Privacy Policy — version 2026-10-16

Privacy Policy

Controller: HEADING Global Intelligence LLC

1. Who we are

HEADING (“we”, “our”, “us”) operates the HEADING relocation-finance intelligence platform at tryheading.app. We are the data controller for personal data collected through this service.

Contact: [email protected] [mailto:[email protected]]

2. What data we collect

Account data: Name, email address, hashed password (bcrypt). Google OAuth users: name and email provided by Google.

Profile data: Household composition, domain, seniority, income bracket, housing preferences, and lifestyle priorities entered in the analysis wizard. This data is used solely to generate your relocation analysis and is not shared.

Usage data: Number of analyses run, tier, subscription status, and timestamps. Used for billing and usage-limit enforcement.

Payment data: Handled entirely by Stripe. We store only your Stripe customer ID — no card numbers or payment credentials are ever held on our servers.

Technical data: IP address hash (not raw IP) used for share-link access tracking. Error logs and anonymised performance metrics.

Support data: Messages you send through the support system.

Waitlist data: If you join our launch waitlist: your email address, the page or campaign you signed up from, the time you signed up and confirmed, and, if you unsubscribe, the time you did so. You can also tell us which country you live in; if you leave it blank, the form may pre-fill a country based on your connection, and we store that country only if you submit the form. We store the country, not your IP address. We send a confirmation email first (double opt-in); you are only added to the launch list once you click the link in it.

3. How we use your data

Purpose | Legal basis (GDPR Art. 6)

Deliver the service (run analyses, store reports) | Performance of contract (Art. 6.1.b)

Billing and subscription management | Performance of contract (Art. 6.1.b)

Prevent abuse (rate limiting, fraud detection) | Legitimate interests (Art. 6.1.f)

Error monitoring and platform reliability | Legitimate interests (Art. 6.1.f)

Respond to support requests | Performance of contract (Art. 6.1.b)

Aggregate, anonymised analytics (conversion funnels) | Legitimate interests (Art. 6.1.f)

Legal compliance (tax, financial regulation) | Legal obligation (Art. 6.1.c)

Waitlist: send your confirmation email and the early-access updates you signed up for | Consent (Art. 6.1.a), confirmed by double opt-in; withdraw anytime with the unsubscribe link in any email

We do not sell personal data. We do not use your data for advertising profiling or automated individual decision-making with legal effect.

4. Data sharing and sub-processors

Your account, profile, and analysis data is stored in the European Union (Frankfurt, Germany). Some processing — AI report generation, payments, and email delivery — occurs in the United States under the safeguards listed below. Each provider’s place of incorporation is listed separately from where your data is actually stored and processed.

Sub-processor | Purpose | Incorporated | Data storage / processing | Transfer safeguard

Neon Inc. | PostgreSQL database hosting | United States | EU (Frankfurt) | DPF / SCCs

Vercel Inc. | Application hosting and serverless compute | United States | Compute: EU (Frankfurt); global CDN; build infrastructure in the US | DPF

Sentry Inc. | Error monitoring and crash reporting | United States | EU (Frankfurt) | DPF

PostHog Inc. | Product analytics (conversion funnels) | United States | EU (Frankfurt) | SCCs

Anthropic PBC | AI model inference (analysis pipeline) | United States | United States | SCCs

Stripe Inc. | Payment processing and subscription management | United States | United States / global | DPF

Resend Inc. | Transactional email delivery | United States | United States | SCCs

Upstash Inc. | Job queue (QStash) and Redis rate-limiting | United States | EU (Frankfurt) | SCCs

Google LLC | OAuth authentication (optional) | United States | United States / global | DPF

Where data is processed in the United States, transfers rely on the EU–US Data Privacy Framework (DPF) or standard contractual clauses (SCCs).

5. Data retention

Account data: Retained until you delete your account or request erasure.

Analysis data: Retained until deleted by you or until account deletion.

Support messages: Retained for 3 years after case closure for quality and legal compliance purposes.

Billing records: Retained for 7 years to comply with financial regulations.

