Legal

Privacy Policy

Last updated: 11 November 2026

1. Who We Are (Data Controller)

The Service at heed.finance is operated by Heed Intelligence Pte. Ltd., a private company limited by shares incorporated in Singapore, with its registered office at 68 Circular Road, #02-01, Singapore 049422 ("Heed", "we", "us"). Heed is a trading name of that company. For personal data we process about you as a user, we are the data controller. For personal data that advisor-tier users enter about their own clients, the advisor is the controller and we act as their processor (see §11). Contact: privacy@heed.finance.

2. Data We Collect

  • Account data: email, name, and profile details you provide at registration and onboarding.
  • Tax profile data: tax residency, jurisdictions of interest, income types, asset classes, wealth bracket, life events, and any offshore entity details you choose to enter.
  • Content you submit: queries to our AI assistant, scenario and relocation inputs, and other information you enter into tools.
  • Residency days and location check-in: the days you spend in each country, whether you log them yourself or let Heed count them automatically. If you turn on location check-in on a device, that device reads its location when you open Heed and works out the country on the device itself: your coordinates are not sent to us or stored. We keep only the country and the date. You can turn it off at any time on the Residency page or in your browser’s settings.
  • Usage & device data: pages and features used, interaction patterns, approximate location derived from IP, and device/browser information.
  • Payment data: processed by Paddle, the merchant of record that sells our paid plans. We receive limited billing metadata (e.g. status, plan, customer ID) but never see or store your card details.
  • Lead data: email and inputs you submit through the Tax Situation Roast, the Incorporation Roast, waitlist and early-access forms, advisor walkthrough requests, partner and Circle applications, and support requests.
  • Job applicant and event lead data: if you apply for a role through our careers pages, your name, email, location, LinkedIn address and the CV you attach; if you leave your details through a partner or investor form at an event, your name, email and the short answers you give. We use them only to reply to you and to assess your application or enquiry. They are shared in our private team workspace, and we keep them no longer than needed for that purpose. Ask us at privacy@heed.finance to delete them sooner.
  • Advisor client data: client names, emails, and tax profiles that advisor-tier users enter (see §11).

3. How & Why We Use Your Data

  • To provide and personalise the Service (change feed, alerts, residency tracking, scenarios, position analysis).
  • To operate our AI features, your inputs may be sent to AI providers to generate responses (see §6).
  • To send service and transactional emails (alerts, threshold warnings, digests, account notices).
  • To send marketing emails where you have opted in, and to manage our newsletter.
  • To process payments, manage subscriptions, and prevent fraud and abuse.
  • To secure, maintain, analyse, and improve the Service, and to comply with legal obligations.
  • Contract: to provide the Service and features you sign up for.
  • Legitimate interests: to secure, analyse, and improve the Service and prevent abuse, and, outside the countries where consent comes first (see §10), to measure our website and our advertising with analytics and advertising cookies you can switch off at any time, balanced against your rights.
  • Consent: for marketing communications, the newsletter, location check-in on a device, and, in the countries listed in §10, any non-essential cookies and analytics.
  • Legal obligation: to keep billing, tax, and accounting records as required by law.

5. Who Receives Your Data

We do not sell your personal data for money. We share it only with service providers that process it on our behalf under written contracts, and with the advertising partners named below, and only for the purposes below:

  • Hosting and database providers that run the Service and store your account, profile, residency and client data in the European Union, in Germany (see §7).
  • Payments through Paddle (Paddle.com Market Limited), the merchant of record for our paid plans: Paddle sells the subscription, handles checkout, card details, invoices and sales tax, and processes that payment data as an independent controller under its own privacy notice, in the UK, the EU and the US.
  • Email delivery providers for transactional email (sent from heed.finance) and, where you have opted in, marketing email (sent from news.heed.finance), in the EU and the US.
  • AI model providers, currently Google and Perplexity, which receive the inputs needed to generate a response (see §6), in the EU and the US.
  • Analytics and tag management by Google (see §10), in the EU and the US.
  • Advertising and measurement partners, currently Meta, TikTok, X and LinkedIn, which receive the pages you visit and the actions you take on our website (such as joining the waitlist), with your email address in hashed form where you give it, so we can measure and improve our campaigns (see §10), in the US and elsewhere.
  • Bot protection by Cloudflare Turnstile on public forms, on a global edge network.
  • Team notification tools that tell us when a form is submitted or a system event needs attention, and, only where an advisor firm connects its own workspace such as Slack or Microsoft Teams, delivery of alerts to that workspace on the firm's instruction, in the US.

The named list of these providers is available on request from privacy@heed.finance. We review it whenever we change providers.

We may also disclose data where required by law, to enforce our terms, or in connection with a corporate transaction (with continued protection of your data).

6. AI Processing

Some features, including Ask Heed, position analysis, scenario and relocation tools, and our tax-data pipeline, send inputs to third-party AI model providers (currently Google and Perplexity; we update §5 if this changes) to generate outputs. We send only what is needed for the feature to work. AI outputs are generated automatically and are informational only (see our Terms). We do not use your personal data to train third-party foundation models, and we do not make legally significant decisions about you solely by automated means.

