Privacy Policy

1. Information We Collect

We collect information that you provide directly, information collected automatically, and information from third-party services.

Information You Provide

• Account information: name, email address, and authentication credentials (managed by Clerk)
• Estate planning data: family member information, asset details, beneficiary designations, and other information you enter to generate wills, powers of attorney, or inheritance calculations
• Financial data: stock holdings, portfolio compositions, and investment amounts you enter for screening and zakat calculations
• Communication data: messages you send to our support team

Information Collected Automatically

• Usage data: pages visited, features used, timestamps, and interaction patterns
• Device data: browser type, operating system, screen resolution, and language preference
• Network data: IP address and approximate geographic location

Information from Third-Party Services

• Authentication data from Clerk (your identity provider)
• Financial market data from public sources (not linked to your account)

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the platform: generate documents, perform calculations, screen stocks, and deliver results
• Authenticate your identity and manage your account
• Improve and develop the platform: analyze usage patterns to enhance features and fix issues
• Communicate with you: respond to support requests and send important service updates
• Ensure security: detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations: respond to lawful requests from authorities

We do NOT sell your personal information to third parties. We do NOT use your estate planning data, financial data, or religious preferences for advertising purposes.

3. Data Storage and Security

We implement industry-standard security measures to protect your personal information:

• Authentication is managed by Clerk, which provides enterprise-grade identity security
• Application data is stored in Supabase with row-level security policies
• All data is encrypted in transit using TLS/SSL
• Access to production systems is restricted and monitored
• We conduct regular security reviews of our infrastructure

While we strive to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but will promptly notify affected users in the event of a data breach in accordance with applicable law.

4. Third-Party Services

Halalytic integrates with the following third-party services to provide our platform:

• Clerk: Authentication and user management. Clerk processes your login credentials and identity information under its own privacy policy.
• Vercel: Frontend hosting and content delivery. Vercel may collect standard web server logs.
• Railway: Backend API hosting. Railway processes API requests on our behalf.
• Market Data Providers: We query publicly available financial data; no personal information is shared with data providers.
• PostHog: Privacy-friendly analytics. We use PostHog to understand usage patterns. PostHog can be configured to anonymize data.
• Stripe: Payment processing (for paid plans). Stripe processes your payment information under its own privacy policy. We do not store your credit card details.

5. Cookies and Tracking

We use a limited number of cookies and similar technologies:

• Essential cookies: Required for authentication and core platform functionality. These cannot be disabled.
• Analytics cookies: Used by PostHog to collect anonymous usage data. You can opt out of analytics cookies through your browser settings or our cookie consent mechanism.
• Preference cookies: Store your language selection and display preferences.

We do not use third-party advertising cookies. We do not participate in cross-site tracking networks.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account data is retained while your account remains active
• Generated documents and calculation results are retained in your account until you delete them
• Usage analytics data is retained in aggregated, anonymized form
• If you delete your account, we will delete your personal data within 30 days, except where retention is required by law

You may request deletion of your account and associated data at any time by contacting us.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of access: Request a copy of the personal data we hold about you
• Right of correction: Request that we correct inaccurate or incomplete data
• Right of deletion: Request that we delete your personal data
• Right of data portability: Request your data in a structured, machine-readable format
• Right to withdraw consent: Withdraw your consent to data processing at any time
• Right to object: Object to processing based on legitimate interests

To exercise any of these rights, please contact us at privacy@halalytic.com. We will respond to your request within 30 days.

8. Children's Privacy

Halalytic is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@halalytic.com.

9. International Data Transfers

Halalytic is operated from Canada. If you access the platform from outside Canada, your information may be transferred to, stored, and processed in Canada and the United States, where our hosting providers operate. By using the platform, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence. We ensure that any data transfers comply with applicable data protection legislation and that your information receives an adequate level of protection.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on the platform, updating the "Last Updated" date, and, where appropriate, sending an email notification. Your continued use of the platform after changes are posted constitutes your acceptance of the revised policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For data protection inquiries specific to European, UK, or Australian residents, please indicate your jurisdiction in your correspondence so we can direct your request appropriately.