Companies keep their plans in Headwater, including their goals, the work they have decided to stop, and who is responsible for what. We never sell this data, use it for advertising, or use it to train AI.
- 01
We never sell your data.
We don’t sell it to data brokers, advertisers, or anyone else. This includes data that has been anonymised or combined with other companies’ data. Our only income is what companies pay to use Headwater.
- 02
We never use your data for advertising.
There are no ads in Headwater. This website, the app, and our emails have no advertising trackers or tracking pixels. We don’t share your data with advertising networks, and we don’t use it for marketing.
- 03
We never use your data to train AI.
This applies to our own AI models and to other companies’ models. Brook, the AI assistant in Headwater, uses models from other companies, and our contracts with them don’t allow them to train on your data. Brook is an add-on, and if your company doesn’t add it, none of your data is sent to an AI company.
- 04
Nobody at Headwater looks at your data without your permission.
If you need help, an admin in your company can give our support team access to your workspace for a set time. Your admins can see a record of every page the support team opens. The only other reasons we would look at your data are to stop an attack on Headwater or because the law requires it.
- 05
You can export or delete your data at any time.
Your admins can export all of your company’s data at any time, in files that other software can open. If you delete your company, we delete its data from our systems within 30 days, and from our backups within 90 days.
- 06
We only give your data to authorities when the law requires it.
If a government, court, or police force asks for your data, we check that the law requires us to give it. We challenge requests that ask for more than the law allows. Unless the law stops us, we tell you before we give anything. We will never give anyone a hidden way to get data from Headwater.
- 07
We will never weaken these promises.
These promises are part of our terms of service, so we are legally bound by them. If we change them, we’ll email your admins 30 days before the change. We won’t make any change that gives data you have already given us less protection. If Headwater is ever sold, the buyer has to keep these promises.
Last updated 29 September 2026.
- Only if your company adds Brook
- Brook is an add-on. If your company doesn’t add it, none of your data is sent to an AI company.
- Never used for training
- Brook uses AI models from Anthropic, OpenAI, Groq, and TypeSafe. Our contracts with these companies don’t allow them to use your data to train their models.
- Deleted within 30 days
- These companies keep a copy of each question for up to 30 days to check it for misuse, and then delete it. They only keep a copy for longer if it has been flagged as misuse or the law requires it.
- Only your company’s data
- When someone asks Brook a question, Headwater only sends data from their own company’s workspace. Your data is never used in answers for another company.
- No recordings of your calls
- A team can add Brook to its video call to have the huddle notes written automatically. Headwater doesn’t record the audio or video. We delete the written transcript of the call within 24 hours of the huddle ending.
Headwater in Claude works differently. If you connect your own Claude account to Headwater, Claude can read the parts of the plan that you can see. Anthropic, the company that makes Claude, then handles that data under your agreement with Anthropic, not under our terms.
Stored in the EU
Your company’s workspace is stored in data centres in Ireland. Some of the companies we use for sign-in, email, and Brook are in the United States, and we follow UK and EU law when we send them data.
Encrypted
Your data is encrypted when it is sent over the internet, using TLS, and when it is stored, using AES-256. This includes our backups.
Secure sign-in
People sign in with a link sent to their email, a password, or their Google or Microsoft account.
Kept apart from other companies
Everything in Headwater belongs to one company. Each time someone opens or changes anything, Headwater checks that they have access to that company.
Breaches reported within 48 hours
If there is a security breach that affects your data, we’ll email your admins within 48 hours of confirming it. We’ll tell them what happened and what we are doing about it.
A list of every company we use
Our privacy policy lists every company that handles your data for us, what data it has, and where it is. We email your admins 30 days before we add a company to the list, and you can object.
See the listFor questions about your data, email [email protected]
To report a security problem, email [email protected]
No. Our support team can only see your workspace if an admin in your company gives them access, for as long as the admin chooses. Your admins can see a record of every page the support team opens. The only other reasons we would look at your data are to stop an attack on Headwater or because the law requires it.
Your first quarter is free, so you can set your plan and see a whole quarter through before you pay anything.