Privacy Policy — version 2026-11-11

Privacy Policy

Controller: HEADING Global Intelligence LLC

1. Who we are

HEADING (“we”, “our”, “us”) operates the HEADING relocation-finance intelligence platform at tryheading.app. We are the data controller for personal data collected through this service.

Contact: [email protected] [mailto:[email protected]]

2. What data we collect

Account data: Name, email address, hashed password (bcrypt). Google OAuth users: name and email provided by Google.

Profile data: What you enter in the analysis wizard: household composition, the age bands of any children, your profession, seniority and employment type, your income as the figure you type in (and your partner’s, if you add it), your healthcare plan type and monthly premium, housing preferences and a target home price if you give one, your home city, and lifestyle priorities. We use it only to generate your relocation analysis. We disclose it to the service providers that help us do that (see section 4 — in particular Anthropic, which generates the report from it, and our hosting and database providers). We do not sell or share it. It is shared with anyone else only if you create a share link for a report.

Usage data: Number of analyses run, tier, subscription status, and timestamps. Used for billing and usage-limit enforcement.

Payment data: Handled entirely by Stripe. We store only your Stripe customer ID — no card numbers or payment credentials are ever held on our servers.

Technical data: IP address hash (not raw IP) used for share-link access tracking. Error logs and performance metrics.

Analytics data: While analytics is on (see section 7): the pages you view, product events such as starting or finishing an analysis, and the campaign or referrer of your first visit. While you are signed in these events are tied to your account (account ID, email address and plan tier) at our analytics provider, PostHog. This is not anonymous. Analytics is off if you decline it, and in the United States for browsers that send a Global Privacy Control or Do Not Track signal (section 12).

Support data: Messages you send through the support system.

Waitlist data: If you join our launch waitlist: your email address, the page or campaign you signed up from, the time you signed up and confirmed, and, if you unsubscribe, the time you did so. You can also tell us which country you live in; if you leave it blank, the form may pre-fill a country based on your connection, and we store that country only if you submit the form. We store the country, not your IP address. We send a confirmation email first (double opt-in); you are only added to the launch list once you click the link in it. Sign-ups you do not confirm within 30 days are deleted.

3. How we use your data

Purpose | Legal basis (GDPR Art. 6)

Deliver the service (run analyses, store reports) | Performance of contract (Art. 6.1.b)

Billing and subscription management | Performance of contract (Art. 6.1.b)

Prevent abuse (rate limiting, fraud detection) | Legitimate interests (Art. 6.1.f)

Error monitoring and platform reliability | Legitimate interests (Art. 6.1.f)

Respond to support requests | Performance of contract (Art. 6.1.b)

Product analytics tied to your account while you are signed in (conversion funnels, feature use) | Legitimate interests (Art. 6.1.f); where the law requires your permission first, consent

Legal compliance (tax, financial regulation) | Legal obligation (Art. 6.1.c)

Waitlist: send your confirmation email and the early-access updates you signed up for | Consent (Art. 6.1.a), confirmed by double opt-in; withdraw anytime with the unsubscribe link in any email

We do not sell or share your personal data (as “sell” and “share” are defined in US state privacy laws, which include sharing for cross-context behavioural advertising). We do not use your data for advertising profiling or automated individual decision-making with legal effect.

4. Data sharing and sub-processors

Your account, profile, and analysis data is stored in the European Union (Frankfurt, Germany). Some processing — AI report generation, payments, and email delivery — occurs in the United States under the safeguards listed below. Each provider’s place of incorporation is listed separately from where your data is actually stored and processed.

Sub-processor | Purpose | Incorporated | Data storage / processing | Transfer safeguard

Neon Inc. | PostgreSQL database hosting | United States | EU (Frankfurt) | DPF / SCCs

Vercel Inc. | Application hosting and serverless compute | United States | Compute: EU (Frankfurt); global CDN; build infrastructure in the US | DPF

Sentry Inc. | Error monitoring and crash reporting | United States | EU (Frankfurt) | DPF

PostHog Inc. | Product analytics (conversion funnels) | United States | EU (Frankfurt) | SCCs

Anthropic PBC | AI model inference (analysis pipeline) | United States | United States | SCCs

Stripe Inc. | Payment processing and subscription management | United States | United States / global | DPF

Resend Inc. | Transactional email delivery | United States | United States | SCCs

Upstash Inc. | Job queue (QStash) and Redis rate-limiting | United States | EU (Frankfurt) | SCCs

Google LLC | OAuth authentication (optional) | United States | United States / global | DPF

Where data is processed in the United States, transfers rely on the EU–US Data Privacy Framework (DPF) or standard contractual clauses (SCCs).

No AI training. We do not use your questionnaire answers or your reports to train or fine-tune any AI model, and our AI provider is contractually barred from using them to train its models.

5. Data retention

Account data: Retained until you delete your account or request erasure.

