Introduction
At Heading ("we", "us" or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website at useheading.com, apply for access, use the Heading platform, API and related services (the Services), or otherwise interact with us.
Heading is operated by Heading AI Limited, a company registered in England and Wales with company number 17241813 whose registered office is at 124-128 City Road, London, England, EC1V 2NX. We are registered with the Information Commissioner's Office (ICO) under registration number ZC240573.
Heading provides an AI search visibility and workflow platform to brands, marketing teams and agencies. Our customers use it to research the questions buyers ask AI platforms, track how their brands appear in AI answers, analyse crawler and traffic data, and turn findings into tasks and reports.
We are committed to complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR).
Please take the time to read this Privacy Policy carefully. We keep it under regular review, and you can see the date it was last updated above. If you have any questions, please contact us using the details in the 'Contact us' section below.
Our role: controller or processor?
This Privacy Policy applies where we act as a data controller, meaning we decide how and why your personal data is used. That is the case for:
visitors to our website and blog;
people who apply for access, join our waitlist or contact us;
account holders, team members and other authorised users of the Services; and
people who receive marketing communications from us.
Our customers also submit data to the Services and connect third-party sources such as Google Analytics and server logs. Where that data contains personal data (for example, the IP addresses of visitors to a customer's website, or names that appear in an AI answer), we process it as a data processor on our customer's instructions. That processing is governed by our Data Processing Terms with the customer, not by this Privacy Policy. If you have questions about how a Heading customer uses your data, please contact that customer directly.
Some agencies make the Services available to their own clients under the agency's own branding. If you access the Services through an agency's branded platform, the agency is responsible for its own use of your personal data and should be your first point of contact. This Privacy Policy still applies to any personal data that we process as a controller in providing the Services.
1. What personal data do we collect?
Personal data is data that relates to you and identifies you, or can be used to identify you. This might be your name, email address, or digital identifiers such as cookies, IP addresses or logs.
The types of personal data we collect include:
1.1 Account and contact data
Name, email address, job title and company name
Login credentials (passwords are stored in hashed form and are never visible to us)
Workspace, team and role information
Profile details you choose to add
1.2 Waitlist and enquiry data
Name, email address, company, website and role
Information you give us about your business, your use of AI search and why you would like access
Records of our correspondence with you
1.3 Billing data
Billing contact name, address and VAT or tax details
Payment card or bank details, which are collected and stored by our payment processor (Stripe) and not by us. We receive confirmation of payment, the last four digits of your card and your billing history.
1.4 Data you enter into the Services
Brand names, competitor names, domains, prompts, objectives, tasks, notes and documents you or your team enter into the platform
Messages and questions you send to the Heading Agent, and its responses
Data from sources you connect to the Services, such as Google Analytics 4 properties or server log streams
Most of this is business data rather than personal data. Where it contains personal data about people other than you, we generally act as a processor for our customer as explained above.
1.5 Automatically collected data
When you access our website or the Services, we may collect:
Device information: IP address, browser type and version, operating system, device identifiers and screen settings
Usage data: pages visited, features used, actions taken in the platform, timestamps, referring URLs and error reports
Cookies and similar technologies: as described in the 'Cookies' section below
1.6 Marketing data
Your marketing preferences and consents
Records of emails we have sent you and whether they were opened or clicked
We do not knowingly collect special category data (such as health, ethnicity, religion or political opinions) and we ask you not to enter it into the Services.
We may also aggregate and anonymise personal data to form statistical data (Aggregated Data), for example to calculate the percentage of users accessing a particular feature or to produce industry benchmarks about AI search visibility. Aggregated Data is not personal data and does not reveal your identity. If we combine Aggregated Data with your personal data so that it can identify you, we treat the combined data as personal data under this Privacy Policy.
2. How do we collect your personal data?
Directly from you: when you apply for access, create an account, enter data into the Services, contact us, attend a demo or respond to a survey.
From your organisation: when a colleague or your agency invites you to a workspace or adds you as a team member.
From connected sources: when you connect a third-party account or data source to the Services, subject to your authorisation and the third party's terms.
Automatically: through cookies, logs and similar technologies when you use our website or the Services.
From third parties: such as our payment processor, business contact databases, LinkedIn and other publicly available sources, and partners who introduce you to us.
3. How do we use your personal data?
We process personal data for the following purposes:
| What we use your personal data for | What personal data we use | Our lawful basis for processing |
|---|---|---|
| To review your application for access and manage our waitlist | Waitlist and enquiry data | Steps prior to entering into a contract; legitimate interests (managing demand for the Services) |
| To create and administer your account and provide the Services | Account and contact data, data you enter into the Services, automatically collected data | Performance of a contract |
| To take payment and manage billing | Billing data, account data | Performance of a contract; legal obligation (accounting and tax records) |
| To provide support and respond to your enquiries | Account and contact data, correspondence | Performance of a contract; legitimate interests (responding to enquiries) |
| To send service communications, such as changes to our terms, security notices and product updates that affect your account | Account and contact data | Performance of a contract; legal obligation |
| To improve, develop and secure the Services, including analytics, testing and troubleshooting | Automatically collected data, usage data | Legitimate interests (improving and protecting our Services) |
| To send marketing communications about Heading, our features and content | Contact and marketing data | Consent, or legitimate interests where the 'soft opt-in' applies (see section 10) |
| To monitor for fraud, abuse and breaches of our terms | IP address, login and usage data | Legitimate interests (protecting the Services and other users) |
| To comply with legal obligations and respond to lawful requests | Any relevant personal data | Legal obligation |
| To manage our business, including obtaining advice and defending legal claims | Any relevant personal data | Legitimate interests (running our business) |
We do not use personal data for automated decisions that have a legal or similarly significant effect on you.