Error logs: Anonymised after 90 days; deleted after 1 year.

Waitlist data: Kept until you ask us to delete it. If you unsubscribe, we stop emailing you and keep your address on a suppression record so we do not email you again; email [email protected] [mailto:[email protected]] to have it erased.

Shared city cache: City-level cost-of-living data is stored in a shared cache for up to 270 days. This data contains no personal information — it is aggregated research about geographic locations, not about individual users.

6. Your rights (GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

Access (Art. 15): Request a copy of your personal data.

Rectification (Art. 16): Correct inaccurate data.

Erasure (Art. 17): Delete your account and all associated data. Use the “Delete account” option in Settings, or email us.

Restriction (Art. 18): Request that we limit processing of your data.

Data portability (Art. 20): Receive your data in a structured, machine-readable format.

Objection (Art. 21): Object to processing based on legitimate interests.

Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email [email protected] [mailto:[email protected]] or use the self-service options in your account Settings [/settings]. We will respond within 30 days.

You have the right to lodge a complaint with your local supervisory authority (EEA directory: edpb.europa.eu → members [https://edpb.europa.eu/about-edpb/about-edpb/members_en]).

7. Cookies and tracking

We use a small number of first-party cookies and browser-storage items — authentication (NextAuth session/CSRF/callback cookies) and, only with your permission, privacy-friendly analytics (PostHog, EU-hosted, no analytics cookie). See the full inventory, grouped by category, on our /cookies page.

See the full inventory — every cookie and browser-storage item we set, why, and for how long — on our Cookies page [/cookies]. You can change your analytics choice anytime via “Cookie settings” in the footer, or in Settings [/settings] if you’re signed in.

8. Children

HEADING is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us for immediate deletion.

9. Security

We implement industry-standard technical and organisational measures: TLS encryption in transit, bcrypt password hashing, serverless architecture with minimal attack surface, error monitoring, rate limiting, and security headers (CSP, HSTS, X-Frame-Options). Stripe handles all payment security under PCI-DSS Level 1 compliance.

10. Changes to this policy

We may update this policy when our practices change. Material changes will be notified by email to registered users at least 14 days before taking effect. The effective date above reflects the latest revision.

Version | Date | Summary of changes

2026-10-16 | 16 October 2026 | No change to what the policy says: versions are now dated (the previous labels 1.0 and 1.1 are retired) and the version block is shared with the other legal pages.

2026-10-11 | 11 October 2026 | Added launch-waitlist data: what we collect, the consent basis, and retention.

2026-08-07 | 7 August 2026 | Controller shown as HEADING Global Intelligence LLC (registered; "in formation" removed).

2026-08-01b | 1 August 2026 | Platform descriptor updated; supervisory-authority wording made neutral (EEA directory).

2026-08-01 | 1 August 2026 | Controller changed from the planned Dutch company to HEADING Global Intelligence LLC (in formation).

2026-07-10 | 10 July 2026 | Cookies section replaced: first-party cookies and browser storage by category, with a link to the full inventory on the Cookies page.

2026-07-06b | 6 July 2026 | Wording change in the data-subject-rights section (DSAR intake).

2026-07-06 | 6 July 2026 | Version number, effective date and changelog table added to the policy.

2026-07-05b | 5 July 2026 | Privacy contact address changed to [email protected].

2026-07-05 | 5 July 2026 | Sub-processor table rewritten: place of incorporation split from where data is stored and processed; PostHog and Resend added.

2026-07-04 | 4 July 2026 | Sentry sub-processor location corrected to EU (Frankfurt).

2026-06-03b | 3 June 2026 | Rebrand from TERRA to HEADING; controller still a Dutch company in formation.

2026-06-03 | 3 June 2026 | Initial policy (published under the TERRA name; controller named as a Dutch company in formation).

11. Contact

HEADING Global Intelligence LLC

Email: [email protected] [mailto:[email protected]]

For erasure requests, use Settings → Delete account, or email us with subject “GDPR Erasure Request”.