Privacy Policy

Heading is operated by Heading AI Limited ("Heading", "we", "us", "our"), a company registered in England and Wales under company number 17241813, with its registered office at 124-128 City Road, London, England, EC1V 2NX.

This Privacy Policy explains how we collect, use, store, and share personal data when you visit useheading.com, use our AI search visibility platform ("Service"), or otherwise interact with us. It applies to website visitors, people who join our waitlist, registered users, and members of teams that use the Service.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For most of the personal data described in this policy — your account details, billing information, usage data, and the data we collect when you visit our website — Heading is the data controller. We decide how and why that data is processed.

For some data, we act as a data processor on behalf of our customers, who remain the controller. This applies where a customer uses features that bring their own contacts' or prospects' personal data into the Service — for example, prospect capture forms, lead and conversion webhooks, or connecting their own Google Analytics property. We process that data only to provide the Service and on the customer's instructions.

If your data was submitted to Heading through a form, report, or integration operated by one of our customers (for example, an agency using our platform), that customer is the controller of your data. Please direct privacy requests to them; we will assist them in responding.

We collect the following categories of personal data:

We process personal data for the following purposes, relying on the lawful bases shown:

• Providing and operating the Service, including AI visibility monitoring, scoring, and reporting — performance of a contract
• Managing your account, team memberships, and sign-in — performance of a contract
• Processing payments and managing subscriptions — performance of a contract and compliance with legal obligations
• Sending service communications such as account alerts, billing notices, weekly digests, and security notifications — performance of a contract and legitimate interests
• Sending product updates and marketing to business contacts, with the ability to opt out at any time — legitimate interests, or consent where required
• Providing customer support, including live chat — legitimate interests
• Analysing how the Service is used so we can improve it — legitimate interests
• Detecting and preventing fraud, abuse, and security incidents — legitimate interests and compliance with legal obligations
• Complying with legal obligations, including tax and accounting requirements — compliance with legal obligations

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can object to any processing based on legitimate interests — see section 10.

The core of the Service is collecting and analysing publicly available answers produced by third-party AI platforms. Those answers sometimes mention individuals — for example, a company founder, author, or spokesperson named in an answer about a brand.

We process this data under our legitimate interests (and those of our customers) in monitoring how brands are represented in AI-generated answers. We store the answers as generated by the AI platform; we do not enrich them with additional personal data, use them to build profiles of individuals, or use them for advertising.

If you believe an AI answer stored by Heading contains personal data about you and want it reviewed or removed, contact us at privacy@useheading.com. Note that we have no control over the AI platforms themselves — removing data from Heading does not change what an AI platform generates. To correct or remove the underlying answer, you will need to contact the relevant platform provider.

We do not sell personal data. We share it only in the following circumstances:

• Service providers — third parties that help us operate the Service, listed below. Each processes data on our behalf under a data processing agreement.
• Your team — your name, email address, and activity within the Service are visible to other members of your team, as you would expect from a collaborative product.
• Professional advisors — lawyers, accountants, and insurers where reasonably necessary.
• Legal requirements — where required by law, regulation, legal process, or an enforceable government request.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with notice to affected users where required.

Our current service providers are: Vercel (hosting, content delivery, file storage, web analytics, and AI gateway — US), Neon (database hosting — US), Stripe (payment processing — US), Inngest (background job processing — US), Resend (transactional email delivery — US), PostHog (product analytics, hosted in the EU), Google (sign-in and Google Analytics — US), Intercom (customer support chat — US), Anthropic (AI analysis of collected answers — US), DataForSEO (retrieval of AI platform answers and search data — US), and Cloudflare (bot protection on public forms — US).

We will update this list as our providers change. Material changes will be reflected in an updated version of this policy.

We are based in the United Kingdom, but several of our service providers process data in the United States and other countries outside the UK.

Where we transfer personal data outside the UK, we rely on one or more of the following safeguards: UK adequacy regulations (including the UK-US Data Bridge where the recipient is certified), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses.

We keep personal data only for as long as we need it for the purposes described in this policy:

• Account data — kept while your account is active. If you delete your account, it is deactivated immediately and permanently deleted after a 14-day grace period, during which you can restore it.
• Monitoring configuration and AI answer data — kept while the associated team account is active, then deleted or anonymised after account deletion. Anonymised, aggregated monitoring data (with no personal data) may be retained for benchmarking.
• Billing records — kept for 6 years after the relevant transaction to meet UK tax and accounting obligations.
• Usage and technical data — kept in identifiable form only as long as needed for analytics and security, then deleted or anonymised.
• Support conversations — kept while your account is active and for a reasonable period afterwards so we can handle follow-up queries.
• Waitlist data — kept until launch communications are complete or you ask us to remove you, whichever is sooner.

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit (TLS) and at rest
• Access controls and authentication on all systems, with role-based access within teams
• Encryption of third-party integration credentials at rest
• Data processing agreements with all service providers
• Incident response procedures, including notifying the ICO and affected users of reportable breaches without undue delay

No system is completely secure. Use a strong, unique password and keep your account credentials confidential.

Under the UK GDPR, you have the following rights over personal data we hold about you as a controller:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data, subject to legal retention requirements
• Restriction — request that we limit processing in certain circumstances
• Portability — receive the data you provided to us in a structured, machine-readable format
• Objection — object to processing based on legitimate interests, including direct marketing
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@useheading.com. We will respond within one month. We may ask you to verify your identity before acting on a request. If we cannot fulfil a request, we will explain why.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

We use cookies and similar technologies in three categories:

• Essential — session cookies that keep you signed in and protect the Service against abuse. The Service does not work without them.
• Analytics — Google Analytics, PostHog (EU-hosted), and Vercel Analytics help us understand how the website and Service are used. Signed-in users may be identified in our product analytics so we can understand feature usage and improve the Service.
• Support — Intercom sets a cookie so that live chat conversations persist between visits.

We do not use advertising cookies and we do not share cookie data with ad networks. You can block or delete cookies through your browser settings; blocking essential cookies will prevent parts of the Service from working.

The Service is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. For material changes we will notify registered users by email or through the Service before the changes take effect. The date at the top of this page shows when the policy was last updated.

Questions about this policy or how we handle your data? Contact us:

• Email: privacy@useheading.com
• Post: Heading AI Limited, 124-128 City Road, London, England, EC1V 2NX

We aim to respond to privacy enquiries within 5 working days.