Privacy

Last updated: October 15, 2026

This Privacy Policy explains how Halfacre Research Institute LLC, an Alabama limited liability company ("Halfacre Research," "we," "us"), collects, uses, shares, and protects personal information when you use halfacreresearch.tech, your private client page, and our products.

1. Summary

• When you sign up, we collect your name, email address, and phone number.
• Your client page opens from a private link that we email to you. That email leads with Tap this button to sign in. Tapping the button, or opening the private page link, signs that browser in so you can see or upload statements. A 6-digit code is in the same email as a backup. Your browser then stays signed in for 30 days (see Section 5).
• When you upload a statement, our server reads it and keeps only what it read (such as institution, account type, last four digits of the account number, balance, statement date, and holdings), encrypted with a key that belongs to your account alone. We also keep the file itself, sealed with that same key, so your AI partner can remember it. You can delete one upload or all of it from your page at any time (see Section 6).
• When you chat on your page, your messages are sent to our outside AI provider, xAI, so the AI on your page can respond. For uploads, xAI receives only the holdings and balances our server read, never the file, its raw text, or account numbers (see Section 4).
• PayPal handles all payments. We never see your full card or bank account numbers.
• We do not sell your personal information, and we do not share it for targeted advertising.
• Halfacre Research provides research and data. It is not personal financial advice.

Files and account details you share

What we keep: the files you upload (such as statements, tax returns, and estate or beneficiary documents), the account details you choose to connect, and the notes your AI partner makes from them.

Why we keep it: your AI partner remembers what you've shared, so it can keep helping you over time, track your progress, and send the reminders you asked for without asking you to upload the same files again.

How long we keep it: until you delete it or close your account.

How to delete it: you can delete any upload, or all of your data, from your page at any time, or ask us to do it by emailing matt@halfacreresearch.tech. Closing your account deletes your data. We may keep a limited record when the law requires it.

We protect what you share with reasonable security, and we never sell it. We share it only with the service providers that help us run Halfacre Research, such as hosting, our AI provider and account-connection services, under agreements that limit their use to providing our service, or when the law requires it. We never hold or move your money.

2. Information we collect

Information you give us

• Sign-up details: your full name, email address, and phone number.
• Chat messages you type to the AI on your client page.
• Uploads:
  • We keep each file you upload, encrypted with a key that belongs to your account alone, so your AI partner can remember it over time. We do not keep the file's raw text. We also keep the file's name, size, type, and upload time, plus the account details our server read from it (institution, account type, last four digits of the account number, balance, statement date, and holdings: symbol, name, quantity, and value). These are stored encrypted, with a key that belongs to your account alone, in private storage that is not part of the public website. We use them to show your statements and your net worth on your page. Images and scanned PDFs are not read yet, so for those we keep only the file's name, size, and type. The largest upload we accept is 20 MB.
  • Our AI provider receives only the institution, account type, balance, statement date, and holdings our server read. It never receives the file, its raw text, or any account number.
  • The account details we read from a file are automatic and may be wrong. We do not check them with your bank or broker.
  • Because file names and text documents can contain personal details, please name files simply and remove passwords, PINs, full account numbers, and Social Security numbers before uploading.
• Emails you send us at matt@halfacreresearch.tech, and our replies.

Information from purchases

• Products are sold one at a time through PayPal, including research modules, packs, and bots. PayPal sends us your name, email address, transaction ID, the item purchased, the amount, and the payment status. Your card and bank details stay with PayPal.
• We keep a record of what you bought and unlocked.

Information collected automatically

• Our web host, Hostinger, logs your IP address, browser type, and the pages you request.
• Your browser stores data on your device (local storage) to remember your session. After you tap the emailed sign-in button, open the private page link, or enter the backup 6-digit code, we set a secure cookie that keeps that browser signed in for 30 days. You can sign out a browser from your page at any time.
• We keep a log of each time your statement data is opened (who opened it, when, and from what IP address). The log never contains the data itself.
• Some pages load fonts from Google Fonts, which means your browser connects to Google's servers.
• We do not use advertising pixels or third-party analytics on client pages.

3. How we use information

We use personal information to:

• create and run your account and client page, and email you your private page link;
• provide AI responses and research based on what you choose to share;
• deliver purchases and unlocks;
• process payments, refunds, and payment disputes;
• keep the service secure and prevent fraud and abuse;
• answer your questions and send account messages and receipts;
• meet our legal, tax, and accounting obligations; and
• with your permission, send you updates.

Phone numbers. We use your phone number to contact you about your account. We will not send you marketing text messages, or make autodialed or prerecorded marketing calls, unless you separately agree in writing.

No training by us. We do not use your chats or uploads to train AI models.

