Privacy policy
Last updated: 22 September 2026
1. Who is responsible for your data
Halofloor is a project under development, published on a non-professional basis. The data controller is the publisher of the service, reachable at contact@halofloor.com. Under French law on confidence in the digital economy, a non-professional publisher may withhold their personal contact details from public display provided they have supplied them to their hosting provider, who keeps them available to the judicial authority. They will be published here when the service goes on sale.
The service does not meet the thresholds that would require appointing a data protection officer. Should that change, their identity will appear on this page.
2. What we process, and why
Halofloor is built to work on as little data as possible. In particular, the audio you listen to is never recorded or transmitted: only text metadata and aggregate measurements leave your device.
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Title, artist and duration of the track playing | Find the album artwork and the matching musical analysis | Performance of the contract | Cached as a fingerprint, with no link to you |
| Computed musical features (tempo, intensity, danceability) | Choose and drive the visual | Performance of the contract | Technical cache shared across all users |
| Email address and account identifiers | Create the account, manage the subscription, provide support | Performance of the contract | Life of the account, then 3 years |
| Billing data | Issue invoices and meet our accounting obligations | Legal obligation | 10 years |
| Server logs: IP address, timestamp, browser | Security, abuse prevention, fault diagnosis | Legitimate interest | 12 months at most |
What we do not do
- No recording, storage or transmission of your audio.
- No sale or rental of data to third parties.
- No targeted advertising, no advertising profiling.
- No automated decision producing legal effects concerning you.
- Your music platform credentials do not pass through our servers: you sign in with the provider, and we never receive your password.
3. Recipients and processors
We rely on a small number of providers, each for a specific purpose:
- Hosting and computing — providers located in the European Union. Their identity is available on request at the contact address.
- Payment — a licensed payment provider, which handles card data itself; we neither see nor store it. No payment is taken while the service is not on sale.
- Music catalogues — the platforms you choose to connect, queried to find artwork and information about the track.
- Audience measurement — Umami Cloud, which counts visits without cookies or any identifier that would let us recognise you across sites.
Some of these providers may process data outside the European Union. Such transfers then rely on the European Commission's standard contractual clauses or on an adequacy decision.
4. Cookies and audience measurement
The site uses no analytics or advertising cookies, and therefore displays no consent banner.
Traffic is measured with Umami, a tool that works without cookies and without any persistent identifier. It records the page viewed, the page you came from, the device type and the country, along with a few aggregate actions: a click on a plan, a preview played. This data cannot identify you, is not combined with other sites, and is neither sold nor shared.
The following are also used:
- a session cookie, strictly necessary to keep you signed in;
- the browser's local storage, to remember your display preferences. It never leaves your device and nobody but you can read it.
5. Your rights
European regulation gives you the right to access your data, have it corrected, have it erased, restrict its processing, object to processing based on our legitimate interest, and receive the data you provided in a reusable format.
To exercise these rights, write to contact@halofloor.com. We reply within one month. If our answer does not satisfy you, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.
6. Security
Traffic between your browser and our servers is encrypted. Access to account data is restricted to those who need it. In the event of a breach presenting a risk to your rights, we notify the supervisory authority within 72 hours and inform you directly where the risk is high.
7. Minors
The service is not intended for people under 15 and we do not knowingly collect their data. If you find otherwise, tell us: we will delete the account concerned.
8. Changes
This policy may change. The update date appears at the top of the page, and any substantial change will be notified to you before it takes effect.