Privacy policy

Overcrate Ltd (“Headwater”, “we”, “us”, or “our”) makes Headwater, software that companies use to run their plan. We are registered in England and Wales under company number 16507860, our registered office is 128 City Road, London, EC1V 2NX .

This policy explains how we handle personal data when you use Headwater, visit useheadwater.com, join our waiting list, or contact us. It is written to meet the UK General Data Protection Regulation, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (together, “UK data protection law”), and for people in the European Economic Area (EEA), the EU General Data Protection Regulation (“EU GDPR”).

For anything about privacy, email [email protected]. We reply within five working days. Our representative in the EU, for people in the EEA, is Overcrate Limited.

If this policy and one of the promises on our privacy page ever differ, whichever gives your data more protection applies.

Workspace content

When your company uses Headwater, it decides what goes into its workspace: its vision, pillars, initiatives, and climbs, check-ins, issues, decisions, documents, comments, huddle notes, 1:1 notes, Brook conversations, and the people it adds. We call all of this workspace content. For workspace content, your company is the controller and Headwater is its processor. We handle it only on your company’s instructions, under our data processing addendum, and only to run Headwater for your company.

Our own records

For account details, sign-in and security records, billing, our website, our waiting list, and messages you send us, Headwater is the controller. Most of this policy is about this data.

If you have a request about workspace content, such as seeing or deleting what your company holds about you, please ask your company first, because it decides what happens to it. If you ask us, we’ll pass your request to your company and help them answer it.

Our website sets no cookies and uses no analytics. Our hosting provider keeps short-lived technical logs of requests to run the site and keep it secure.

Headwater is not designed for special category data, such as health, religion, or ethnicity, or for data about criminal offences. Please don’t put it in your workspace unless your company has a lawful basis for it and has told the people it concerns.

Where we rely on legitimate interests, we have weighed them against your rights and interests. Email [email protected] for a copy of that assessment.

We send service emails that Headwater needs to work, such as sign-in codes. Everything else, such as product news, is only sent if you ask for it, and every one of those emails has a link to stop them. We don’t track whether you open our emails or click their links.

Brook is the AI assistant in Headwater. It is an add-on, and it is off unless your company adds it. People use Brook to ask questions about their plan, to write huddle pre-reads, notes, and monthly reviews, to set climbs, and to check whether goals are SMART. Every feature that sends workspace content to an AI provider is part of Brook, so if your company doesn’t add Brook, none of its workspace content is sent to an AI provider.

Each time someone uses Brook, we send their request, with the parts of their company’s workspace needed to answer it, to one of the AI providers listed in section 9. The provider sends back an answer, which we show in Headwater and keep in your workspace. We only ever send data from the workspace of the company the person belongs to, and your data is never used in answers for anyone at another company.

Our contracts with our AI providers forbid them from using your data to train or improve their models. They may keep requests for up to 30 days to detect misuse, and then delete them. A provider may keep a request longer only if the law requires it or its safety systems flag the request as misuse, which for Anthropic can mean up to two years. Where a provider offers zero data retention and we have it in place, the provider keeps nothing once it has answered.

We keep a record of each AI request, with who asked, the feature, the model, and what it cost, for as long as your company uses Headwater. We keep the text of requests and answers for 30 days, to find and fix faults, and then delete it. Nobody at Headwater reads that text without your company’s permission.

Brook is never used to make decisions about people, and your workspace is only changed when someone asks Brook to change it. Answers from AI models can be wrong, so please check them before you rely on them.

Huddle notes

A team can add Brook to its video call to have the huddle notes written automatically. Our provider, Recall.ai, adds a participant called Brook to the call, which everyone in the call can see. Recall.ai turns what people say into text, and the huddle notes are written from that text. We don’t record audio or video, and we delete the transcript within 24 hours of the huddle ending. The notes are kept in your workspace. Your company is responsible for telling people in the call that notes are being taken.

Headwater in Claude

If you connect your own Claude account to Headwater, Claude can read the parts of the workspace that you can see, when you ask it to. Anthropic, the company that makes Claude, then handles that data under your agreement with Anthropic, not under this policy. If you use a personal Claude account, check your Claude privacy settings to see whether your chats can be used for training.

Headwater stores, backs up, and searches workspace content automatically, and sends it to AI providers when someone uses Brook. Nobody at Headwater sees the content when this happens.

