Privacy Policy
This policy explains what personal information Headway Stack (ABN 75 674 802 209) (“we”, “us”), operating from Melbourne, Victoria, Australia, collects through the Headway service at app.headwaystack.com and this website, why we collect it, and the rights you have over it. We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).
Headway is a tool for businesses. Most of the personal information that passes through it is not ours - it belongs to the organisation whose workspace it sits in, and we handle it on that organisation’s behalf.
1. The two roles we play
For information about the people who sign in - your account name and email address - we decide how it is handled, so we act as the controller of it.
For the Customer Data in your workspace - your deals, companies, contacts, quotes, time entries, candidates and applications, attachments, and (if you enable the People module) employee records - your organisation decides what goes in and why. We store and handle it to provide the service and to keep it running safely. If you are a customer, candidate or employee of an organisation that uses Headway, please contact that organisation first; we will help them answer you.
2. What we collect
- Identity and sign-in: your name and email address, handled through our authentication provider, Clerk. If you choose to sign in with Google or another social provider, that provider shares your basic profile (name, email) with Clerk to create your session. We never see or store a password.
- Customer Data: the business records your workspace enters or imports, which may include personal information about your customers, contacts, candidates and employees.
- Form and application submissions: where a workspace publishes a public form, such as a job application or a booking link, what the person submits - including their contact details and any file such as a CV - is collected into that workspace.
- Attachments: files uploaded into a workspace, held in our object storage.
- Operational logs: IP address, timestamps and request metadata, kept to run, secure, rate-limit and debug the service.
- Error reports: when a fault occurs, technical details of the failure and the request context around it may be captured by our error-reporting tooling so we can fix it.
- Correspondence: anything you send us at our support and contact addresses.
This website sets no analytics or advertising cookies today. The application uses only the cookies and local storage needed to keep you signed in and to remember your interface preferences. If we later add product analytics, we will use it to understand how the product is used, not to build advertising profiles, and we will say so here.
The application does keep its own first-party counts of how each workspace is used - sign-ins, and how many records, deals, quotes and candidates it creates each day - as numbers per workspace with no names or record contents in them, together with when each account last signed in. We use those counts to run the service, to notice when it is failing, and to bill for it. No third-party analytics runs inside the application.
3. Where your data lives
Headway’s application, database, database backups and file storage are hosted in Australia (Sydney region). Some specific parts of the service do involve disclosure outside Australia, and APP 8 says we should name them plainly:
- Clerk, our authentication provider, stores account identity data (names, email addresses, sign-in metadata) on its own infrastructure in the United States. Signing in therefore involves an overseas disclosure of that identity data.
- Resend, our email delivery provider, processes the messages the service sends on your behalf - an email to a candidate, for example - including the recipient’s address and the content of the message. Its delivery infrastructure sits outside Australia, principally in the United States.
- Sentry, when error reporting is enabled, processes error reports and their request metadata in the United States.
Apart from those flows, and any integration you switch on yourself, we do not routinely move your workspace records offshore. Where we do disclose personal information overseas, we take reasonable steps to use established providers whose contractual commitments require them to protect it, and by using Headway you agree to those disclosures.
4. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Application hosting and database | Sydney, Australia |
| Amazon Web Services (S3) | Attachment and file storage | Sydney, Australia |
| Clerk | Authentication and identity | United States |
| Resend | Outbound email delivery | United States |
| Stripe | Subscription billing and card payments - card details go to Stripe and never reach Headway | United States |
| Sentry | Error reporting (when enabled) | United States |
| Google, or your chosen social sign-in provider | Optional social sign-in, at your election | Per provider |
We use these providers to deliver the service and require appropriate protections from them. This list changes as the service changes; we keep this page current rather than promise a notice period.
5. How we use personal information
To operate, support and secure Headway, to provision your account and workspace, to send the messages the product exists to send, to respond to you, to communicate about the service, and to meet our legal obligations. We also use aggregated or de-identified information - counts, timings, error rates, feature usage - to understand and improve the product.
We do not sell personal information. We do not use it for advertising, and we do not use your Customer Data to train machine-learning models.
6. What we ask of you
You choose what goes into your workspace, so you are responsible for having a lawful basis to collect it, for telling the people concerned how you will use it, and for meeting your own privacy obligations to your customers, candidates and employees. Please do not put information into Headway that you do not need, and take particular care with sensitive information such as health details or government identifiers - the product is not designed for it.
Headway is built for businesses and their staff, not for individuals under 16 signing up for themselves.
7. Security
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, as APP 11 requires. Traffic is encrypted in transit (TLS), access to production systems is limited to those who need it, and backups are kept in the same region as the database. Headway staff can see the facts about your account that running the service needs - your plan, your seats, the names of the people in your workspace and your administrators’ addresses, when your account was last used, and the usage counts above - and not your workspace’s records. Headway staff can enter your workspace only with your administrator’s approval, for a stated reason, for a bounded time, and every action they take there is recorded in your audit log. No system is perfectly secure and we cannot guarantee absolute security; you are responsible for keeping your own sign-in method, including any social account you use to sign in, safe.
8. Data breaches
We participate in the Notifiable Data Breaches scheme under the Privacy Act. If a data breach involving personal information is likely to result in serious harm, we will notify affected workspace administrators and individuals, and the Office of the Australian Information Commissioner (OAIC), as the scheme requires.
9. Retention and deletion
We keep Customer Data while your workspace is active and for a reasonable wind-down period after it closes, then delete it. We may keep information for longer where we need it to resolve a dispute, enforce our terms, or meet a legal or accounting obligation, and we may keep aggregated or de-identified information indefinitely.
Closing a workspace in the product starts that wind-down period. The workspace becomes read-only immediately, everything in it is permanently deleted 30 days later, and the closure can be undone at any point before that. We notify the workspace’s owner and administrators when it closes and again shortly before the deletion.
Deactivating an account is not the same as deleting a workspace’s records. When someone leaves a workspace, or an administrator removes them, their sign-in is deleted and their access ends immediately. Their name and work email remain on that workspace’s records - the deals they owned, the hours they logged, the entries they wrote - because those records belong to the organisation that operates the workspace, which needs them to stay attributable, accurate and auditable. Preferences that belong only to the individual, such as a display timezone or email settings, are deleted once the reactivation period has passed. The email address is at that point released from the Headway sign-in, so it can be used again.
Deleting something in the product removes it from the live service. Backups are taken on a rolling schedule and are not edited record by record, so a deleted item can persist in a backup until that backup ages out. You can request an export or deletion at privacy@headwaystack.com; where the request concerns another organisation’s records - including your own name on records held by an employer or a client - we will route it through that organisation as the one who decides.
10. Access, correction and complaints
You may ask us to access or correct the personal information we hold about you (APPs 12 and 13), or complain about how we have handled it, at privacy@headwaystack.com. We will acknowledge your request and respond within a reasonable period, usually within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au.
11. Changes to this policy
We may update this policy as the service changes. The updated version is posted here with a new date, and continuing to use Headway after that means you accept it. If a change materially affects how we handle personal information, we will take reasonable steps to let workspace administrators know.
12. Contact
Headway - Melbourne, Victoria, Australia.
Privacy: privacy@headwaystack.com · General: hi@headwaystack.com