Back to home

    Privacy Policy

    Last updated: 28 July 2026

    1. Who We Are (Data Controller)

    The Service at heed.finance is operated by POP DIGITAL STUDIO - FZCO, a free-zone company registered with IFZA (Dubai Integrated Economic Zones Authority) under licence no. 70917 in the Emirate of Dubai, United Arab Emirates, with its registered office at IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates ("Heed", "we", "us"). For personal data we process about you as a user, we are the data controller. For personal data that advisor-tier users enter about their own clients, the advisor is the controller and we act as their processor (see §11). Contact: privacy@heed.finance.

    2. Data We Collect

    • Account data: email, name, and profile details you provide at registration and onboarding.
    • Tax profile data: tax residency, jurisdictions of interest, income types, asset classes, wealth bracket, life events, and any offshore entity details you choose to enter.
    • Content you submit: queries to our AI assistant, scenario and relocation inputs, and other information you enter into tools.
    • Usage & device data: pages and features used, interaction patterns, approximate location derived from IP, and device/browser information.
    • Payment data: processed by Stripe. We receive limited billing metadata (e.g. status, plan, customer ID) but do not store full card details.
    • Lead data: email and inputs you submit via the Tax Roast, waitlist, or Circle application forms.
    • Advisor client data: client names, emails, and tax profiles that advisor-tier users enter (see §11).

    3. How & Why We Use Your Data

    • To provide and personalise the Service (change feed, alerts, residency tracking, scenarios, position analysis).
    • To operate our AI features, your inputs may be sent to AI providers to generate responses (see §6).
    • To send service and transactional emails (alerts, threshold warnings, digests, account notices).
    • To send marketing emails where you have opted in, and to manage our newsletter.
    • To process payments, manage subscriptions, and prevent fraud and abuse.
    • To secure, maintain, analyse, and improve the Service, and to comply with legal obligations.

    4. Legal Bases for Processing

    • Contract: to provide the Service and features you sign up for.
    • Legitimate interests: to secure, analyse, and improve the Service and prevent abuse, balanced against your rights.
    • Consent: for marketing communications, the newsletter, and any non-essential cookies and analytics.
    • Legal obligation: to keep billing, tax, and accounting records as required by law.

    5. Sub-processors & Data Sharing

    We do not sell your personal data. We share it only with service providers that process data on our behalf under appropriate contractual safeguards:

    • Supabase (database, authentication, hosting, edge functions), EU and US.
    • Stripe (payment processing and subscription billing), EU and US.
    • Resend (transactional email delivery via notify.heed.finance), US.
    • Brevo (marketing email and newsletter delivery via news.heed.finance), EU.
    • Google (Gemini models for AI features; Analytics 4, Tag Manager, and advertising or measurement tags, only with your consent), EU and US.
    • Perplexity (research and verification in our tax-data pipeline), US.
    • OpenAI (language models behind some AI features), US.
    • Lovable (application hosting and the AI gateway that routes several of the services above), EU and US.
    • Sanity (blog and editorial content), EU and US.
    • Cloudflare (bot protection and security, e.g. Turnstile), global edge network.
    • Telegram (internal operational notifications), global.

    These are the service providers we currently use. We keep this list current and review it whenever we change providers.

    We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction (with continued protection of your data).

    6. AI Processing

    Some features, including Ask Heed, position analysis, scenario and relocation tools, and our tax-data pipeline, send inputs to third-party AI providers (including Google, OpenAI and Perplexity) to generate outputs. We send only what is needed for the feature to work. AI outputs are generated automatically and are informational only (see our Terms). We do not use your personal data to train third-party foundation models, and we do not make legally significant decisions about you solely by automated means.

    7. International Transfers

    We are based in the UAE and our providers may process data in the United States, the European Union, and elsewhere. Where personal data is transferred across borders, including out of the EEA and the UK, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, together with technical and organisational measures, to protect it. You can request details of the safeguards used.

    8. Data Retention

    We retain your personal data while your account is active. When you close your account we delete your personal data without undue delay, except where we must retain certain records (such as billing, tax, and accounting records, or data needed to resolve disputes or comply with law) for the period required by law. Aggregated or anonymised data that no longer identifies you may be retained.

    9. Your Rights

    Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact privacy@heed.finance; we will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.

    10. Marketing & Cookies

    Marketing. We send marketing email and our newsletter only where you have opted in (for example via the Tax Roast email gate or a newsletter sign-up), and every marketing email includes a one-click unsubscribe link. Where you give us your email address to receive a Roast result, we tell you at the point of entry that this also subscribes you to Heed Weekly; you may unsubscribe immediately and at any time without losing access to anything.

    Cookies. Cookies that are strictly necessary to sign you in, keep your session, and remember your cookie choice are set without consent, as the law permits. Everything else is off until you choose otherwise. Our Google Tag Manager container, which loads Google Analytics 4 and any advertising or measurement tags we run, loads only after you accept. Refusing takes one click. To change or withdraw your choice later, use the control below; withdrawal takes effect immediately and does not affect processing carried out before you withdrew.

    11. Advisor Client Data

    Where an advisor-tier user enters personal data about their clients, the advisor is the data controller and we process that data only as their processor, on their instructions, to provide the Service. If you are an advisor's client and wish to exercise your rights, please contact your advisor; we will assist them as required.

    12. Security

    We use technical and organisational measures appropriate to the risk, including encryption, access controls, and authentication safeguards. No system is completely secure, and we cannot guarantee absolute security. If a personal-data breach is likely to result in a high risk to you, we will notify you and the relevant authority as required by law.

    13. UAE, US and Other Jurisdictions

    United Arab Emirates. As a UAE-established company we also process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

    United States. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. Depending on your state of residence you may have the right to know what we collect, to request deletion or correction, to receive a portable copy, and not to be discriminated against for exercising those rights. Use the contact address below and we will verify and respond within the period your state law allows.

    14. Children

    Heed is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

    15. Changes to This Policy

    We may update this Policy from time to time. For material changes we will provide notice (for example by email or in-app). The "last updated" date above reflects the current version.

    16. Contact

    Privacy questions or requests: privacy@heed.finance.