Privacy.

In short

This box is a plain summary. The numbered sections below are the binding text.

We collect what we need to run Halyard: your email address, sign-in and billing records, the footage you send and the details of each job. We use it to provide the service, bill you, prevent abuse and answer support. We never use your footage to train AI models. Uploads are deleted after 2 days, results after 7 days and job details after 90 days. We do not sell data and we do not use advertising trackers.

1. Who is responsible

Smoke and Oakum LLC ("we", "us") runs Halyard. We are the controller of your account, sign-in, billing and support data. For the footage you upload and the results we produce, we act on your behalf as your processor, under our Terms of Service. Contact us at [email protected].

2. What we collect

Account: your email address, and the name or organisation on your account.
Sign-in records: sign-in requests and confirmations, the device name the Premiere plugin reports, and the IP address the request came from. The sign-in page uses Cloudflare Turnstile to check that you are not a bot; Cloudflare receives your IP address for that check and tells us the result.
API keys: each key's name, the client it was issued to, and when it was created and last used. We store only a one-way hash of the key itself.
Billing: Stripe holds your card details. We receive your Stripe customer id, payment status, card brand, the last 4 digits of your card, receipts and invoices, and a card fingerprint. We use the card fingerprint only to prevent abuse of the free test credit. We keep a ledger of every credit purchase, grant, charge, refund and expiry.
Free credit checks: to keep the free test credit to one per person, we record a normalised form of your email address, your email domain, the network range your request came from (for example the first three parts of an IPv4 address), whether that address belongs to a hosting or VPN provider, and the result of the check.
Your content: the footage you upload and the results we produce. See section 5 and our Retention Schedule.
Job metadata: file references, the settings you chose, frame counts, durations, timings, status, errors and costs.
Support: the emails you send to [email protected] and our replies.
Server logs: IP addresses, request details and errors recorded by our servers.

3. How we use it

to provide the service: sign you in, run your jobs and deliver the results;
to quote, charge, refund and keep billing and tax records;
to keep Halyard secure and to prevent fraud and abuse, including abuse of the free test credit;
to answer support requests and send you service and account notices;
to meet our legal obligations.

We do not sell personal data. We do not share it for advertising, and we do not use advertising trackers.

4. Legal bases for EU and UK users

If you are in the European Union or the United Kingdom, we rely on these legal bases: performance of our contract with you (providing the service, sign-in, billing and support); our legitimate interests (keeping the service secure and preventing fraud and abuse); and compliance with legal obligations (tax and accounting records).

5. Your content and no training

We process your footage and results only to run your jobs, deliver the results, keep the service secure and meet legal obligations. We never use your content, or anything derived from it, to train, fine-tune, evaluate or otherwise improve any AI model, whether ours or anyone else's, and we do not permit any of our processors to do so.

A small set of providers process data for us: RunPod (GPU processing), Cloudflare (storage, DNS, content delivery and Turnstile), Hetzner (our API server and database), Stripe (payments) and Google Workspace (email). The full list, with what each one handles and where, is on our Subprocessors page.

We disclose data to authorities only when the law requires it, and we report child sexual abuse material as described in our Terms. If we sell or transfer our business, data may pass to the buyer under this policy.

7. International transfers

Our providers process data in the United States and the European Union, and Cloudflare operates a global network. Where personal data from the EU or UK is transferred to a country without an adequacy decision, the transfer relies on the providers' Standard Contractual Clauses.

8. How long we keep it

Uploads are deleted after 2 days, results after 7 days, and job details after 90 days. Server logs are kept only as long as needed to run and secure the service, and never longer than 12 months; support emails for 2 years, and billing and ledger records for 7 years because tax law requires it. Account data is kept until you ask us to delete your account. The full schedule, including backups, is on our Retention Schedule.

9. This website and the web app

This website runs no analytics or advertising trackers. It stores one preference, the display style you picked, in your browser, and also in one cookie on halyard.video (halyard_view) so the web app can use the same style. That cookie holds only the style name, contains no identifier, and lasts one year. Because it is set on halyard.video, your browser sends it with requests to our sites.

When you sign in to the web app at app.halyard.video, it sets cookies that the app needs to work: one that keeps you signed in (it lasts 14 days after you last use it, and 90 days at most), one that protects your requests from being forged by other websites, and a short-lived one that holds a sign-in while you wait for the email link. They are not used for anything else.

The sign-in page uses Cloudflare Turnstile to keep automated sign-ups out, so Cloudflare receives your IP address and some information about your browser when you sign in. Fonts are loaded from Google Fonts, so Google receives your IP address when a page loads.

10. Your rights

You can ask us to give you access to your personal data, correct it, delete it, export it, or stop a use of it you object to. Email [email protected] from your account address. We answer within 30 days. We may need to keep some data after a deletion request where the law requires it, for example billing records. If you are in the EU or UK, you can also complain to your local data protection authority.

11. Security

Data travels over encrypted connections. Uploads and downloads use short-lived signed links. Storage is access-controlled, and access to production systems is limited to the people who run Halyard. We keep footage for as short a time as the service allows. No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay.

12. Children

Halyard is not for anyone under 18, and we do not knowingly collect their data. If you believe we hold data about a child, contact us and we will delete it.

13. Changes to this policy

We will post changes here and update the version and effective date. For material changes, we will email account holders at least 30 days before they take effect.

Questions: [email protected]