Privacy Policy

Who we are

Hale is a passive, event-driven household assistant for families. You (a parent or legal guardian) create an account, add your children, and optionally connect tools you already use. Hale watches for things that matter, drafts helpful suggestions, and — only with your approval — helps carry them out. Hale is operated by Village Hale Technologies Inc., a company incorporated in Ontario, Canada, which is the organization responsible for your family’s data; see How to reach us.

What we collect

We collect only what we need to run Hale for your family:

• Your account. Your name and email address, provided through Google sign-in, plus basic preferences such as language and time zone.
• Your children’s profiles. Each child’s first name (and last name if you add it), date of birth, and — only if you choose to share them — gender and other optional details such as interests. Hale uses date of birth to derive each child’s stage (newborn, toddler, child, or teenager).
• Care and activity logs. The day-to-day entries you or connected tools record — feeds, naps, milestones, and similar notes about your child’s routine.
• Hale conversations and derived memory. The questions you ask Hale and its answers, plus a structured memory of facts and patterns Hale infers from your family’s activity (for example, a usual nap window or a stated preference) so it can be more helpful over time.
• Coarse location only. If you opt in to local discovery, we store a coarse area — your city, province, country, and at most a postal code or forward-sortation area. We never store your precise street address or your child’s location. The full address you may type into the address box is used only to derive that coarse area and is not retained.
• Village endorsements. When you endorse a local activity, we record that your family endorsed it so we can show an aggregate count (“loved by several families near you”). We never reveal which family endorsed what.
• Connected integrations. If you connect a tool (such as email, calendar, or a daycare app), we store an encrypted authorization token and the minimum metadata needed to sync. You control which integrations are connected and can disconnect them.
• Audit logs and technical data. Every action Hale takes produces an immutable audit record (see Your rights), and we keep limited technical information such as your IP address and browser type for security and to honour your access requests.

Why we use it (and our legal basis)

We use your family’s data to provide and improve Hale: to understand what’s happening in your family’s day, to draft suggestions, to find genuinely useful local things to do, to keep an accurate record of what Hale did, and to keep your account secure. We do not sell your data, and we do not use your children’s data for advertising.

Our processing rests on your consent. We ask for that consent clearly when you sign up and again for specific, sensitive purposes — connecting an integration, sending your context to our AI provider, processing data across borders, and unlocking any automated action. We record each consent (including the policy version and time) so the choice is verifiable, and you can withdraw it at any time (see Your rights).

Children's data

Hale is built around children’s information, and we apply heightened protection to it. A child’s data is provided by you, their parent or guardian, and is processed on your authority and for your family’s benefit. Optional and sensitive fields — such as gender — are exactly that: optional, and stored only if you provide them. A child’s information belongs to one family and is never visible to another family.

Teen privacy (children 13 and older)

As children grow, their privacy matters more. For a child aged 13 or older, raw content (the actual text of a message or post Hale observes) is redacted from parents by default. Parents see only a category or short summary — enough to stay involved, without reading their teen’s words verbatim.

Controls to grant a parent time-limited, explicitly logged access to a teen’s raw content — and a safety-escalation path for a credible risk of harm, in which relevant content may be surfaced and the teen is notified — are planned and not yet available. Until then, the default redaction above always applies.

AI and automated processing

Hale uses artificial intelligence (Anthropic’s Claude models) to read your family’s context and draft suggestions. To do this, relevant conversation and context data is sent to our AI provider to generate a response.

Hale never acts on its own. The AI only drafts; a parent approves every action before anything happens in the outside world. New accounts begin in an observe-only mode, and any move toward more automation requires your explicit, per-action-type approval. You are always the decision-maker.

Sub-processors and cross-border processing

We rely on a small set of trusted service providers to run Hale. We share with each only what that service needs, under contractual safeguards:

• Supabase — our primary database. Hosted in Canada (Toronto, ca-central-1). This is where your family’s core data lives.
• Anthropic — AI processing (the Claude models that draft suggestions). Processed in the United States.
• Google Maps / Places — address autocomplete and public-venue lookup. Only coarse-area and public-venue queries are sent; your precise home address is never sent.
• Vercel — application hosting and content delivery, plus Web Analytics and Speed Insights. Operates in the United States and on a global edge network. Vercel Web Analytics is cookieless — it sets no cookies and builds no cross-site profile.
• PostHog — product analytics, session replay, and error tracking. Event data is coarse and non-identifying (no child data, no message content) — we capture only a few key product steps. Session replay is on so we can understand and fix problems, but every typed value (names, dates of birth, email, address) and all personal data shown on screen — child names and ages, the health and activity timeline, and Hale conversations — is masked before the recording leaves your browser. Error tracking captures unhandled errors (a stack trace, not your data) so we can fix them. Autocapture stays off, and we identify you by an opaque account id, never your name or email. Region per NEXT_PUBLIC_POSTHOG_HOST.
• Resend — delivery of transactional and digest emails (United States).
• Langfuse — AI observability, so we can monitor and debug the assistant. A teen’s raw content and contact details (emails, phone numbers, postal codes, and precise addresses) are masked before any data is sent to this service.

To be clear about where data travels: your primary data store is in Canada, while some processing — AI, application hosting, email delivery, and observability — happens in the United States. We ask for your consent to cross-border processing, and we put appropriate contractual safeguards in place with these providers. Because some processing occurs outside Quebec and Canada, that data may be accessible to authorities in those jurisdictions under their laws.

Data residency, retention, and security

Residency. Your family’s primary data is stored in Canada (Toronto). See Sub-processors for the processing that occurs elsewhere.

Retention. We keep your family’s data for as long as your account is active and as needed to provide Hale. When you delete your account or ask us to erase your data, we delete it, except where we must retain certain records (such as audit logs) to meet legal obligations. Removing a child removes that child’s identifying data; some family history is retained in de-identified form.

Security. Access to your data is isolated per family at the database level (row-level security), data is encrypted in transit, and integration tokens are encrypted before they are stored. We log every action Hale takes so it can always be reviewed.

Your rights

Under PIPEDA and Quebec’s Law 25, you have the right to:

• Access the personal information we hold about your family. Because every action Hale takes is recorded in an immutable audit log, we can show you what happened and when.
• Correct information that is inaccurate or incomplete.
• Delete your data and close your account.
• Withdraw consent at any time, including consent to AI processing, cross-border processing, a specific integration, or any automated action.
• Port your data — receive a copy in a structured, commonly used format.
• Complain. If you are not satisfied with how we handle your data, you may contact the Office of the Privacy Commissioner of Canada, or, in Quebec, the Commission d’accès à l’information du Québec.

To exercise any of these rights, contact us at the address in How to reach us.

Email and electronic messages (CASL)

We send you email that is necessary to run your account — such as security notices and the updates and digests you ask Hale to prepare. If we ever send commercial electronic messages, we do so only with your consent, we identify ourselves, and every such message includes a clear, working way to unsubscribe. You can opt out of non-essential messages at any time without affecting your account.

Changes to this policy

We may update this policy as Hale evolves. When we make a material change, we will update the date at the top and, where appropriate, ask for your renewed consent. The version you agreed to is recorded with your consent.

How to reach us

Our Privacy Officer — the person in charge of personal information under Quebec’s Law 25 — is Anzhe Dong, Founder. For any privacy question, or to exercise your rights, contact us at privacy@villagehale.com.