Core page analysis happens in your browser and isn't sent to us. If you create an account, connect Google Search Console or contact us, we handle a small amount of personal data, described below. We don't sell your data or use it for advertising.
Who is responsible.
DoubleO Lab Ltd, registered in England & Wales (company number 17389244), registered office Flat 329 Crescent House, Golden Lane Estate, London, England, EC1Y 0SN, is the controller for the account, support and marketing personal data it processes for Halo, and for the Orbit waitlist. Contact admin@doubleolab.com. Google processes information under its terms; and our use of Supabase for authentication and database services does not remove our responsibility for the personal data it processes for us.
Page audits and external requests.
When you actively run an audit, Halo reads the selected page's HTML, metadata, headings, text, structured data, links and image information, which can include personal information appearing on that page. Audit calculations and schema generation run locally; page content is not sent to an AI model. Halo does not monitor or record your browsing.
Checks may request the page source, robots.txt, sitemaps, llms.txt and public agent files. On-demand checks can contact linked URLs, image resources and alternate-language pages on other domains; the Link health check tests status for up to 200 URLs. These requests test the relevant resources and are not limited to the site in your active tab. The destination server receives the requested URL, your IP address and normal network information, and URLs may themselves contain personal information; Halo adds no advertising or tracking identifiers.
Keyword fit is calculated from the page and the keyword you enter. It does not use any external search-results provider. Image and Local SEO checks inspect the page and the audited site's own resources; they do not send your data to a third-party analysis service. We do not receive or store the content or results of your page audits on our servers.
Accounts and sign in.
Halo is free. Without an account you see a preview of the audit; a free account unlocks the full page audit and the Deep Audits. We use Supabase to manage email or Google sign-in and your account identifier. Email sign-up includes a verification code, sent by our sign-in service through Resend, our email provider. A Google sign-in for your Halo account is separate from granting Search Console access.
We process your email address, account identifier, authentication information and marketing preference to run your account. With Google sign-in we receive your email address (Google may also share your name and profile picture); we store only your email. Your interface preferences are kept on your device, and account settings are stored in Supabase.
Google Search Console (optional).
Connecting Search Console is optional. Halo requests read-only access using the webmasters.readonly scope to retrieve performance and URL-inspection information for properties you are authorised to access, and uses it only to show the Search Console features you request. Requests go from your device to Google's APIs; results are not stored on our servers, and the access token is held by Chrome on your device. Disconnecting in Halo clears the local connection and asks Google to revoke the token; you can also manage access at your Google Account permissions. Halo's use of information from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements; we use it only for the features you ask for, never for advertising or AI-model training.
Support and optional emails.
Emails to admin@doubleolab.com are received in our Google Workspace inbox; we process what you send so we can reply. Please don't send passwords, access tokens or unnecessary personal information in screenshots or reports. Product marketing emails are optional and require your opt-in. We do not send any marketing email unless you opt in, and you can unsubscribe at any time. (We haven't launched a newsletter yet; when we do, we'll name the email provider here.)
Orbit waitlist.
If you join the Orbit waitlist on our website, we store your email address in a list held by Resend, our email provider, and use it only to tell you about Orbit: when a seat opens up and when it launches. This is separate from any Halo account. Every email we send has an unsubscribe link, or you can email admin@doubleolab.com to be removed. We keep your address until you unsubscribe or ask us to delete it, or until we stop running the waitlist.
Purposes and lawful bases.
- Contract. Creating and authenticating your account and handling support you request.
- Consent. Optional marketing email and the Orbit waitlist; you can withdraw it any time.
- Legal obligation. Records we must keep by law.
- Legitimate interests. Keeping the service secure, preventing fraud and handling legal claims, balanced against your rights. You can object to processing based on legitimate interests.
Recipients and international transfers.
We don't sell personal data or share it for advertising. Recipients are Supabase (account services), Resend (email delivery and the Orbit waitlist), Google (sign-in, optional Search Console, and our Workspace support inbox), and the destinations your audits contact. Our database is hosted in the EEA (Ireland), which is covered by the UK's adequacy rules. Where a provider processes data outside the UK/EEA (for example Resend and Google), the transfer relies on the appropriate safeguards in that provider's data-processing terms (such as the UK IDTA/Addendum or EU Standard Contractual Clauses). Provider notices: Supabase, Resend, Google.
Storage, retention and deletion.
- On your device. Settings and cached audit results. The page-audit cache is session-scoped and clears when you close the browser; a small interface preference persists until you clear it or uninstall.
- Account data (email, preferences). Kept while your account is active and deleted within 30 days of account closure, except where the law requires us to keep something.
- Sign-in / security logs. About 90 days.
- Marketing consent. Kept while you're opted in; if you unsubscribe we keep a minimal suppression record so we don't email you again.
- Backups. These roll off on a short window (around seven days), so deleted data clears from backups within that.
Request account deletion at admin@doubleolab.com; we'll explain anything we must retain. Removing the extension does not delete your account, and revoking Google access is a separate action.
Security, permissions and tracking.
We use appropriate technical and organisational measures to protect personal data; no system is perfectly secure, so keep your device and browser secure too. Halo's Chrome permissions are activeTab, scripting, sidePanel, storage and identity, with host access to all sites (to audit any page and fetch page-derived resources), Google's API hosts and Supabase. Halo contains no advertising, behavioural analytics or tracking pixels, and complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Your rights and updates.
Depending on the circumstances you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests; you may withdraw consent and object to direct marketing at any time. We normally respond within one month. You may complain to the ICO. We'll update this policy when our practices change and give appropriate notice of significant changes.