4. How does Heading use AI?
The Services use artificial intelligence in two main ways:
Tracking AI platforms. To show how brands appear in AI answers, the Services run prompts against third-party AI platforms, such as AI assistants and AI search engines, and collect the answers they return. We may collect these answers directly or through specialist third-party data providers.
Our own analysis and agent features. We use large language models from third-party AI providers, accessed directly or through an AI gateway service, to analyse the answers collected, assess sentiment, generate summaries and recommendations, and power the Heading Agent.
Where you enter data into the Services or use the Heading Agent, the relevant content is sent to our AI providers so that they can process it for us. We only send what is needed for the feature you are using. The terms on which we use those providers do not allow them to use your data to train their models, and we do not use your personal data to train general-purpose AI models ourselves.
Our AI Policy explains in more detail how we use AI and the safeguards we apply. The providers we currently use are listed in our sub-processor list at docs.useheading.com/legal/sub-processors.
6. How do we protect your data?
We have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include encrypting data when we store it and when we send it across the internet, role-based access controls, logging and monitoring, regular backups, and secure development practices. We limit access to your personal data to those employees, contractors and service providers who have a business need to access it.
Where we have given you (or you have chosen) a password, you are responsible for keeping it confidential. Please do not share your password or API keys with anyone. We recommend enabling any additional security features we make available.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.
7. How long do we keep your data?
We only keep your personal data for as long as reasonably necessary to fulfil the purposes set out in this Privacy Policy and to comply with our legal and regulatory obligations. The exact period depends on your relationship with us and the type of data, for example:
Account data: for as long as your account is active and for up to 12 months afterwards, so that you can reactivate your account and we can deal with any queries.
Data you enter into the Services: for the duration of your subscription. After your account is closed, you may export your data for 30 days, after which we delete it from live systems and it is removed from backups in the ordinary cycle.
Waitlist and enquiry data: for up to 24 months from your last interaction with us, unless you become a customer.
Billing records: for six years after the end of the financial year to which they relate, to comply with tax and accounting law.
Marketing data: until you unsubscribe or object, and for a short period afterwards to record your preference.
Logs and usage data: typically for up to 12 months, unless needed for a longer period for security or legal reasons.
If an account is inactive for 24 months, we will notify the account holder before deleting it.
8. International data transfers
Countries outside the UK and the European Economic Area (which means all EU countries plus Norway, Iceland and Liechtenstein, together the EEA) may have a lower standard of protection for personal data than that required by UK and EEA data protection laws. The information we collect from you may be transferred to, and stored and processed outside the UK and EEA, including in the United States, by our service providers.
If we transfer your data to a provider based outside the UK and EEA, we will take steps to make sure your personal data is handled in line with UK and European data protection law by relying on an adequacy decision or by implementing appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. If you would like more detail on the specific mechanism used to transfer your personal data, please contact us using the details in the 'Contact us' section below.
A summary of our regular data transfers is set out below:
| Country or region | Purpose for the transfer | Safeguard used |
|---|---|---|
| United Kingdom | Business administration, support and marketing tools | Not applicable (no transfer) |
| European Union | Hosting and SaaS tools used to run our business | Adequacy regulations |
| United States | Cloud hosting and database services; AI model providers; payment processing; email, analytics and support tools | UK Extension to the EU-US Data Privacy Framework where the provider is certified; otherwise the UK International Data Transfer Agreement or Addendum, or EU Standard Contractual Clauses, plus encryption |
9. Your rights
Under UK GDPR, EU GDPR and applicable privacy laws, you have the following rights in relation to your personal data:
Access: request a copy of the personal data we hold about you.
Correction: ask us to update inaccurate or incomplete data.
Deletion: ask us to erase your personal data where there is no good reason for us to continue processing it.
Restriction: ask us to limit how we use your data in certain circumstances.
Objection: object to processing based on our legitimate interests, and object at any time to direct marketing.
Data portability: receive the data you provided to us in a structured, commonly used and machine-readable format.
Withdraw consent: where we rely on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at support@useheading.com. We may need to verify your identity before responding. We will normally respond within one month, and we will not charge a fee unless your request is clearly unfounded or excessive.
If you are not happy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to your local supervisory authority. We would appreciate the chance to deal with your concerns first, so please contact us before you do.
10. Marketing and opting out
We may send marketing communications by email with information about Heading, new features, content and events we think you may be interested in. We will do so where we have appropriate marketing permissions from you. You can check or change your preferences, and opt out, at any time by clicking the unsubscribe link in any marketing email or by contacting us.
There may be circumstances where we can lawfully send marketing messages without your express consent, for example where you have enquired about or purchased the Services and it is in our legitimate interests to tell you about similar services. This is known as the 'soft opt-in'.
We will get your express opt-in consent before we share your personal data with any other company for its own marketing purposes.
Even if you have opted out of marketing communications, we may still need to send you service communications from time to time, either because we are legally required to do so or to provide you with important updates about your account or the Services.
12. Children
The Services are designed for businesses and are not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Third-party websites
Our website and the Services contain links to third-party websites, including the sources cited in AI answers. We do not control those websites and are not responsible for their privacy practices. Please read the privacy policy of any website you visit.
14. Updates to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on our website and change the date at the top. If we make significant changes, we will let you know by a notice on our website or in the Services, or by email where appropriate.
15. Contact us
For any questions about this Privacy Policy or to exercise your rights, please contact us:
Email: support@useheading.com
Post: Heading AI Limited, 124-128 City Road, London, England, EC1V 2NX, United Kingdom
Thank you for taking the time to review our Privacy Policy.