Privacy policy
Issued by Halcyon. Contact ai@halcyonlabs.uk. Company number, registered office and ICO registration are available on request until published here.
This policy explains how Halcyon processes personal data when you create an account, sign in, or use Halcyon or the workspace. It is written to meet the structure expected under UK GDPR. It does not claim a certification.
1. Who is the controller
Halcyon is the controller for the personal data described here. Trading name: Halcyon. Contact: ai@halcyonlabs.uk. Registered company name, company number, registered office and ICO registration number are available on request.
If your organisation has a written contract with us, that contract may name the legal entity that is the controller for your organisation’s service.
2. What we process
- Account and identity — email, display name, and identifiers issued by our identity service so you can sign in.
- Membership and access — which isolated private environments you belong to, and the role granted to you. Membership is resolved on the server.
- Usage telemetry — usage, cost, latency, workload mix, and whether tools were used. We do not store prompts or responses on our servers. We do not harvest document contents.
- Encrypted file metadata — size and security class, not readable contents. Files are encrypted on your device before they are sent.
- Device-side chat history — may stay on your device. We do not store that history on our servers.
- Support correspondence and security records, including which version of this policy you accepted (version, time, and a hash of the text — not prompt content).
Halcyon is not offered to anyone under 18.
3. Lawful bases
Contract — to run your account and the isolated environment you have been granted. Legitimate interests — to keep the service secure and to size capacity, not to read prompts. Consent — accepting this policy before using the signed-in service, and any opt-in to aggregated industry intelligence.
4. How inference is processed
Work you send for inference is processed on isolated capacity under the security class chosen for that work. Confidential work is not run on hosts that are not eligible for that class. We do not silently send work to a weaker class of host. If eligible capacity is unavailable, the work stays queued or is refused.
5. Retention
Account and membership while the account is active, then a short closing period. Privacy acceptance is kept as evidence. Usage telemetry is operational, not a prompt archive. Device history is controlled on your device.
6. Where data is processed
The control plane is hosted in the United Kingdom. Inference for your isolated environment is processed on capacity allocated to that environment. We do not routinely transfer account data outside the UK or EEA.
7. Processors
An identity service and cloud hosting in the United Kingdom act as processors on our instructions. We do not sell personal data.
8. Your rights
You may ask us to access, correct, erase, or restrict your data, object to legitimate-interests processing, and receive a copy where portability applies. Email ai@halcyonlabs.uk. You may complain to the Information Commissioner’s Office (ico.org.uk).
9. Security
Files and conversations are encrypted in transit and at rest. Access to an isolated environment requires membership.
10. Local storage
Halcyon and the workspace store sign-in tokens on the device and, if you choose, encrypted chat history. This marketing website does not set tracking cookies.
11. Staging
If Staging is on in Halcyon, you are using a separate control plane. Acceptance of this policy is recorded there, not copied automatically from production.
12. Changes
A new Version date means you will need to accept again before using the signed-in service.