Privacy Policy

This Privacy Policy explains what information Halqen collects, how it is used, how it is protected, and what choices you have. It applies to the Halqen website and application (the "Service"), operated by Bill Walker, doing business as Halqen.

1. Information We Collect

1.1 Account information

When you sign in, we collect your email address. We use passwordless, email-based sign-in links, so we do not store a password for your account.

1.2 Identity and profile information

You choose what to include in each identity you create, which may include:

• Your name, business name, title, phone number, and email address;
• A profile photo, if you choose to upload one;
• A brand color and, where applicable, a recognized company brand mark.

1.3 Credential information

If you choose to use the credentials feature, you may provide license numbers, insurance policy information, issuing state, expiration dates, and an optional label to distinguish multiple credentials. This information is provided voluntarily by you and is not required to use the base Service.

1.4 Access and security information

When someone scans a card or enters a code (including a card issued to an employee of a company account), we log that the attempt occurred, whether it succeeded, and a cryptographically hashed version of the requester's IP address, never the raw IP address itself. This hashing is designed so the original IP address cannot be recovered from what is stored, even if the underlying data were ever exposed. We also log failed code attempts, without identifying information beyond the same hashed IP, in order to detect and block repeated guessing.

1.5 Client portal information

If you create a Client account, we collect the company name you provide. If a vendor grants you standing access to their identity, our system records that grant so you can view that identity's credential status; this record includes which identity granted access and when.

1.6 Verification documents

If you ask Halqen staff to confirm a credential, you may upload a document, such as a license or an insurance certificate, for review. The document is stored in a private area that is not reachable from the public Service. Only authorized Halqen staff can open it, each time through a link that expires after 60 seconds, and each opening is recorded. After the review is decided, the document is kept for 24 hours so you can check that your credential shows correctly on your profile, and then it is deleted automatically. You can delete it sooner with the Delete now button. If the review has not started within 7 days, or you cancel the request, the document is deleted by a nightly cleanup. If you dispute a decision, Halqen may keep the document past 24 hours until the dispute is resolved, and then deletes it. You can still delete it yourself at any time.

1.7 Nearby providers (Firefly)

If you use Firefly, we process the approximate location you share, the note and optional photo you attach to a request, your saved locations and availability schedule, and the connections and blocks you create. Request locations, notes and photos are cleared when the request expires. Availability entries are removed when they expire, and request and connection records are removed after 90 days.

2. How We Use Information

• To operate the core function of the Service: verifying a scanned code and displaying the associated identity;
• To allow you to manage your own identities, credentials, and access grants;
• To detect and prevent abuse, including repeated failed code attempts;
• To communicate with you about your account, including sign-in links and reminders before a credential you entered is due to expire;
• To improve the Service based on aggregate, non-identifying patterns of use.

We do not use your information to serve you advertising, and we do not sell your information to third parties, ever.

3. How Information Is Shared

Information is shared only in these specific circumstances:

• With someone who scans your card and enters a valid code: they see only the identity associated with that code, not your other identities;
• With a Client you have explicitly granted standing access to, limited to the identity and credential status you have chosen to make visible to them, until you revoke that access;
• With service providers that run parts of the Service on our behalf, under their own security and confidentiality obligations. They are: Supabase (database, sign-in and file storage), Vercel (application hosting), Resend (sending sign-in and reminder emails), Zoho (Halqen's own business email, including messages you send us), Namecheap (domain name registration and DNS), and Stripe (payment processing, once paid plans begin). We will update this list if it changes;
• Where required by law, such as in response to a valid legal request.

We do not otherwise share, rent, or sell your personal information to third parties.

4. How Information Is Protected

The Service is built with the following security measures:

• Row-level security at the database level, so an account can only read or modify its own data unless it has been explicitly granted access to someone else's;
• Server-side code verification: access codes are never sent to or checked by a visitor's browser directly; all checking happens on a secured server;
• Rate limiting that blocks repeated failed code-guessing attempts from the same source;
• Globally unique access codes, enforced by the database, so two different accounts can never be assigned the same code;
• IP address hashing, as described in Section 1.4, rather than storage of raw IP addresses;
• Private storage and an audit trail for verification documents, as described in Section 1.6;
• Two-step sign-in on the accounts our team uses to run the Service;
• Encrypted connections (HTTPS) for all traffic to and from the Service.

No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you in a manner consistent with applicable law.

5. Data Retention

We retain your account and identity information for as long as your account remains active. You can delete your account yourself at any time from your dashboard ("Delete my account"). Doing so permanently deletes your identities, credentials, codes, cards, access grants, uploaded profile photos, and sign-in. We keep only a minimal record that a deletion happened (an internal account number and the dates), with no name, email, or other personal details, along with limited security records, such as hashed request data used for rate limiting, that we are required or permitted to retain for security or fraud-prevention purposes. These security records are deleted automatically on a schedule: failed-code records after 2 days, error reports after 90 days, and scan history after 1 year.

6. Your Rights and Choices

You can, at any time:

• Edit or delete any identity, credential, or photo directly from your dashboard;
• Revoke a Client's standing access to any identity;
• Request a copy of the personal information associated with your account;
• Delete your account and associated data yourself from your dashboard, or ask us to do it by contacting us at the address below.

7. Children's Privacy

The Service is intended for use by individuals and businesses in a professional capacity and is not directed to, or intended for use by, anyone under the age of 18. We do not knowingly collect information from anyone under 18. If we learn that we have done so, we will delete that information.

8. Cookies and Tracking

The Service uses only the minimal session mechanism required to keep you signed in (managed through our authentication provider, Supabase). We do not use third-party advertising trackers, and we do not track you across other websites.

9. International Users

The Service is currently operated for users in the United States, and data is stored and processed in the United States. If Halqen expands to serve users in other countries, this Policy will be updated to reflect any additional data-protection obligations that apply, such as those under the EU's GDPR.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or a notice within the Service, before the changes take effect.

11. Contact

Questions about this Privacy Policy, or requests to access or delete your data, can be sent to support@halqen.com. We aim to reply within 2 business days.

To report a security problem or suspected breach, write to security@halqen.com. We aim to acknowledge security reports within 1 business day.