PRIVACY POLICY

THŌNE Studio Ltd
Company Number: 16482399
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Last Updated: January 2026

INTRODUCTION

THŌNE Studio Ltd ("we," "us," "our," or the "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website halsi.us (the "Site") and use our services.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. By using the Site, you consent to the data practices described in this policy.

DATA CONTROLLER

The data controller responsible for your personal data is:

THŌNE Studio Ltd
71-75 Shelton Street
Covent Garden, London
WC2H 9JQ
United Kingdom

Email: privacy@halsi.us

INFORMATION WE COLLECT

3.1 Information You Provide Directly

• Account Information: When you create an account, we collect your name, email address, and password.
• Subscription Information: When you subscribe to premium services, we collect payment information (processed securely by our payment providers), billing address, and transaction history.
• Communications: When you contact us, we collect the content of your messages and any information you choose to provide.
• User-Generated Content: Any comments, posts, or content you submit to the Site.

3.2 Information Collected Automatically

• Device Information: IP address, browser type and version, operating system, device type, and unique device identifiers.
• Usage Data: Pages visited, time spent on pages, links clicked, referral sources, and navigation patterns.
• Location Data: General geographic location based on IP address.
• Cookies and Similar Technologies: See our Cookie Policy for details.

3.3 Information from Third Parties

• Payment Processors: Transaction confirmations and payment status from Stripe or other payment providers.
• Authentication Services: If you sign in using third-party services (e.g., Google), we may receive your name and email address from those services.
• Analytics Providers: Aggregated usage statistics from analytics services.

LEGAL BASIS FOR PROCESSING

We process your personal data based on the following legal grounds:

PURPOSE LEGAL BASIS
─────────────────────────────────────────────────────────────────────────────────
Providing services and fulfilling contracts Performance of a contract
Processing payments and managing subscriptions Performance of a contract
Sending service-related communications Legitimate interests
Sending marketing communications (with consent) Consent
Improving services and user experience Legitimate interests
Ensuring security and preventing fraud Legitimate interests
Complying with legal obligations Legal obligation

HOW WE USE YOUR INFORMATION

We use your personal information to:

• Provide Services: Create and manage your account, process subscriptions, deliver content, and provide customer support.
• Personalize Experience: Customize content and recommendations based on your preferences and usage patterns.
• Communicate: Send transactional emails (account confirmations, payment receipts, subscription updates) and, with your consent, marketing communications.
• Improve Services: Analyze usage data to enhance Site functionality, develop new features, and improve user experience.
• Ensure Security: Detect, prevent, and address fraud, abuse, security risks, and technical issues.
• Legal Compliance: Comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

We do not sell your personal information. We may share your data with:

6.1 Service Providers

Third-party vendors who perform services on our behalf, including:

• Payment Processing: Stripe, PayPal (for secure payment transactions)
• Email Services: For transactional and marketing emails
• Hosting and Infrastructure: Cloud service providers
• Analytics: To understand Site usage and improve services

All service providers are contractually obligated to protect your data and use it only for the purposes we specify.

6.2 Legal Requirements

We may disclose your information if required by law, legal process, litigation, or governmental authority requests, or when we believe disclosure is necessary to:

• Protect our rights, property, or safety
• Investigate potential violations of our Terms
• Prevent illegal activities or fraud

6.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.

INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in countries outside the United Kingdom or European Economic Area (EEA). When we transfer data internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions where applicable
• Other legally recognized transfer mechanisms

DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

DATA TYPE RETENTION PERIOD
─────────────────────────────────────────────────────────────────────────────────
Account information Duration of account + 2 years
Subscription/payment records 7 years (legal/tax requirements)
Usage analytics 26 months
Marketing preferences Until consent is withdrawn
Support communications 3 years

Upon account deletion, we will delete or anonymize your personal data within 30 days, except where retention is legally required.

YOUR RIGHTS

Under the UK GDPR, you have the following rights:

9.1 Right of Access
You may request a copy of the personal data we hold about you.

9.2 Right to Rectification
You may request correction of inaccurate or incomplete personal data.

9.3 Right to Erasure ("Right to be Forgotten")
You may request deletion of your personal data in certain circumstances.

9.4 Right to Restriction of Processing
You may request that we limit how we use your data.

9.5 Right to Data Portability
You may request a copy of your data in a structured, commonly used, machine-readable format.

9.6 Right to Object
You may object to processing based on legitimate interests or for direct marketing purposes.

9.7 Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time.

9.8 Right to Lodge a Complaint
You have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113

To exercise any of these rights, please contact us at privacy@halsi.us. We will respond to your request within one month.

DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure storage with access controls
• Regular security assessments and updates
• Employee training on data protection

However, no method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

CHILDREN'S PRIVACY

The Site is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete that information.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Site with a new "Last Updated" date. Your continued use of the Site after changes constitutes acceptance of the updated policy.

CONTACT US

For questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: