1. Privacy commitment
HaltState is operated by Krystal Unity Pty Ltd, an Australian company. We use HaltState data to provide AI governance, runtime policy enforcement, approval workflows, and audit evidence for our customers.
The umbrella Krystal Unity Privacy Policy describes the shared privacy framework, including GDPR and UK GDPR, the California Consumer Privacy Act, Australian Privacy Principles, data protection addendum availability, and group-wide contact paths.
2. What we collect
HaltState collects the information needed to run an AI governance control plane:
- Policy configuration data, including customer-defined rules, enforcement thresholds, approval routing, and agent registrations.
- Runtime agent telemetry, including which actions were attempted, allowed, blocked, escalated, or approved.
- Proof Packs, including cryptographic attestations of policy evaluation events and related audit evidence.
- Sentinel-style governance state, including who approved an action, when approval occurred, and which policy applied.
- Operator account information, including name, email address, organisation, role, and authentication metadata.
- Billing information, processed through Stripe. We do not store full card numbers.
HaltState does not collect end-user content from customer applications by default. We see policy decisions and governance events, not the user content the agent was acting on, unless a customer deliberately configures HaltState to log that content.
HaltState does not perform cross-site tracking or advertising targeting.
3. How we use data
We use HaltState data to deliver and improve the governance product, enforce customer-defined policies, generate Proof Packs, operate approval and escalation workflows, send service notices, process subscriptions, respond to support requests, and investigate security incidents or abuse.
We may use aggregated or de-identified operational metrics to understand reliability, latency, and product quality. We do not sell HaltState customer data.
4. Sub-processors
HaltState uses a focused subset of Krystal Unity sub-processors:
- Hetzner Online GmbH for primary hosting and storage.
- Stripe for billing, subscriptions, payment processing, and tax workflows.
- Anthropic and OpenAI for selected inference and policy-reasoning workflows.
- Postmark for transactional email and service notices.
- Sentry for error tracking and production reliability diagnostics.
The master policy at krystalunity.com/privacy maintains the broader Krystal Unity sub-processor disclosure.
5. Data retention
Proof Packs are retained according to the customer policy selected for the workspace. The default retention period is 7 years to support compliance evidence, incident reconstruction, and auditability.
Operator account records are retained for the life of the subscription and a reasonable post-termination period for billing, support, security, and legal recordkeeping. Customers may request deletion or export subject to contractual, legal, and security obligations.
6. Security and data location
HaltState is primarily hosted with Hetzner in Germany. EU data residency is available for eligible customer deployments. We use TLS 1.2 or newer in transit, encryption at rest for production data stores, and multi-factor authentication for production access.
Access to production systems is limited to authorised personnel with a service need. Security events may be reviewed using governance telemetry, error logs, and audit evidence.
7. Your rights and contact
The master Krystal Unity Privacy Policy explains rights under GDPR and UK GDPR, the CCPA, and the Australian Privacy Principles. It also explains how to request access, correction, deletion, portability, restriction, objection, or a data protection addendum.
For HaltState privacy requests, contact info@krystalunity.com and include your organisation name and workspace details where relevant.
8. Changes
We may update this HaltState addendum as the product, legal requirements, or sub-processor set changes. Material changes will be reflected on this page and, where appropriate, communicated through service notices.
Last updated: 11 May 2026.