Core page analysis happens in your browser and isn't sent to us. If you create an account, connect Google Search Console, buy Halo Pro or contact us, we handle a small amount of personal data, described below. We don't sell your data or use it for advertising.
Who is responsible.
DoubleO Lab Ltd, registered in England & Wales (company number 17389244), registered office Flat 329 Crescent House, Golden Lane Estate, London, England, EC1Y 0SN, is the controller for the account, support and marketing personal data it processes for Halo. Contact support@doubleolab.com. Paddle processes purchase information as merchant of record under its own notice; Google processes information under its terms; and our use of Supabase for authentication and database services does not remove our responsibility for the personal data it processes for us.
Page audits and external requests.
When you actively run an audit, Halo reads the selected page's HTML, metadata, headings, text, structured data, links and image information — which can include personal information appearing on that page. Audit calculations and schema generation run locally; page content is not sent to an AI model. Halo does not monitor or record your browsing.
Checks may request the page source, robots.txt, sitemaps, llms.txt and public agent files. On-demand checks can contact linked URLs, image resources and alternate-language pages on other domains; the Link health check tests status for up to 200 URLs. These requests test the relevant resources and are not limited to the site in your active tab. The destination server receives the requested URL, your IP address and normal network information, and URLs may themselves contain personal information; Halo adds no advertising or tracking identifiers.
Keyword fit is calculated from the page and the keyword you enter — it does not use any external search-results provider. Image and Local SEO checks inspect the page and the audited site's own resources; they do not send your data to a third-party analysis service. We do not receive or store the content or results of your page audits on our servers.
Accounts and sign in.
Anonymous users get a limited overview. A Free account unlocks detailed findings; Pro unlocks more. We use Supabase to manage email or Google sign-in, your account identifier, and your subscription entitlement. Email sign-up includes a verification code (currently sent through our authentication provider's email service). A Google sign-in for your Halo account is separate from granting Search Console access.
We process your email address, account identifier, authentication information, plan status and marketing preference to run your account. With Google sign-in we receive your email address (Google may also share your name and profile picture); we store only your email. Your interface preferences are kept on your device, and account settings are stored in Supabase.
Google Search Console (optional).
Connecting Search Console is optional. Halo requests read-only access using the webmasters.readonly scope to retrieve performance and URL-inspection information for properties you are authorised to access, and uses it only to show the Search Console features you request. Requests go from your device to Google's APIs; results are not stored on our servers, and the access token is held by Chrome on your device. Disconnecting in Halo clears the local connection and asks Google to revoke the token; you can also manage access at your Google Account permissions. Halo's use of information from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements; we use it only for the features you ask for, never for advertising or AI-model training.
Payments, support and optional emails.
Paddle handles checkout, payment details, tax and invoicing as merchant of record; we do not receive or store card numbers. From Paddle we receive only your subscription status, plan, billing period, renewal date and the related customer and subscription identifiers, so we can unlock Pro and help with billing.
Emails to support@doubleolab.com are received in our Google Workspace inbox; we process what you send so we can reply. Please don't send passwords, access tokens or unnecessary personal information in screenshots or reports. Product marketing emails are optional and require your opt-in — we do not send any marketing email unless you opt in, and you can unsubscribe at any time. (We haven't launched a newsletter yet; when we do, we'll name the email provider here.)
Purposes and lawful bases.
- Contract — creating and authenticating your account, managing your plan, and handling support you request.
- Consent — optional marketing email; you can withdraw it any time.
- Legal obligation — records we must keep for tax and accounting.
- Legitimate interests — keeping the service secure, preventing fraud and handling legal claims, balanced against your rights. You can object to processing based on legitimate interests.
Recipients and international transfers.
We don't sell personal data or share it for advertising. Recipients are Supabase (account services), Paddle (purchases), Google (sign-in, optional Search Console, and our Workspace support inbox), and the destinations your audits contact. Our database is hosted in the EEA (Ireland), which is covered by the UK's adequacy rules. Where a provider processes data outside the UK/EEA (for example Paddle and Google), the transfer relies on the appropriate safeguards in that provider's data-processing terms (such as the UK IDTA/Addendum or EU Standard Contractual Clauses). Provider notices: Supabase, Paddle, Google.
Storage, retention and deletion.
- On your device — settings and cached audit results. The page-audit cache is session-scoped and clears when you close the browser; a small interface preference persists until you clear it or uninstall.
- Account data (email, plan, preferences) — kept while your account is active and deleted within 30 days of account closure, except where the law requires us to keep something.
- Sign-in / security logs — about 90 days.
- Marketing consent — kept while you're opted in; if you unsubscribe we keep a minimal suppression record so we don't email you again.
- Billing and tax records — held by Paddle for the period required by law (around six years); we store only your subscription status.
- Backups — roll off on a short window (around seven days), so deleted data clears from backups within that.
Request account deletion at support@doubleolab.com; we'll explain anything we must retain and coordinate cancelling any active subscription. Removing the extension does not cancel billing or delete your account, and revoking Google access is a separate action.
Security, permissions and tracking.
We use appropriate technical and organisational measures to protect personal data; no system is perfectly secure, so keep your device and browser secure too. Halo's Chrome permissions are activeTab, scripting, sidePanel, storage, identity and alarms, with host access to all sites (to audit any page and fetch page-derived resources), Google's API hosts and Supabase. Halo contains no advertising, behavioural analytics or tracking pixels, and complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Your rights and updates.
Depending on the circumstances you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests; you may withdraw consent and object to direct marketing at any time. We normally respond within one month. You may complain to the ICO. We'll update this policy when our practices change and give appropriate notice of significant changes.