Cookies that sign you in and keep your session need no consent. Choose what else we may use. Privacy Policy
Last updated: 5 September 2026
The Service at heed.finance is operated by Heed ("Heed", "we", "us"). For personal data we process about you as a user, we are the data controller. For personal data that advisor-tier users enter about their own clients, the advisor is the controller and we act as their processor (see §11). Contact: privacy@heed.finance.
We do not sell your personal data. We share it only with service providers that process it on our behalf under written contracts, and only for the purposes below:
notify.heed.finance) and, where you have opted in, marketing email (sent from news.heed.finance), in the EU and the US.The named list of these providers is available on request from privacy@heed.finance. We review it whenever we change providers.
We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction (with continued protection of your data).
Some features, including Ask Heed, position analysis, scenario and relocation tools, and our tax-data pipeline, send inputs to third-party AI model providers (currently Google and Perplexity; we update §5 if this changes) to generate outputs. We send only what is needed for the feature to work. AI outputs are generated automatically and are informational only (see our Terms). We do not use your personal data to train third-party foundation models, and we do not make legally significant decisions about you solely by automated means.
AI assistants you connect. If you connect your own AI assistant to Heed through our MCP server, the account data you ask that assistant to read flows to its provider under your agreement with them, not under this Policy. You can revoke the connection at any time from your settings.
Storage. The personal data you entrust to Heed, meaning your account, profile, residency records, uploads and any client data an advisor enters, is stored by our database provider in the European Union, in Ireland. We do not store it at rest in any other country.
Processing outside the EU and the UK. Some processing takes place elsewhere: AI model providers in the United States receive the inputs needed to generate a response (see §6); Google Analytics and Tag Manager process data in the United States, only after you accept them (see §10); Stripe processes payments in the United States and the European Union; the edge network that serves the application handles requests in transit worldwide; and our providers keep operational logs for security and reliability. A provider may also hold its own copy of what it needs for its function, such as your billing record at Stripe or your newsletter subscription at our marketing email provider in the European Union (see §5). Our team accesses the Service from outside the European Economic Area.
Safeguards. Where personal data leaves the EEA or the UK, we rely on an adequacy decision where one exists and otherwise on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with technical and organisational measures. You can request details of the safeguards used for any transfer at privacy@heed.finance.
We retain your personal data while your account is active. When you ask us to close your account (write to privacy@heed.finance from your account email) we delete your personal data without undue delay, except where we must retain certain records (such as billing, tax, and accounting records, or data needed to resolve disputes or comply with law) for the period required by law. Aggregated or anonymised data that no longer identifies you may be retained.
Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact privacy@heed.finance; we will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.
Marketing. We send marketing email and our newsletter only where you have opted in (for example via the Tax Roast email gate or a newsletter sign-up), and every marketing email includes a one-click unsubscribe link. Where you give us your email address to receive a Roast result, we tell you at the point of entry that this also subscribes you to Heed Weekly; you may unsubscribe immediately and at any time without losing access to anything.
Cookies. Cookies that are strictly necessary to sign you in, keep your session, and remember your cookie choice are set without consent, as the law permits. Everything else is off until you choose otherwise. Our Google Tag Manager container, which loads Google Analytics 4 and any advertising or measurement tags we run, loads only after you accept. Refusing takes one click. To change or withdraw your choice later, use the control below; withdrawal takes effect immediately and does not affect processing carried out before you withdrew.
Where an advisor-tier user enters personal data about their clients, the advisor is the data controller and we process that data only as their processor, on their instructions, to provide the Service. If you are an advisor's client and wish to exercise your rights, please contact your advisor; we will assist them as required. The terms of that processing are in our Data Processing Addendum.
We use technical and organisational measures appropriate to the risk, including encryption, access controls, and authentication safeguards. No system is completely secure, and we cannot guarantee absolute security. If a personal-data breach is likely to result in a high risk to you, we will notify you and the relevant authority as required by law.
United States. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. Depending on your state of residence you may have the right to know what we collect, to request deletion or correction, to receive a portable copy, and not to be discriminated against for exercising those rights. Use the contact address below and we will verify and respond within the period your state law allows.
Heed is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.
We may update this Policy from time to time. For material changes we will provide notice (for example by email or in-app). The "last updated" date above reflects the current version.
Privacy questions or requests: privacy@heed.finance.