haloclub.app. We will not discriminate against you for exercising them.
12. Changes to this policy
We may update this policy. We will tell you about material changes by email or in the app before they take effect. The date of the current version is shown at the top.
13. Contact
Write to Halo Club Limited at 71-75 Shelton Street, London, England, WC2H 9JQ or email hello@haloclub.app. Our EU representative is [name, address and email]. We have not appointed a data protection officer.