Privacy Policy

Clemens Fischer
Calle Padre Cosme Torres 5
46019 Valencia
Spain

Email: info@heedly.app

We collect the following data when you use Heedly:

• Account data: email address, name (provided via authentication)
• Profile data: work schedule, sleep habits, chronotype, work field, subscription plan
• Daily check-in data: energy, stress, sleep hours, mood
• Task and scheduling data: tasks, durations, priorities, types, notes, completion status
• Career plan data: current role, target role, industry, skills and career goals
• Notes: ideas and thoughts you choose to write in Heedly's Notes
• Tools: what you write in Heedly's Tools, such as the monthly concern vs. influence sheet
• Coaching data: the steps Adrian suggests to you and what became of them (planned, done or declined, and the reason you gave), and which topics he has already raised, so he follows up instead of repeating himself
• Burnout score data: calculated daily scores and contributing factors
• Payment data: handled entirely by Stripe (website) or Apple (iOS app). We store only your Stripe customer ID, or an Apple transaction identifier, and never see or store card details.

Reminders in the iPhone app (your career review dates, the career diary and Adrian's check-ins on steps you planned) are scheduled by the iPhone itself, and only after you have turned them on. No push service is involved and no data leaves your device for them. The text on the lock screen is general and never contains what Adrian wrote or the name of a task.

Heedly's AI features use language models from OpenAI. Requests go from Heedly's own server to OpenAI; the API key never reaches your device. Nothing is sent before you have agreed to it in the app ("How Heedly uses AI"), and you can withdraw that consent at any time in Settings → AI features. Without it the AI features are switched off; the planner, check-ins and burnout score keep working.

What is sent, and when:

• Adrian, your coach: your messages and the context he needs to answer them: your first name (if you have given one), your role and career plan, your planner tasks (titles, durations, status, logged hours) with a month-by-month history, the averages of your check-ins (energy, stress, motivation) and your burnout score, your diary entries (the newest as complete summaries of each evening, older months as one summary per month, and counts across all your entries: how often you practised the skills in your career plan, recurring challenges and progress on your milestones), your achievements and career review answers, a short summary of your earlier conversations with him, and the steps he has suggested to you with what became of them (whether you planned, did or declined them, and the reason you gave). When he suggests a step, the tasks of your coming days are sent with a random internal ID, so he can link the step to one of them. He uses the same context when he writes to you on his own initiative.
• Notes: only when you ask Adrian about them in Notes research.
• Tools sheets: only when you send one to Adrian yourself with "Talk it through". Otherwise Adrian only learns whether and when you filled one in.
• Weekly reports: the week's tasks (titles, types, status, durations) and your check-in averages (energy, stress, motivation).
• Career plan and career reports: your answers in the career plan wizard, the text of a CV or LinkedIn profile if you import one, and for the reports your career plan with your recent tasks (names, types, durations, notes).
• Achievement suggestions: your completed tasks, diary entries and review answers.
• Voice: recordings are sent as audio to be transcribed; a voice command sends the transcript together with your current week's tasks. When Adrian reads a reply aloud, the text of that reply is sent to be turned into speech. The career diary in the iPhone app sends no recordings: where the iPhone supports it, speech is turned into text on the iPhone itself (Apple's on-device speech recognition) and no audio leaves the device; where it does not, the diary is typed.
• Career diary: what you say or type in the evening diary, to tick off the questions as you answer them, to read your day from it (sleep, energy, stress, hours worked, the day's challenge, wins, milestones and skills) and to write a complete summary of each entry, sorted by topic and linked to the skills and milestones in your career plan, whose names are sent with it. When a month is over, its summaries are sent once more to be condensed into one summary of the month. These summaries are stored in your account; Adrian works from them. On the web, each recording is sent with the names of the skills in your career plan and common legal and consulting terms, so the transcription spells them correctly; in the iPhone app, these words and your client list only help the recognition on the iPhone.
• Task import: only if you ask Heedly to suggest types and durations, and then only the task names.

Never sent: your email address or any account identifier, the sleep hours from your check-ins, your calendar (see 3b) and payment data. What you say about your sleep in the career diary is part of that entry and is sent with it.

Check-ins and diary entries can reveal information about your health and wellbeing. We send them to the AI only with your explicit consent. The legal basis for the AI features is your consent under Art. 6(1)(a) GDPR and, for this data, Art. 9(2)(a) GDPR. Withdrawing consent does not affect processing that took place before it.

OpenAI processes these requests on our behalf, to produce the answer and for nothing else. It does not use them to train its models and keeps them for at most 30 days to detect misuse before deleting them.

Client-name masking: before a request is sent to OpenAI, Heedly replaces the client names on your client list (Settings → Client names) and the names of well-known companies with code names, and restores them in the answer on your device. OpenAI receives the code names only. The list itself is stored in your account and is never sent. Voice recordings are an exception: they are sent as audio for transcription and cannot be masked; the resulting text is masked before any further processing. The career diary in the iPhone app has no such exception: it sends no audio, and its text is masked before it leaves the iPhone.