AI assistants you connect. If you connect your own AI assistant to Heed through our MCP server, the account data you ask that assistant to read flows to its provider under your agreement with them, not under this Policy. You can revoke the connection at any time from your settings.

7. Where Your Data Is Stored and International Transfers

Storage. The personal data you entrust to Heed, meaning your account, profile, residency records, uploads and any client data an advisor enters, is stored by our database provider in the European Union, in Germany, and our encrypted backups are kept in the European Union. We do not store it at rest outside the European Union.

Processing outside the EU and the UK. Some processing takes place elsewhere: AI model providers in the United States receive the inputs needed to generate a response (see §6); Google Analytics and Tag Manager, and our advertising partners, process data in the United States (see §10); Paddle processes payments in the United Kingdom, the European Union and the United States; the edge network that serves the application handles requests in transit worldwide; and our providers keep operational logs for security and reliability. A provider may also hold its own copy of what it needs for its function, such as your billing record at Paddle or your newsletter subscription at our marketing email provider in the European Union (see §5). Our team accesses the Service from Singapore.

Safeguards. Where personal data leaves the EEA or the UK, we rely on an adequacy decision where one exists and otherwise on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with technical and organisational measures. You can request details of the safeguards used for any transfer at privacy@heed.finance.

8. Data Retention

We retain your personal data while your account is active. When you ask us to close your account (write to privacy@heed.finance from your account email) we delete your personal data without undue delay, except where we must retain certain records (such as billing, tax, and accounting records, or data needed to resolve disputes or comply with law) for the period required by law. Aggregated or anonymised data that no longer identifies you may be retained.

9. Your Rights

Subject to applicable law, you may have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting prior processing). To exercise these rights, contact privacy@heed.finance; we will respond within the timeframe required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data-protection supervisory authority.

10. Marketing & Cookies

Marketing. We send marketing email and our newsletter only where you have opted in (for example via the Tax Roast email gate or a newsletter sign-up), and every marketing email includes a one-click unsubscribe link. Where you give us your email address to receive a Roast result, we tell you at the point of entry that this also subscribes you to Heed Weekly; you may unsubscribe immediately and at any time without losing access to anything.

Cookies. Cookies that are strictly necessary to sign you in, keep your session, and remember your cookie choice are set without consent, as the law permits. Our Google Tag Manager container loads Google Analytics 4 and our advertising and measurement tags (see §5). What happens before you choose depends on where you are, which we read from your connection when the page loads and keep only in your browser for that visit:

  • Consent first in the European Union and the European Economic Area, the United Kingdom, Switzerland, Canada, Brazil, India, South Africa, Turkey, South Korea, China and Thailand, and wherever we cannot tell your country: everything beyond the strictly necessary is off, and the container loads only after you accept. Refusing takes one click.
  • On unless you switch it off everywhere else, including the United States: the container loads by default and the banner lets you switch analytics, advertising or both off. If your browser sends a Global Privacy Control signal, we treat it as a request not to sell or share and keep the advertising tags off.

To change or withdraw your choice later, use the control below; withdrawal takes effect immediately and does not affect processing carried out before you withdrew.

11. Advisor Client Data

Where an advisor-tier user enters personal data about their clients, the advisor is the data controller and we process that data only as their processor, on their instructions, to provide the Service. If you are an advisor's client and wish to exercise your rights, please contact your advisor; we will assist them as required. The terms of that processing are in our Data Processing Addendum.

12. Security

We use technical and organisational measures appropriate to the risk, including encryption, access controls, and authentication safeguards. No system is completely secure, and we cannot guarantee absolute security. If a personal-data breach is likely to result in a high risk to you, we will notify you and the relevant authority as required by law.

13. Singapore, US and Other Jurisdictions

Singapore. We are established in Singapore and the Personal Data Protection Act 2012 (PDPA) applies to our processing. Our Data Protection Officer can be reached at privacy@heed.finance. Under the PDPA you may withdraw consent, ask for access to and correction of your personal data, and ask how it has been used or disclosed in the past year; we answer within 30 days. If we do not resolve your concern, you may complain to the Personal Data Protection Commission of Singapore at pdpc.gov.sg.

United States. We do not sell personal information for money. Our advertising partners (see §5) receive information about your visits and actions on our website, which US state privacy laws, including California's, may treat as selling personal information or sharing it for cross-context behavioural advertising. You may opt out at any time, without an account, with the control below; it turns the advertising tags off on this browser. We also honour Global Privacy Control signals as an opt-out. Depending on your state of residence you may have the right to know what we collect, to request deletion or correction, to receive a portable copy, to opt out of selling and sharing, and not to be discriminated against for exercising those rights. Use the contact address below and we will verify and respond within the period your state law allows.

14. Children

Heed is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

15. Changes to This Policy

We may update this Policy from time to time. For material changes we will provide notice (for example by email or in-app). The "last updated" date above reflects the current version.

16. Contact

Privacy questions or requests: privacy@heed.finance.