Questionnaire answers and reports (analysis data): Deleted when you delete the analysis or your account (Settings → Delete account), or on request. Otherwise they are deleted automatically 2 years after the analysis for free (Scout) analyses and 7 years after for paid analyses, after four email notices (60, 30, 7 and 1 day before). Copies in our backups and with our sub-processors are kept for no more than 30 days after the deletion. This 30-day limit covers your questionnaire answers and reports only; the records below have their own periods and contain none of your answers or reports.

Support messages: Retained for 3 years after case closure for quality and legal compliance purposes.

Billing records: Records of purchases and refunds are retained for 7 years to comply with financial regulations. We keep your payment provider customer record for this, even after you delete your account.

Consent and acceptance records: The record of which Terms and Privacy Policy versions you accepted, your cookie and marketing choices, and the time and manner of each, kept for as long as your account exists and for 7 years after it closes or a consent is withdrawn, so we can show that you agreed. These records contain none of your questionnaire answers or reports.

Error logs: Anonymised after 90 days; deleted after 1 year.

Waitlist data: Kept until you ask us to delete it or unsubscribe, or until 12 months after you joined or last confirmed your interest, whichever comes first. You confirm your interest by confirming your sign-up or by clicking the link in the renewal email we send you about a month before the 12 months are up; if you do not, we delete your entry. Sign-ups you never confirm are deleted after 30 days. If you unsubscribe, we stop emailing you and keep your address on a suppression record so we do not email you again; email [email protected] [mailto:[email protected]] to have it erased.

Shared city cache: City-level cost-of-living data is stored in a shared cache for up to 270 days. This data contains no personal information — it is aggregated research about geographic locations, not about individual users.

6. Your rights (GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

Access (Art. 15): Request a copy of your personal data.

Rectification (Art. 16): Correct inaccurate data.

Erasure (Art. 17): Delete your account and all associated data. Use the “Delete account” option in Settings, or email us.

Restriction (Art. 18): Request that we limit processing of your data.

Data portability (Art. 20): Receive your data in a structured, machine-readable format.

Objection (Art. 21): Object to processing based on legitimate interests.

Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email [email protected] [mailto:[email protected]] or use the self-service options in your account Settings [/settings]. We will respond within 30 days.

If you live in the United States, see section 12 for your rights.

You have the right to lodge a complaint with your local supervisory authority (EEA directory: edpb.europa.eu → members [https://edpb.europa.eu/about-edpb/about-edpb/members_en]).

7. Cookies and tracking

We use a small number of first-party cookies and browser-storage items — authentication (NextAuth session/CSRF/callback cookies) and product analytics (PostHog, EU-hosted, no analytics cookie). Where the law requires your permission first, analytics stays off until you agree; elsewhere, for example in the United States, it runs until you opt out. See the full inventory, grouped by category, on our /cookies page.

See the full inventory — every cookie and browser-storage item we set, why, and for how long — on our Cookies page [/cookies]. You can change your analytics choice anytime via “Cookie settings” in the footer, or in Settings [/settings] if you’re signed in.

8. Children

HEADING is for people aged 18 or older and is not directed at anyone under 18. We ask you to confirm you are 18 or older when you sign up, and we do not knowingly collect personal data from anyone under 18. The age bands of children in your household that you enter in the wizard are information about your household that an adult gives us, not data collected from the children. If you believe a person under 18 has given us data, contact us and we will delete it.

9. Security

We implement industry-standard technical and organisational measures: TLS encryption in transit, bcrypt password hashing, serverless architecture with minimal attack surface, error monitoring, rate limiting, and security headers (CSP, HSTS, X-Frame-Options). Stripe handles all payment security under PCI-DSS Level 1 compliance.

10. Changes to this policy

We may update this policy when our practices change. Material changes will be notified by email to registered users at least 14 days before taking effect. The effective date above reflects the latest revision.

Version | Date | Summary of changes

2026-11-11 | 11 November 2026 | Minimum age is now 18. We state that we do not train AI models on your questionnaire answers or reports and that our AI provider may not either. Your questionnaire answers and reports are deleted on request or when you delete your account, with copies in backups and at sub-processors kept at most 30 days; billing (7 years), support (3 years) and the record of the Terms and Privacy Policy versions you accepted and your cookie and marketing choices (7 years after your account closes) keep their own periods. Corrections: income is the figure you enter, not an estimate; your answers go to the service providers that run HEADING for us (our AI provider, hosting and database) only so they can produce your estimates and reports on our instructions, and they may not use them for their own purposes; analytics is tied to your account and is not anonymous; we do not sell or share personal information; analyses are deleted automatically after 2 or 7 years. New: a US state privacy rights section (Do Not Track and Global Privacy Control honoured, your rights and how to use them, what we collect) and a waitlist retention period of 12 months from joining or your last confirmed interest (30 days if you never confirm).

2026-10-16 | 16 October 2026 | No change to what the policy says: versions are now dated (the previous labels 1.0 and 1.1 are retired) and the version block is shared with the other legal pages.

2026-10-11 | 11 October 2026 | Added launch-waitlist data: what we collect, the consent basis, and retention.

2026-08-07 | 7 August 2026 | Controller shown as HEADING Global Intelligence LLC (registered; "in formation" removed).