Application data (tasks, check-ins, profiles, career plans, reports) is stored with Supabase (supabase.com), our database and authentication provider, within the European Union, and is protected by per-user row-level security so each account can only access its own data. Supabase is SOC 2 Type II and ISO 27001 certified; a Data Processing Agreement is available at supabase.com/legal/dpa.

AI features (Adrian, reports, career plan, voice; see section 3) send the relevant text to OpenAI (openai.com), located in the United States, through Heedly's own secure server — the API key is never exposed to your browser. OpenAI does not use data submitted through its API to train its models (see openai.com/policies). For EU-to-US transfers, the relevant Standard Contractual Clauses apply. Your notes are sent only when you ask the coach about them in the Notes research conversation.

Payment processing, where used, is handled by Stripe Payments Europe, Limited (Dublin, Ireland). Where Stripe transfers data outside the EU, Standard Contractual Clauses apply (stripe.com/legal/dpa).

For data-residency questions, contact: info@heedly.app

Connecting a calendar is optional and switched off by default. Heedly works fully without it.

When you connect a calendar in Settings, you are taken to Google or Microsoft to sign in. Heedly never sees your password. We receive an access token and a refresh token, which are stored in our EU database (encrypted at rest) and never sent to your browser, together with the email address of the connected account so we can show you which account is linked.

What we read: for the date range shown in your planner, we read the title, start time and end time of your events and store them so they can be displayed next to your Heedly tasks. We do not read attendees, descriptions, locations or attachments.

What we write: nothing, unless you ask for it. When you create or edit a task you may tick "Add to calendar" and enter a start and end time. Only that single event is created, with the title and times you entered. Heedly never writes your tasks to your calendar automatically and never exports your planner. Synchronisation is otherwise one-way: from your calendar into Heedly.

Calendar data is not sent to OpenAI or any other AI service, is never sold, and is never transferred to third parties. Permissions used: Google — https://www.googleapis.com/auth/calendar.events; Microsoft Graph — Calendars.ReadWrite.

You can disconnect at any time in Settings, which deletes the stored tokens and the events synced from that calendar. You can also revoke access directly at myaccount.google.com/permissions or myapps.microsoft.com.

Heedly's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time by disconnecting.

The salary check on our website (heedly.app/salary-check and its German and Spanish versions) can be used without an account and without giving us anything. Nothing is stored unless you enter an email address.

If you do, we store: your email address, what you looked up (profession, country, city, level and the band you were shown), the language you used, any campaign parameters in the link you arrived through, and the exact consent text you agreed to, with the date.

We use double opt-in. After you sign up we send one email asking you to confirm the address. Until you click that link we send you nothing else, and an unconfirmed address is never used for anything. When you confirm, we record the time and the IP address of the click as proof of consent.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw it at any time — every email contains an unsubscribe, or write to info@heedly.app — and withdrawal does not affect the lawfulness of what was sent before.

We process your data to:

• Provide the Heedly service (Art. 6(1)(b) GDPR — performance of a contract)
• Calculate your burnout score and scheduling recommendations
• Provide the AI features (Adrian, reports, career plan, voice) — only with your consent (Art. 6(1)(a) GDPR; for check-in and diary data Art. 9(2)(a) GDPR, see section 3)
• Send you two emails before your free trial ends, four days before and the day before (Art. 6(1)(b) GDPR — part of the trial)
• Process payments via Stripe (Art. 6(1)(b) GDPR)
• Improve the service (Art. 6(1)(f) GDPR — legitimate interest)

We do not use your data for advertising or sell it to third parties.

See section 3a for full details on data storage locations, certifications, and transfer mechanisms.

• Stripe (stripe.com): Payment processing. Stripe's privacy policy applies to payment transactions.
• Supabase (supabase.com): Database storage and authentication, EU region.
• Vercel (vercel.com): Application hosting.
• OpenAI (openai.com): AI feature processing.
• Apple (apple.com): payment processing for subscriptions bought in the iOS app. Apple tells us only that a subscription is active and until when; we receive no name, address or payment details.
• Google LLC (google.com): Google Calendar, only if you connect one (section 3b).
• Microsoft Corporation (microsoft.com): Outlook Calendar, only if you connect one (section 3b).
• Resend (resend.com): delivery of transactional email, e.g. messages you send us via the support form and the two reminders before your free trial ends.
• PostHog (posthog.com), EU cloud: privacy-focused product analytics on our public website — page views and anonymous usage statistics, hosted in the EU. No advertising, no cross-site tracking, and no analytics inside the app itself.
• HeyCatch (heycatch.ai): anonymous page and click statistics on our public website — page views, which links and buttons are clicked, and which of our links a visit came from. No cookies, no identifier that outlasts the browser tab, no session recordings, no names or email addresses, and no analytics inside the app itself.

We do not use tracking pixels, advertising networks or social media trackers.

We retain your data for as long as your account is active. You can request deletion of your account and all associated data at any time by contacting us at info@heedly.app.

As a data subject under GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Lodge a complaint with your national data protection authority

To exercise your rights, contact: info@heedly.app

Heedly uses only essential session cookies required for authentication. No third-party tracking or analytics cookies are used. You will be asked for cookie consent when first visiting the site.

We may update this privacy policy from time to time. We will notify you of significant changes via email or in-app notice. The current version is always available at this URL.