4. Who we share information with

We share personal information only with service providers that help us run Halfacre Research, and only as needed to provide the service:

• xAI, our outside AI provider. Your chat messages, the names of files you upload, and the summary our server read from an upload (institution, account type, balance, statement date, and holdings: symbol, name, quantity, and value) are sent to xAI so the AI on your page can respond. We never send xAI the uploaded file, its raw text, or any account number, and we remove long numbers (such as account or card numbers) from chat messages before they are sent. Under xAI's published business terms:
  • xAI processes this content on our behalf. It does not use it to train its AI models.
  • Depending on our account's settings, xAI either deletes it as soon as the response is delivered, and in any case within one hour (xAI's "Zero Data Retention" setting), or stores it encrypted for up to 30 days to monitor for abuse and misuse, and then deletes it.
  • Without Zero Data Retention, xAI may keep content longer if the law requires it or if it is reasonably needed for safety, security, or investigating a suspected violation of xAI's terms. xAI may also create aggregated or de-identified data that cannot identify you.
  • Learn more: xAI Enterprise Terms, xAI Data Processing Addendum, xAI Privacy Policy.
• PayPal, our only payment processor. PayPal's Privacy Statement explains how PayPal handles your information.
• Hostinger, which hosts our website and servers.
• Our email service provider, which sends sign-up, private-link, and receipt emails.
• Others when required: to comply with the law or legal process, to protect rights and safety, or as part of a merger, acquisition, or sale of our business. We will notify you if your information is transferred in a sale.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as California law defines those terms.

5. Your private page link

• Your client page opens from a private link that we send to the email address on your account. That email leads with Tap this button to sign in. Tapping the button, or opening the private page link, signs that browser in so you can see your statement data. A 6-digit code is in the same email as a backup if the button does not finish. Codes expire after 20 minutes and work once. After sign-in, that browser stays signed in for 30 days unless you sign it out. Anyone with that email can open your page and statements, so keep it private.
• Don't forward the email or post the link, and be careful on shared or public computers.
• Lost your link? Enter your email on the sign-up page. If it matches an account, we will email the link to that address only.
• If you think someone else has your link, email matt@halfacreresearch.tech right away with the subject "Secure my page," and we will take steps to secure it, such as replacing your link.
• Please think carefully before uploading sensitive documents, and remove account numbers and Social Security numbers first.

6. How long we keep information

Who is responsible. Matthew Halfacre is the person responsible for protecting your information at Halfacre Research. Contact him at matt@halfacreresearch.tech.

• Uploaded files: stored encrypted with a key that belongs to your account alone, until you delete them or close your account. Deleting an upload, or using "Delete my statement data," also deletes the stored file.
• Statement data (what our server read from your uploads: file name, size, type, upload time, institution, account type, last four digits of the account number, balance, statement date, and holdings): stored encrypted with a key that belongs to your account alone, until you delete it or close your account.
• Deleting your statement data: use "Delete my statement data" on your page, or the Delete button next to any one upload, or email matt@halfacreresearch.tech with the subject "Privacy request." Deleting destroys your account's encryption key and overwrites the stored data, so it cannot be read back.
• Statement access log (who opened your statement data and when; never the data itself): kept as long as we keep your statement data, so we can check who has looked at it.
• Account details (name, email, phone): while your account is open, then deleted within 12 months after it is closed, unless the law requires us to keep them longer.
• Chat records: only as long as needed to provide your page, and deleted no later than 12 months after your last activity, or sooner if you ask.
• Purchase records: 7 years, for tax and accounting purposes.
• Server logs: according to our web host's standard log retention.
• What we send to xAI: xAI's retention of what we send it is described in Section 4.

7. How we protect information

We use administrative, technical, and physical safeguards. These include encryption in transit (HTTPS); encryption at rest for statement data (each client's data is sealed with that client's own key, which is itself encrypted with a key kept outside the public website) and for saved exchange keys; an emailed sign-in link (or a 6-digit backup code) before anyone can see statement data; multi-factor sign-in for Halfacre staff before they can use our admin desk; a log of who opens statement data; long random page links that are never published; instructions that tell search engines not to index client pages; and keeping API keys out of public code. Only you, and Halfacre staff who have signed in with multi-factor authentication, can see your statement data. No system is perfectly secure.

Data breaches. If your statement data or other personal information is breached:

• we will notify you by email or mail without unreasonable delay, and no later than 45 days after we determine the breach happened;
• if more than 1,000 people are affected, we will also notify the Alabama Attorney General; and
• if unencrypted information of 500 or more people is involved, we will notify the Federal Trade Commission within 30 days of discovering it.

These commitments follow the Alabama Data Breach Notification Act of 2018 (Ala. Code § 8-38-1 et seq.) and the FTC Safeguards Rule (16 CFR 314.4(j)).

8. Your choices and rights

• You can ask us to access, correct, download, or delete your personal information, or to stop marketing to you. Email matt@halfacreresearch.tech with the subject "Privacy request." We will verify your request, usually by replying to the email address on your account, and respond within 45 days.
• You can unsubscribe from marketing emails at any time using the link in the email.
• California residents: if the California Consumer Privacy Act applies to us, you have the right to know, delete, and correct your personal information; to opt out of its sale or sharing (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
• Texas residents: if the Texas Data Privacy and Security Act applies to us, you may confirm, access, correct, delete, and get a copy of your personal data, and opt out of targeted advertising, sale, and certain profiling. If we deny your request, you may appeal by replying to our decision, and we will respond within 60 days. If your appeal is denied, you may contact the Texas Attorney General.
• Residents of other states with privacy laws may make the same requests, and we will honor them as those laws require.

9. Children

Our services are for adults 18 and older. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

10. Changes to this policy

We will post any update on this page and change the date at the top. If a change is material, we will tell you by email or on your client page before it takes effect.

11. Contact us

Halfacre Research · matt@halfacreresearch.tech