2026-08-01b | 1 August 2026 | Platform descriptor updated; supervisory-authority wording made neutral (EEA directory).

2026-08-01 | 1 August 2026 | Controller changed from the planned Dutch company to HEADING Global Intelligence LLC (in formation).

2026-07-10 | 10 July 2026 | Cookies section replaced: first-party cookies and browser storage by category, with a link to the full inventory on the Cookies page.

2026-07-06b | 6 July 2026 | Wording change in the data-subject-rights section (DSAR intake).

2026-07-06 | 6 July 2026 | Version number, effective date and changelog table added to the policy.

2026-07-05b | 5 July 2026 | Privacy contact address changed to [email protected].

2026-07-05 | 5 July 2026 | Sub-processor table rewritten: place of incorporation split from where data is stored and processed; PostHog and Resend added.

2026-07-04 | 4 July 2026 | Sentry sub-processor location corrected to EU (Frankfurt).

2026-06-03b | 3 June 2026 | Rebrand from TERRA to HEADING; controller still a Dutch company in formation.

2026-06-03 | 3 June 2026 | Initial policy (published under the TERRA name; controller named as a Dutch company in formation).

11. Contact

HEADING Global Intelligence LLC

Email: [email protected] [mailto:[email protected]]

For erasure requests, use Settings → Delete account, or email us with subject “GDPR Erasure Request”.

12. Your US state privacy rights

We give the rights below to every user, wherever in the United States you live, whether or not a state privacy law applies to us. This section is also our notice at collection for people in the United States.

We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Global Privacy Control and Do Not Track. We honour both. If you are in the United States and your browser sends a Global Privacy Control signal, or has Do Not Track turned on, we treat it as a request to opt out: optional analytics stays off for that browser and, if you are signed in, for your account. Outside the United States optional analytics is off until you agree, so these signals change nothing there. You can also switch analytics off or on at any time with “Cookie settings” in the footer.

Your rights. You can ask to know what personal information we hold about you and how we use it, to get a copy, to correct it, or to delete it. You can do most of this yourself in Settings [/settings] (Download my data, Delete account). Otherwise, email [email protected] [mailto:[email protected]]. We confirm receipt within 10 business days and respond within 45 days. If we need more time (up to 45 more days) we will tell you why.

Verification. If you are signed in, your account is your verification. Otherwise we match the request to the email address we hold and may ask you to confirm from that address. We never require you to create an account to make a request.

Authorised agents. Someone you authorise can make a request for you. We will ask for your signed permission and may ask you to confirm your identity directly.

No discrimination. Using these rights never changes your price, your access or the quality of the service.

Sensitive personal information. The only sensitive personal information we collect is your account login (email and password, stored as a bcrypt hash). We use it only to sign you in and keep your account secure. We do not use it to infer anything about you.

What we collected in the past 12 months. None of these categories is sold or shared.

Category | Examples we hold | Source | Purpose | Disclosed for a business purpose to | Retention

Identifiers | Name, email, account ID, payment provider customer ID, hashed IP (share links only) | You; your device | Account, service delivery, billing, security | Hosting and database (Vercel, Neon), payments (Stripe), email (Resend), analytics (PostHog: account ID and email, only while analytics is on) | Until you delete your account; billing records 7 years

Customer records: financial and health-insurance information | Your and your partner’s income, healthcare plan type and premium, target home price | You (wizard) | Producing your relocation analysis | AI processing (Anthropic), hosting and database | With the analysis: deleted after 2 years (free) or 7 years (paid), after four email notices; sooner if you delete it. Copies in backups and with sub-processors at most 30 days more

Characteristics of protected classifications | Age bands of children in your household; household composition | You (wizard) | Producing your analysis (schooling, childcare, food costs) | AI processing (Anthropic), hosting and database | As above

Commercial information | Plan, credits, purchases, analyses run | You; our payment provider | Billing, usage limits | Stripe, hosting and database | Billing records 7 years; the rest until you delete your account

Internet or network activity | Pages viewed, feature events, campaign or referrer of your first visit (only while analytics is on) | Your device | Product analytics | PostHog (EU) | Until you delete your account (which deletes your analytics profile); attribution is cleared when you turn analytics off

Geolocation (not precise) | Country of residence you declare; country or region from your connection, used only to choose which privacy notice to show | You; your connection | Residency check, choosing the privacy notice | Hosting | Declared country: until you delete your account. Connection country: not stored, except on the waitlist if you submit it

Sensitive personal information | Account login credentials | You | Authentication only | Hosting and database | Until you delete your account

Waitlist | Email, signup source, country, confirmation and unsubscribe times | You | Launch updates you asked for | Email (Resend), hosting and database | Until you ask us to delete it or unsubscribe, or 12 months after you joined or last confirmed your interest, whichever comes first; unconfirmed sign-ups 30 days. A suppression record of unsubscribed addresses is kept

Inferences | None drawn about you. The report is about cities, not a profile of you | - | - | - | -

We do not collect biometric information, precise location, government IDs, or citizenship or immigration status. Support messages you send are kept for 3 years after the case closes.