This Privacy Policy explains how Halfacre Research Institute LLC, an Alabama limited liability company ("Halfacre Research," "we," "us"), collects, uses, shares, and protects personal information when you use halfacreresearch.tech, your private client page, and our products.
1. Summary
When you sign up, we collect your name, email address, and phone number.
Your client page opens from a private link that we email to you. To see or upload statements, you also enter a 6-digit code we email you; your browser then stays signed in for 30 days (see Section 5).
When you upload a statement, our server reads it and keeps only what it read (such as institution, account type, last four digits of the account number, balance, statement date, and holdings), encrypted with a key that belongs to your account alone. We do not keep the file itself. You can delete all of it from your page at any time (see Section 6).
When you chat on your page, your messages are sent to our outside AI provider, xAI, so the AI on your page can respond. For uploads, xAI receives only the holdings and balances our server read, never the file, its raw text, or account numbers (see Section 4).
PayPal handles all payments. We never see your full card or bank account numbers.
We do not sell your personal information, and we do not share it for targeted advertising.
Halfacre Research provides research and data. It is not personal financial advice.
2. Information we collect
Information you give us
Sign-up details: your full name, email address, and phone number.
Chat messages you type to the AI on your client page.
Uploads:
Our server reads each file you upload and then discards the file. We do not keep the file or its raw text. We keep the file's name, size, type, and upload time, plus the account details our server read from it (institution, account type, last four digits of the account number, balance, statement date, and holdings: symbol, name, quantity, and value). These are stored encrypted, with a key that belongs to your account alone, in private storage that is not part of the public website. We use them to show your statements and your net worth on your page. Images and scanned PDFs are not read yet, so for those we keep only the file's name, size, and type. The largest upload we accept is 20 MB.
Our AI provider receives only the institution, account type, balance, statement date, and holdings our server read. It never receives the file, its raw text, or any account number.
The account details we read from a file are automatic and may be wrong. We do not check them with your bank or broker.
Because file names and text documents can contain personal details, please name files simply and remove passwords, PINs, full account numbers, and Social Security numbers before uploading.
Emails you send us at matt@halfacreresearch.tech, and our replies.
Information from purchases
Products are sold one at a time through PayPal, including research modules, packs, and bots. PayPal sends us your name, email address, transaction ID, the item purchased, the amount, and the payment status. Your card and bank details stay with PayPal.
We keep a record of what you bought and unlocked.
Information collected automatically
Our web host, Hostinger, logs your IP address, browser type, and the pages you request.
Your browser stores data on your device (local storage) to remember your session. After you enter an emailed sign-in code, we set a secure cookie that keeps that browser signed in for 30 days. You can sign out a browser from your page at any time.
We keep a log of each time your statement data is opened (who opened it, when, and from what IP address). The log never contains the data itself.
Some pages load fonts from Google Fonts, which means your browser connects to Google's servers.
We do not use advertising pixels or third-party analytics on client pages.
3. How we use information
We use personal information to:
create and run your account and client page, and email you your private page link;
provide AI responses and research based on what you choose to share;
remember what you tell ResearchBot on your page (your messages and the facts we take from them) so later visits can pick up where you left off;
deliver purchases and unlocks;
process payments, refunds, and payment disputes;
keep the service secure and prevent fraud and abuse;
answer your questions and send account messages and receipts;
meet our legal, tax, and accounting obligations; and
with your permission, send you updates.
Phone numbers. We use your phone number to contact you about your account. We will not send you marketing text messages, or make autodialed or prerecorded marketing calls, unless you separately agree in writing.
Conversation memory. ResearchBot on your page remembers what you tell it — your messages and short facts we take from them, such as a goal or a coin you asked about — so it can use those on later visits. That memory is stored encrypted, with a key that belongs to your account alone, in private storage that is not part of the public website. Only you, and Halfacre staff who have signed in with multi-factor authentication, can read it. You can erase it at any time with "Delete my memory" on your page (see Section 6).
No training by us. We do not use your chats or uploads to train AI models.
4. Who we share information with
We share personal information only with service providers that help us run Halfacre Research, and only as needed to provide the service:
xAI, our outside AI provider. Your chat messages, the names of files you upload, and the summary our server read from an upload (institution, account type, balance, statement date, and holdings: symbol, name, quantity, and value) are sent to xAI so the AI on your page can respond. We never send xAI the uploaded file, its raw text, or any account number, and we remove long numbers (such as account or card numbers) from chat messages before they are sent. Under xAI's published business terms:
xAI processes this content on our behalf. It does not use it to train its AI models.
Depending on our account's settings, xAI either deletes it as soon as the response is delivered, and in any case within one hour (xAI's "Zero Data Retention" setting), or stores it encrypted for up to 30 days to monitor for abuse and misuse, and then deletes it.
Without Zero Data Retention, xAI may keep content longer if the law requires it or if it is reasonably needed for safety, security, or investigating a suspected violation of xAI's terms. xAI may also create aggregated or de-identified data that cannot identify you.
PayPal, our only payment processor. PayPal's Privacy Statement explains how PayPal handles your information.
Hostinger, which hosts our website and servers.
Our email service provider, which sends sign-up, private-link, and receipt emails.
Others when required: to comply with the law or legal process, to protect rights and safety, or as part of a merger, acquisition, or sale of our business. We will notify you if your information is transferred in a sale.
We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as California law defines those terms.
5. Your private page link
Your client page opens from a private link that we send to the email address on your account. Your statement data (uploads and everything read from them) also needs a 6-digit code we email to that address. Codes expire after 10 minutes and work once. After a correct code, that browser stays signed in for 30 days unless you sign it out. Someone with only your link can see your purchases and chat on your page, but not your statement data, so keep the link private.
Don't forward the email or post the link, and be careful on shared or public computers.
Lost your link? Enter your email on the sign-up page. If it matches an account, we will email the link to that address only.
If you think someone else has your link, email matt@halfacreresearch.tech right away with the subject "Secure my page," and we will take steps to secure it, such as replacing your link.
Please think carefully before uploading sensitive documents, and remove account numbers and Social Security numbers first.
6. How long we keep information
Who is responsible. Matthew Halfacre is the person responsible for protecting your information at Halfacre Research. Contact him at matt@halfacreresearch.tech.
Uploaded files: we do not store them. Our server reads each file when you upload it and then discards it.
Statement data (what our server read from your uploads: file name, size, type, upload time, institution, account type, last four digits of the account number, balance, statement date, and holdings): stored encrypted with a key that belongs to your account alone, until you delete it, and no later than 2 years after you last use your page. Then we delete it automatically.
Deleting your statement data: use "Delete my statement data" on your page, or the Delete button next to any one upload, or email matt@halfacreresearch.tech with the subject "Privacy request." Deleting destroys your account's encryption key and overwrites the stored data, so it cannot be read back.
Statement access log (who opened your statement data and when; never the data itself): kept as long as we keep your statement data, so we can check who has looked at it.
Account details (name, email, phone): while your account is open, then deleted within 12 months after it is closed, unless the law requires us to keep them longer.
Conversation memory (your ResearchBot messages and the facts we take from them so later visits remember you): stored encrypted with a key that belongs to your account alone, until you delete it, and no later than 12 months after your last activity.
Deleting your conversation memory: use "Delete my memory" on your page, or email matt@halfacreresearch.tech with the subject "Privacy request." Deleting destroys that memory's encryption key and overwrites the stored talks, so they cannot be read back. This does not delete your statement data; use "Delete my statement data" for that.
Purchase records: 7 years, for tax and accounting purposes.
Server logs: according to our web host's standard log retention.
What we send to xAI: xAI's retention of what we send it is described in Section 4.
7. How we protect information
We use administrative, technical, and physical safeguards. These include encryption in transit (HTTPS); encryption at rest for statement data (each client's data is sealed with that client's own key, which is itself encrypted with a key kept outside the public website) and for saved exchange keys; an emailed sign-in code before anyone can see statement data; multi-factor sign-in for Halfacre staff before they can use our admin desk; a log of who opens statement data; long random page links that are never published; instructions that tell search engines not to index client pages; and keeping API keys out of public code. Only you, and Halfacre staff who have signed in with multi-factor authentication, can see your statement data. No system is perfectly secure.
Data breaches. If your statement data or other personal information is breached:
we will notify you by email or mail without unreasonable delay, and no later than 45 days after we determine the breach happened;
if more than 1,000 people are affected, we will also notify the Alabama Attorney General; and
if unencrypted information of 500 or more people is involved, we will notify the Federal Trade Commission within 30 days of discovering it.
These commitments follow the Alabama Data Breach Notification Act of 2018 (Ala. Code § 8-38-1 et seq.) and the FTC Safeguards Rule (16 CFR 314.4(j)).
8. Your choices and rights
You can ask us to access, correct, download, or delete your personal information, or to stop marketing to you. Email matt@halfacreresearch.tech with the subject "Privacy request." We will verify your request, usually by replying to the email address on your account, and respond within 45 days.
You can unsubscribe from marketing emails at any time using the link in the email.
California residents: if the California Consumer Privacy Act applies to us, you have the right to know, delete, and correct your personal information; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
Texas residents: if the Texas Data Privacy and Security Act applies to us, you may confirm, access, correct, delete, and get a copy of your personal data, and opt out of targeted advertising, sale, and certain profiling. If we deny your request, you may appeal by replying to our decision, and we will respond within 60 days. If your appeal is denied, you may contact the Texas Attorney General.
Residents of other states with privacy laws may make the same requests, and we will honor them as those laws require.
9. Children
Our services are for adults 18 and older. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.
10. Changes to this policy
We will post any update on this page and change the date at the top. If a change is material, we will tell you by email or on your client page before it takes effect.