Who we are
hailo is a product of SimpleKPI Ltd, registered in England and Wales with company number 06191007, at 66 Paul Street, London EC2A 4NA. For the personal data described in this notice we are the controller. We're registered with the Information Commission (the ICO) under number ZB902250.
The short version
- This website sets no cookies. It counts visits without them, has no advertising trackers, and doesn't follow you around other sites.
- The details of your volunteers, staff, keyholders and hirers belong to your venue. We use them only to brief those people and keep your records.
- The AI that drafts your plans writes from your answers about the building, and never sees anyone's name.
- We collect what we need to run your account and bill you, and nothing more.
- We don't sell personal data.
What we collect and why
| When | What we collect | Why, and our lawful basis |
|---|---|---|
| Visiting this website | Your IP address, browser and device type, the pages you request and when, recorded in our hosting provider's server logs. | To deliver the website and keep it secure. Legitimate interests: running a secure website. |
| Counting visits | Through Cloudflare Web Analytics, without cookies: the page, the site you came from, your browser and device type, your country and how long the page took to load. We see only totals, never who you are. | To see which pages help people and keep the site fast. Legitimate interests: improving the website. |
| Checking your venue | Nothing. The scope check runs in your browser and sends us nothing. | So you can find out whether Martyn's Law applies without telling us anything. No personal data is processed. |
| Creating and running an account | Your name, email address, your organisation and venues, your role and sign-in details. | To provide hailo to your venue and let you sign in. Contract, or legitimate interests where you run a venue for an organisation or as a volunteer. |
| Billing | The bill payer's name, organisation, address, VAT number and payment status. Card details go straight to our payment provider, Stripe; we never see the full number. | To take payment and keep the records tax law requires. Contract and legal obligation. |
| Support and service messages | What you tell us when you contact us, and records of our replies. | To help you and to tell you about changes to the service, security issues, renewals and your account. Contract and legitimate interests. |
Where we rely on legitimate interests, we've weighed our interests against yours. You can ask us for details, and you can object at any time.
Data we process for venues
When a venue uses hailo, it decides who to add and brief. For that data the venue's organisation is the controller and we are its processor, acting only on its instructions under our data processing terms.
That data is:
- the names, email addresses and mobile numbers of the volunteers, staff, keyholders and hirers the venue adds, and their role;
- when each person was sent a briefing, when they opened it and when they confirmed it, with the briefing's version, the name they confirmed with and their type of browser. We don't keep their IP address;
- who approved each plan and when, and the venue's answers about its building;
- a record of changes made in the app, for the venue's evidence.
When a venue removes a person, their details are deleted straight away. Their confirmations stay in the venue's evidence, under the name they confirmed with.
If you were briefed by a venue and have a question about your details, ask the venue first. They can ask us to help.
Drafting and the assistant
hailo drafts each plan from a venue's answers about its building. The questions ask for roles, such as "the duty volunteer", not names, and the AI never sees anyone's name. A person at the venue reads and approves every plan.
Questions asked in the app's assistant go to Microsoft, which runs the AI model for hailo in its Azure cloud. Before a question is sent, hailo removes the personal details it can spot: the names and email addresses of the venue's volunteers, hirers and admins, other email addresses, phone numbers, postcodes, and card and bank numbers. Any other name typed into a question is sent as it is, so leave those out. With the question go the parts of our help that fit it and the venue's progress as counts, never anyone's name or what the venue's procedures say. We ask Microsoft not to save it, and questions aren't used to train AI models.
We don't keep the conversation, only how many questions each person asked each day, so we can apply the daily limit. A venue's account owner can turn the assistant off in Settings, and then nothing is sent.
Who we share it with
We share personal data only with suppliers who help us run hailo, under contracts that protect it:
- hosting: Cloudflare, for this website and its visit counts, and Microsoft Azure, for the hailo app;
- payments: Stripe, which collects and stores your card details in its secure checkout under its own privacy notice. We keep only a Stripe customer and subscription reference;
- email: Amazon Web Services, for sign-in codes, briefing links and reminders;
- network security: Cloudflare, in front of the app;
- drafting and the assistant: Microsoft Azure OpenAI, in Microsoft Foundry.
The full list, for the data we process for venues, is on our sub-processors page.
We may also share personal data with our professional advisers, with a buyer if hailo's business is sold, and with authorities when the law requires it.
Transfers outside the UK
Your venue's data in the hailo app is stored in the UK, in Microsoft Azure's UK South region. Some suppliers process personal data outside the UK: Cloudflare runs a global network, Stripe processes payments in the United States, and drafting and the assistant may run in any Azure region where Microsoft runs the model, the United States included. When a supplier processes personal data outside the UK, we make sure the transfer is protected as UK data protection law requires, for example because UK regulations recognise the country's protection as adequate, or by using the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us for a copy of the safeguards we use.
How long we keep it
- Account and venue data: while your account is open. When the account owner closes it, it's hidden straight away and deleted 30 days later, so a mistake can still be put right in that time.
- People a venue removes: deleted straight away, apart from their confirmations in the venue's evidence.
- Briefing links: they stop working after 30 days.
- Billing records: for six years, as tax law requires.
- Support messages: for two years after the conversation ends.
- Website server logs: for 30 days, unless we need them to investigate a security issue.
- Assistant questions: not kept. We keep only a count of each person's questions each day.
What you have to give us
You don't have to give us any personal data to read this website or check your venue. To use hailo we need your name and email address, and to pay for a plan we need billing details. Without them we can't provide the service.
We don't make decisions about you based only on automated processing.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct it if it's wrong;
- delete it, or restrict how we use it;
- stop using it for legitimate interests or for marketing;
- give it to you, or another organisation, in a portable format.
Email hello@gethailo.co.uk with "Privacy" in the subject. We'll reply within one month, and we may need to confirm who you are first. Some rights have exceptions, and we'll explain if one applies. A venue's account owner can also download everything the venue holds, as a file, in Settings.
Complaints
If you're unhappy with how we've handled your personal data, please tell us first at hello@gethailo.co.uk so we can try to put it right. We'll acknowledge your complaint within 30 days.
If you're still unhappy, you can complain to the Information Commission (the ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies, children and changes
Cookies. This website sets no cookies, and counts visits without them. The hailo app sets only the cookies it needs to sign you in. See our cookie notice for the details.
Children. hailo is for the adults who run venues and isn't meant for children. A venue may brief young volunteers, such as young leaders at a scout or guide hut; the venue decides that, and we use their details only to brief them.
Changes. We'll update this notice when how we use personal data changes, and change the date at the top. If a change matters to you, we'll tell you directly.