Privacy Policy

We collect as little as we can get away with. We do not sell your data, we do not share it with advertisers, and we do not use it to train anything.

If you have joined the waitlist, we hold your email address so we can tell you when Hallory launches. That is the whole of it. The rest of this page explains the detail, including what happens once you are using the service itself.

Hallory is the data controller for the hallory.app website and for waitlist signups. You can reach us at hello@hallory.app about anything on this page.

When your organisation uses the Hallory service to manage its venue, your organisation is the data controller for the hirer, volunteer and staff records it enters, and Hallory acts as a data processor on its behalf.

Visiting hallory.app does not require you to give us anything. If you choose to interact with the site, we may collect:

• Your email address, if you join the waitlist. It is submitted through Web3Forms and reaches us by email.
• Standard server and delivery information handled by our hosting provider, such as IP address and browser type, used to serve the site and keep it secure.
• Anything you choose to put in an email to us.

When a venue uses Hallory, the service stores the information needed to run that venue: bookings, rooms, organisations and their contacts, volunteer and staff records, invoices and payment status.

Some of this is personal data belonging to third parties, such as a hirer’s phone number or a volunteer’s availability. The venue decides what to enter and is responsible for having a lawful basis to hold it. We process it only to provide the service.

Under UK GDPR we rely on the following lawful bases:

• Consent, for waitlist emails. You gave us your address specifically to be told about the launch, and you can withdraw that at any time.
• Contract, where processing is necessary to provide the service you or your organisation has signed up for.
• Legitimate interests, for keeping the site secure, preventing abuse, and understanding in general terms how the site is used.
• Legal obligation, where we are required to keep records, for example for tax.

We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf under contract:

• Vercel, for hosting the website and the application.
• Supabase, for the application database and authentication.
• Resend, for sending transactional email such as confirmations and invites.
• Web3Forms, for delivering waitlist signups from the website to us.
• GitHub, which stores the content of this website including blog posts.

Our providers may process data outside the UK. Where that happens, transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

Waitlist emails are kept until launch and for a reasonable period afterwards, or until you ask us to remove you, whichever comes first.

Data inside the service is kept for as long as the organisation uses Hallory. If an organisation stops using the service, we make its data available for export for a reasonable period and then delete it.

We keep records we are legally required to keep, such as financial records, for as long as the law requires.

The marketing website does not use advertising or tracking cookies. The Hallory application uses cookies that are strictly necessary to keep you signed in and to remember which portal you last used.

If we add analytics in future, we will update this page first and use a privacy-respecting provider that does not build advertising profiles.

Under UK GDPR you have the right to ask us for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

Email hello@hallory.app and we will respond within one month. If your data was entered into Hallory by a venue rather than by us, contact that venue first, and we will support them in answering you.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Hallory is a tool for the people who run venues and is not directed at children. We do not knowingly collect personal data from children through this website. Venues that record details of young volunteers or attendees are responsible for the additional safeguards that applies.

We will update this page as the product and the law change, and the date at the top shows the last revision. Where a change materially affects how we handle your data, we will tell you by email before it takes effect.