1. Who We Are (Data Controller)

The Service at heed.finance is operated by POP DIGITAL STUDIO - FZCO, a free-zone company registered with IFZA (Dubai Integrated Economic Zones Authority) under licence no. 70917 in the Emirate of Dubai, United Arab Emirates, with its registered office at IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates ("Heed", "we", "us"). For personal data we process about you as a user, we are the data controller. For personal data that advisor-tier users enter about their own clients, the advisor is the controller and we act as their processor (see §11). Contact: privacy@heed.finance.

2. Data We Collect

Account data: email, name, and profile details you provide at registration and onboarding.
Tax profile data: tax residency, jurisdictions of interest, income types, asset classes, wealth bracket, life events, and any offshore entity details you choose to enter.
Content you submit: queries to our AI assistant, scenario and relocation inputs, and other information you enter into tools.
Usage & device data: pages and features used, interaction patterns, approximate location derived from IP, and device/browser information.
Payment data: processed by Stripe. We receive limited billing metadata (e.g. status, plan, customer ID) but do not store full card details.
Lead data: email and inputs you submit via the Tax Roast, waitlist, or Circle application forms.
Advisor client data: client names, emails, and tax profiles that advisor-tier users enter (see §11).

3. How & Why We Use Your Data

To provide and personalise the Service (change feed, alerts, residency tracking, scenarios, position analysis).
To operate our AI features — your inputs may be sent to AI providers to generate responses (see §6).
To send service and transactional emails (alerts, threshold warnings, digests, account notices).
To send marketing emails where you have opted in, and to manage our newsletter (you can unsubscribe at any time).
To process payments, manage subscriptions, and prevent fraud and abuse.
To secure, maintain, analyse, and improve the Service, and to comply with legal obligations.

4. Legal Bases for Processing

Contract: to provide the Service and features you sign up for.
Legitimate interests: to secure, analyse, and improve the Service and prevent abuse, balanced against your rights.
Consent: for marketing communications, the newsletter, and any non-essential cookies/analytics — withdrawable at any time.
Legal obligation: to keep billing, tax, and accounting records as required by law.

5. Sub-processors & Data Sharing

We do not sell your personal data. We share it only with service providers that process data on our behalf under appropriate contractual safeguards:

Cloud infrastructure providers: database, authentication, hosting, and transactional email delivery (notify.heed.finance).
Stripe: payment processing and subscription billing.
Brevo: marketing email and newsletter delivery (news.heed.finance).
AI providers (including Google and Perplexity): to power AI features and our data pipeline (see §6).
Analytics (Google Analytics 4, Google Tag Manager, Hotjar): to measure and improve product usage, subject to your cookie choices (see §10).
Cloudflare: bot protection and security (e.g. Turnstile).
Telegram: internal operational alerts to our team, which may include the email and details you submit via a form (e.g. a Roast or Circle application).

We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction (with continued protection of your data). A current list of sub-processors is available on request.

6. AI Processing

Some features — including our AI assistant, position analysis, scenario and relocation tools, and our tax-data pipeline — send inputs to third-party AI providers (including Google and Perplexity) to generate outputs. We send only what is needed for the feature to work. AI outputs are generated automatically, may be inaccurate, and are informational only (see our Terms). We do not use your personal data to train third-party foundation models, and we do not make legally significant decisions about you solely by automated means.

7. International Transfers

We are based in the UAE and our providers may process data in the United States, the European Union, and elsewhere. Where personal data is transferred across borders — including out of the EEA/UK — we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with technical and organisational measures, to protect it. You can request details of the safeguards used.

8. Data Retention

We retain your personal data while your account is active. After you delete your account, we remove personal data within 30 days, except where we must retain certain records (such as billing, tax, and accounting records, or data needed to resolve disputes or comply with law) for the period required by law. Aggregated or anonymised data that no longer identifies you may be retained.

9. Your Rights

Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact privacy@heed.finance; we will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.

10. Marketing & Cookies

We send marketing email and our newsletter only where you have opted in (for example via the Roast email gate or newsletter sign-up), and every marketing email includes an unsubscribe link. We use cookies and similar technologies that are strictly necessary for authentication and session management, and — subject to your choices in our cookie banner — analytics and product-experience tools (Google Analytics 4, Google Tag Manager, and Hotjar) to understand and improve usage. We do not use third-party advertising cookies. You can manage non-essential cookies via the banner and your browser settings.

11. Advisor Client Data

Where an advisor-tier user enters personal data about their clients, the advisor is the data controller and we process that data only as their processor, on their instructions, to provide the Service. If you are an advisor's client and wish to exercise your rights, please contact your advisor; we will assist them as required.

12. Security

We use technical and organisational measures including encryption in transit (TLS), row-level access controls, authentication safeguards, and secure secret management. No system is completely secure, and we cannot guarantee absolute security. If a personal-data breach is likely to result in a high risk to you, we will notify you and the relevant authority as required by law.

13. Children

Heed is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. For material changes we will provide notice (for example by email or in-app). The "last updated" date above reflects the current version.

15. Contact

Privacy questions or requests: privacy@heed.finance.

Privacy Policy