Only a few of our people can reach the systems that store workspace content. Each is bound by confidentiality, signs in with two-step verification, and has only the access their job needs.

Our providers

A few companies handle data for us so that we can run Headwater. They are listed in section 9, with what each one gets and where. Each one is bound by a written contract to handle the data only on our instructions, keep it secure, and delete it when we ask, and none may use it for its own purposes.

Your company

Workspace content belongs to your company, and its admins decide who can see it. Your colleagues can see what you write in the parts of the workspace they have access to.

Services you connect

If you or your company connect another service to Headwater, such as Claude or a video call, we only send the data needed for that service to work. From then on, that service’s own terms apply.

Professional advisers

Our lawyers, accountants, auditors, and insurers may see account and billing details when they need to, under a duty of confidentiality. They never see workspace content unless they need it for a legal claim about that content.

Authorities

Only when the law requires it, as set out in section 10.

If Headwater is sold

If Headwater, or the part of it that runs the service, is sold or merged, personal data will move to the new owner. We’ll tell your company before it happens, the new owner must keep the promises in this policy for all the data we already hold, and your company can export and delete its data before the move.

We share personal data with nobody else.

We tell your company’s admins at least 30 days before we add or replace a company that handles workspace content, and your company can object, as set out in our data processing addendum.

We only give personal data or workspace content to a government, court, regulator, or law enforcement agency when the law requires us to, under a valid legal order.

We check every request. We challenge any request that is unclear, too broad, or unlawful, and we hand over only the least data the order requires. Where we can, we ask the authority to go to your company, as the controller, instead.

Unless the law forbids it, we tell your company before we hand anything over, so that it can try to stop the request. If the law forbids it, we tell your company as soon as we are allowed to.

We will never give anyone a hidden way to get data from Headwater. Every year, we publish how many requests we received and how we answered them.

Workspaces are stored in Ireland, in the EU. UK law recognises the EU as protecting personal data to the UK’s standard.

Some of our providers are in the United States, as section 9 shows. When they handle personal data from the UK or the EEA, we protect it in one of these ways:

1. the UK Extension to the EU-US Data Privacy Framework and the EU-US Data Privacy Framework, for providers certified under them; or
2. the EU Standard Contractual Clauses, with the UK’s International Data Transfer Addendum for data from the UK, together with extra protections such as encryption where our assessment of the transfer shows they are needed.

Email [email protected] for a copy of the safeguards that apply to a provider.

We may keep data longer only where the law requires it, and then we keep it secure and use it for nothing else.

If a breach of security affects personal data we hold for your company, we’ll tell your admins within 48 hours of confirming it, with what happened, what it affects, and what we are doing about it. Where the law requires, we’ll report it to the ICO within 72 hours.

If you find a security problem in Headwater, please email [email protected]. We won’t take legal action against anyone who reports a problem to us in good faith and gives us time to fix it.

To use any of these rights, email [email protected]. It’s free. We may ask you to confirm who you are, and we reply within one month. If a request is complex, we may take up to two more months, and we’ll tell you within the first month if we need to. For workspace content, see section 2.

Complaints

If you are unhappy with how we have handled your data, please tell us first at [email protected]. We’ll confirm we have your complaint within 30 days, look into it without delay, keep you told of progress, and tell you what we found and what we have done.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. In the EEA, you can complain to the data protection authority where you live or work.

If you live in the United States

Some US states, such as California, give you rights to know about, correct, and delete personal information, and to opt out of its sale or sharing. We don’t sell or share personal information as those laws define it, or use sensitive personal information to infer anything about you. Email [email protected] to use your rights. We won’t treat you differently for using them.

Our website, useheadwater.com, sets no cookies and uses no analytics or tracking of any kind. The Headwater app sets only the cookies below. Each one is either needed for the app to work or used to keep a choice you made, so the law doesn’t require us to ask first. None is used for advertising or to track you on other websites.

A few settings, such as which company you opened last, are saved in your browser. They stay on your device and are never sent to us.

When we change this policy, we’ll post the new version here with a new date. For a significant change, we’ll email every company’s admins at least 30 days before it takes effect.

A change that gives your data less protection will never apply to data we already hold without your company’s agreement. Our terms of service say the same.