Privacy Policy (DRAFT)

Effective [DRAFT, effective date to be set at launch]. Controller: Hallows Group LLC, 5900 Balcones Drive #31966, Austin, TX 78731, sales@hallowsgroup.com.

What we collect: your email address; your alert preferences (program, centers/state/ZIP and radius, dates, weekdays); payment records from Stripe (payment status, amount, date, and the name, billing country/postal code and email you give Stripe; we never see your full card number); and technical data such as IP address, browser and request logs processed by Cloudflare for security and delivery. We do not collect government identifiers, passport, Known Traveler or CBP/Login.gov information. Please don't send it to us.

How we use it: we send only alerts, receipts and service notices (no marketing). We do not sell personal information or "share" it for cross-context behavioral advertising, and we use no advertising or analytics cookies.

Providers: Cloudflare, Inc. (hosting, database, email sending; privacy policy) and Stripe, Inc. (payments; Stripe is an independent controller for some payment data; privacy policy). Data is stored and processed in the United States. We may disclose data if required by law, to protect rights and safety, or in a business transfer.

Retention: we delete your subscription record (email and preferences) 90 days after it expires or is cancelled; this runs automatically. Payment and refund records are kept as long as tax and accounting law requires (generally up to 7 years). Cloudflare logs follow Cloudflare's retention.

Your rights: you may request access to, correction of, or deletion of your data by emailing sales@hallowsgroup.com; we respond within 30 days (45 days where the CCPA applies). If you are in the EEA/UK, our legal bases are performance of contract (alerts, payment) and legitimate interests (security); you may also object, request portability, and complain to your supervisory authority. Canadian users may contact the Office of the Privacy Commissioner of Canada.

Children: the service is not directed to children under 13, and we do not knowingly collect their data.

Security: data is encrypted in transit, and access is limited to the operator.

Public data: center history pages show only aggregated, anonymous opening times from CBP's public scheduler, never anything about subscribers.

Changes to this policy: we will post any update here with a new effective date.