Headcount (“we”, “us”, “our”) operates the Headcount platform — an AI-powered operations and performance management tool for workplaces, available at app.headcounthq.ai (the “Service”).
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. It applies to all users of the Service, including workspace administrators, managers, and team members.
If you have questions about this policy, contact us at privacy@headcounthq.ai.
1. Who Is Responsible for Your Data
Headcount is a business-to-business (B2B) platform. Understanding who controls your data depends on your relationship with us:
When your employer uses Headcount
Your employer (the organization that created the workspace) is the Data Controller. They decide what data to collect from employees and why. Headcount acts as a Data Processor — we process data on your employer's behalf, following their instructions, to provide the Service.
If you are an employee using Headcount because your employer set it up, questions about how your data is used should first be directed to your employer. We will assist your employer in responding to your requests.
When Headcount is the Data Controller
- •Account registration data of individuals who sign up directly (workspace creators)
- •Billing and payment data
- •Data collected through our marketing website (headcounthq.ai)
- •Communications you send directly to us (support requests, emails)
2. Data We Collect
2.1 Data You Provide
| Category | Data Points | When Collected |
|---|---|---|
| Account Data | Email address, full name, password (stored as a cryptographic hash), job title, department, role (admin, manager, or member) | When you sign up or are invited to a workspace |
| Workspace Data | Company name, workspace settings, departments, teams, leave policies, holiday calendars | When an admin configures the workspace |
| Time-Off Data | Leave requests (type, dates, reason), balances, approval/rejection history | When employees submit and managers review requests |
| Performance Data | Pulse survey responses, peer/upward/downward feedback, public recognition, 1:1 meeting agendas, notes, and action items, workload check-in responses | When users participate in these features |
| Private Manager Notes | Notes a manager writes about a team member, visible only to that manager | When a manager creates a note |
| Knowledge Base | Documents uploaded by admins (company policies, handbooks, guides) | When an admin uploads files |
2.2 Data from Integrations
Slack Integration
When a workspace admin connects Slack, we access:
- •User profiles: Email, display name, avatar, timezone (to link Slack users to Headcount accounts)
- •Bot interactions: Messages sent directly to the Headcount bot in DMs and messages where the bot is @mentioned in channels
- •Slash command inputs: Data entered through /off, /praise, /hc-feedback, and /1on1 commands
- •Modal submissions: When the bot delivers a short pulse survey, the user can answer in an inline Slack modal; their answers are submitted directly into Headcount and stored alongside dashboard-collected pulse responses
- •OAuth tokens: Bot token and signing credentials (stored encrypted, used only for authorized API calls)
What we do NOT access through Slack: We do not read or monitor private channels, group DMs, or any messages where the bot is not directly mentioned or messaged. We do not scrape, index, or bulk-export message history. We do not access files shared in Slack channels. We do not monitor employee activity, keystrokes, or screen content.
Google Calendar Integration
When a user connects Google Calendar, we access:
- •Calendar event metadata: Event title, start/end time, and attendees — used only for scheduling and managing 1:1 meetings
- •OAuth tokens: Stored encrypted, used only for calendar read/write operations
We do not access email content, Google Drive files, or any Google data beyond calendar events. Headcount's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Recall.ai Meeting Bot
When a user explicitly links a recurring meeting to a pulse survey in Headcount, we use Recall.ai to send a meeting bot to that meeting. The bot is opt-in per pulse and per meeting — we never join meetings the user has not linked.
When the bot is active, we access:
- •Meeting audio and video: Captured by the Recall.ai bot during the meeting and used to produce a transcript
- •Diarized transcript: Speaker-attributed text of the conversation, fetched from Recall.ai once the meeting ends
- •Meeting metadata: Title, start/end times, and participant list, used to attribute statements to the correct Headcount user
How the data is used: The transcript is processed by our AI providers (Section 8) to extract draft pulse-style answers for each participant. Each participant reviews their own draft in Slack or in the Headcount web app and chooses to submit, edit, or discard it before it becomes a pulse response. Drafts not acted on are auto-submitted or discarded at the pulse close deadline.
What we do NOT do with meeting data: We do not retain audio or video on Headcount's own servers — audio / video lives only in Recall.ai's infrastructure under their retention defaults and is fetched only as needed to generate the transcript. We do not use meeting recordings or transcripts for any purpose other than generating the user's draft pulse responses. We do not share transcripts across users or with anyone other than the meeting participants. We do not join meetings that have not been explicitly linked in Headcount.
2.3 Data Generated by the Service
| Category | Data Points | Purpose |
|---|---|---|
| AI-Generated Insights | Burnout risk scores, team health assessments, manager insights, recognition suggestions, 1:1 preparation briefs, AI agent responses | Providing AI-powered features |
| Notification Records | Emails sent, Slack DMs sent, in-app notifications delivered | Delivering notifications |
| Billing Records | Subscription plan, billing cycle, payment status, invoices (we do NOT store credit card numbers) | Managing subscriptions |
2.4 Data Collected Automatically
| Category | Data Points | Purpose |
|---|---|---|
| Technical Data | IP address, browser type and version, device type, operating system | Security, debugging, and service improvement |
| Access Logs | Timestamps of logins and API requests | Security monitoring and abuse prevention |
| Error Logs | Application error details (may include request context) | Debugging and reliability |
3. How We Use Your Data
- •Providing the Service — Account authentication, workspace management, leave tracking, pulse surveys, feedback collection, 1:1 scheduling and notes, recognition, workload tracking, and all other core features.
