Privacy Policy
Last updated
This policy explains how we handle personal data when you visit heady.video, create an account, and use Heady to make videos. It is written to meet the EU General Data Protection Regulation (GDPR) and the Hong Kong Personal Data (Privacy) Ordinance (PDPO) [PLACEHOLDER: counsel to confirm the laws that apply, e.g. UK GDPR].
1. Who is responsible
The controller is Vision Music & Media Limited, Room 1006, 10/F, Haleson Building, 1 Jubilee Street, Central, Hong Kong. Email: [PLACEHOLDER: privacy contact email].
Our representative in the European Union under Article 27 GDPR is [PLACEHOLDER: name and address of the EU representative].
[PLACEHOLDER: data protection officer or advisor, if appointed.]
2. What we collect and why
| Data | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Email address, name if given, login records | Create and secure your account, sign you in | Contract, Art. 6(1)(b) |
| Your content | Topics, outlines, scripts and edits, files you upload | Produce your videos | Contract, Art. 6(1)(b) |
| Outputs | Generated scripts, images, narration, videos, subtitles, descriptions | Deliver your videos and let you download them | Contract, Art. 6(1)(b) |
| Usage and billing records | Plan, credit balance and history, jobs run, purchases (as reported by the merchant of record) | Run your plan, count credits, keep accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Technical data | IP address, browser type, timestamps, error logs | Keep the service secure and working, investigate abuse | Legitimate interests, Art. 6(1)(f) |
| Support messages | What you write to us and our replies | Answer you | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Service emails | Email address, delivery status | Sign-in links, notices about your account and videos | Contract, Art. 6(1)(b) |
If you join the waitlist, we use your email address and the interest you can optionally pick (long videos, Shorts or both) to send you one confirmation email through Resend, and only after you confirm do we add your email address to our waitlist mailing list with Resend, which we use only for news about Heady's launch and which you can unsubscribe from at any time.
We do not use advertising cookies, tracking pixels or third-party analytics that track you across sites. See the Cookie Policy.
Please do not put personal data about other people into topics or scripts unless you have the right to. Heady does not need it to make a video.
3. How AI processing works
To make a video, we send the text and instructions needed for each step to AI models:
- Scripts, outlines and descriptions are generated by large language models.
- Images are generated and edited by image models.
- Narration is generated by text-to-speech models.
These requests go through OpenRouter, a service that routes each request to the model provider that runs the model. Some steps run on our own servers and send nothing to a third party beyond our hosting provider: the open-source voice model used on [PLACEHOLDER: plans that use the self-hosted voice], and the speech recognition that times every word for subtitles.
What we send to model providers is the content needed for the step: for example, the topic and outline for the script, a description of the scene for an image, or the lines to be spoken. We do not send your account details or payment data.
[PLACEHOLDER: state, per provider, whether it retains prompts and outputs and for how long, and confirm that OpenRouter is configured to exclude providers that train on or log requests. Do not publish until confirmed.]
We do not use your content or outputs to train AI models.
4. Who receives your data
Processors
These companies process personal data on our behalf, under contracts that bind them to our instructions.
| Processor | What they do for us | Data involved | Location |
|---|---|---|---|
| DigitalOcean, LLC | Hosting: servers, database, file storage and the workers that produce videos | All data in sections 2 and 3 | [PLACEHOLDER: data centre regions used]; company based in the USA |
| OpenRouter, Inc. | Routes AI requests to model providers | Content sent for AI processing (section 3) | USA |
| AI model providers reached through OpenRouter | Run the models that generate text, images and speech | Content sent for AI processing (section 3) | [PLACEHOLDER: per provider] |
| Resend [PLACEHOLDER: contracting entity] | Sends service emails | Email address, email content, delivery status | USA |
| Cloudflare, Inc. | DNS, content delivery and protection against attacks | IP address, request metadata | Global network; company based in the USA |
The model providers we use through OpenRouter at the date of this policy are [PLACEHOLDER: confirm the current list, e.g. OpenAI (text), Google (images and speech), ElevenLabs (premium voices)]. We will update this list when it changes [PLACEHOLDER: or publish a subprocessor page with change notifications].
Independent controllers
Stripe sells our plans and credit packs as merchant of record. When you buy, you enter your payment details on Stripe's checkout, and Stripe processes your name, email, billing address, payment details and purchase history as an independent controller under its own privacy policy [PLACEHOLDER: link Stripe's privacy policy and name the Stripe entity]. We receive from Stripe what we need to run your account: [PLACEHOLDER: e.g. your email, country, plan, payment status and order IDs]. We never see your full card details.
If you publish a video on a platform such as YouTube, that platform is responsible for what it does with it.
Others
We disclose data to authorities only where the law requires it, and to professional advisers bound by confidentiality where needed to establish or defend legal claims.
5. Transfers outside the EU and Hong Kong
We are based in Hong Kong, and some recipients are in, or can access data from, other countries, in particular the United States. For personal data of people in the EU/EEA, where a country does not have an adequacy decision from the European Commission, we rely on:
- the EU-US Data Privacy Framework, for recipients certified under it; or
- the European Commission's Standard Contractual Clauses [PLACEHOLDER: counsel to confirm the safeguards for transfers to Hong Kong and onward].
[PLACEHOLDER: confirm the safeguard for each recipient in section 4.] You can ask us for a copy of the relevant safeguards using the contact details in section 1.
6. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is open, then deleted within [PLACEHOLDER: e.g. 30] days of closure |
| Your content and outputs | Until you delete them or close your account, then deleted within [PLACEHOLDER: e.g. 30] days |
| Backups | Overwritten within [PLACEHOLDER: e.g. 35] days |
| Usage and billing records | [PLACEHOLDER: e.g. 7 years, as required for business records under Hong Kong law; confirm] |
| Technical logs | [PLACEHOLDER: e.g. 30] days, longer only when needed to investigate a specific incident |
| Support messages | [PLACEHOLDER: e.g. 2 years after the conversation ends] |
7. Your rights
Depending on the law that applies to you, you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process it;
- receive your data in a portable format (portability);
- object to processing based on legitimate interests;
- withdraw consent at any time, where we rely on consent.
To use these rights, email [PLACEHOLDER: privacy contact email]. We will answer within the time the law requires, usually within 30 days. We may need to confirm your identity first.
You can also complain to a supervisory authority: in Hong Kong, the Office of the Privacy Commissioner for Personal Data (PCPD); in the EU, the authority in the country where you live or work [PLACEHOLDER: counsel to confirm].
8. Automated decisions
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. [PLACEHOLDER: describe any automated checks that block prohibited content, and how to ask for human review.]
9. Security
We protect data with encryption in transit, access controls limited to staff who need them, and separation between customers' data [PLACEHOLDER: confirm encryption at rest, access logging and other measures]. No system is perfectly secure; if a breach affects your data and the law requires it, we will tell you.
10. Children
Heady is not intended for children. You must be at least [PLACEHOLDER: minimum age] to create an account. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes
We will update this policy when our processing changes. For material changes we will notify you by email or in the app before they take effect. The date at the top shows the latest version.
12. Contact
Vision Music & Media Limited, Room 1006, 10/F, Haleson Building, 1 Jubilee Street, Central, Hong Kong. Email: [PLACEHOLDER: privacy contact email].