- •Slack Integration — Delivering notifications via Slack DMs, responding to slash commands, rendering the App Home tab, and processing bot interactions.
- •Google Calendar Integration — Reading and creating calendar events solely for 1:1 meeting scheduling.
- •AI-Powered Features — Generating burnout risk assessments, team health scores, manager insights, recognition suggestions, 1:1 preparation briefs, and AI agent conversation responses. This involves sending relevant data to third-party AI providers (see Sections 5 and 8).
- •Billing and Payments — Processing subscriptions and payments through our payment provider (Dodo Payments), managing plan tiers, and generating invoices.
- •Communications — Sending transactional emails (leave approvals, pulse reminders, invitation emails, password resets) through our email provider.
- •Security and Fraud Prevention — Detecting unauthorized access, preventing abuse, and maintaining the integrity of the Service.
- •Service Improvement — Analyzing aggregated, anonymized usage patterns to improve product functionality and reliability. We do not build individual user profiles for marketing purposes.
4. Legal Basis for Processing
For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require a legal basis, we process personal data under the following grounds:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Performance of a contract |
| Core HR features (leave, 1:1s, pulse, feedback) | Performance of a contract (processor on controller's instructions) |
| Slack and Google Calendar integrations | Consent (granted through OAuth authorization) |
| AI-powered features | Legitimate interest and contractual necessity |
| Billing and payment processing | Performance of a contract |
| Transactional emails | Performance of a contract |
| Security logging and fraud prevention | Legitimate interest (protecting the Service) |
| Service improvement (aggregated analytics) | Legitimate interest (improving the product) |
Where we rely on legitimate interest, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms.
6. Payment Processing
Payments are processed by Dodo Payments, which acts as our Merchant of Record. This means Dodo Payments — not Headcount — is the entity that processes your credit card or payment method.
We never receive, store, or have access to your full credit card number, CVV, or banking details.
We receive only:
- •Subscription status (active, cancelled, past due)
- •Plan and billing cycle information
- •Payment event outcomes (success, failure)
- •Invoice identifiers
7. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy, or as required by law.
| Data Category | Retention Period | Deletion Trigger |
|---|---|---|
| Account data | Duration of account + 30 days | User or admin requests deletion |
| Workspace data | Duration of subscription + 90 days | Subscription cancellation + grace period |
| Slack OAuth tokens | Until disconnected | Admin disconnects Slack |
| Google OAuth tokens | Until disconnected | Admin disconnects Google Calendar |
| Pulse survey responses | Duration of subscription | Workspace deletion |
| Feedback, recognition, 1:1 data | Duration of subscription | Workspace deletion |
| Private manager notes | Duration of subscription | Workspace deletion |
| Knowledge base documents | Until deleted by admin | Admin action or workspace deletion |
| AI conversation logs | 90 days | Automatic rotation |
| Meeting bot recordings (Recall.ai) | Per Recall.ai's retention defaults; not stored on Headcount infrastructure | Automatic at Recall.ai per their policy |
| Meeting transcripts (derived) | Duration of workspace subscription, alongside the linked pulse occurrence | Workspace deletion or pulse archival |
| Pulse response drafts (transcript-derived) | Until the pulse occurrence closes (typically hours, never more than the configured close window); auto-submitted or discarded at the deadline | Pulse close cron |
| Billing records | 7 years | Legal and tax obligations |
| Security and access logs | 12 months | Automatic rotation |
| Sentry error events | 90 days (Sentry default; subject to change in our Sentry plan) | Automatic rotation in Sentry |
When a workspace is deleted, we permanently erase all associated data within the retention periods above. Backups are rotated on a 30-day cycle; data in backups is overwritten as backups rotate.
8. AI Data Processing
Headcount uses artificial intelligence to provide several features. Because AI processes potentially sensitive workplace data, we believe this deserves specific and transparent disclosure.
What data is sent to AI providers
- •AI Agent conversations: The user's message and relevant context (team data, recent leave requests, pulse trends, 1:1 history) to generate a helpful response
- •Burnout detection: Aggregated signals including PTO patterns, workload self-reports, pulse survey trends, and feedback patterns. Outputs are advisory and are not based on a single clinical instrument.
- •Team health analysis: Aggregated team metrics from pulse surveys, workload, and time-off data
- •Manager insights: A manager's team data to generate actionable recommendations
- •Recognition suggestions: Team activity data to identify recognition opportunities
- •1:1 preparation: 1:1 history, action items, recent feedback, and pulse data to generate meeting briefs
- •Knowledge base queries: Uploaded document content to answer policy-related questions
- •Meeting transcript extraction: For pulses linked to a meeting, the diarized transcript captured by the Recall.ai bot is sent to the AI provider to extract draft answers for each participant. Each draft is reviewed by the participant before it becomes a pulse response.
Which AI providers
- •Anthropic (Claude) — Primary provider
- •OpenAI — Fallback provider
- •Google Vertex AI — Fallback provider
Data retention by AI providers
We access these providers exclusively through their enterprise/API interfaces. Under their current API terms:
- •Anthropic: Does not use API inputs to train models. Data is not retained after processing.
- •OpenAI: Does not use API inputs to train models (default policy since March 2023). Data retained for up to 30 days for abuse monitoring, then deleted.
- •Google Vertex AI: Customer data is not used for model training. Governed by Google Cloud's data processing terms.
No automated decision-making
AI features in Headcount are advisory only. They produce recommendations, scores, and insights for managers to review. No employment decisions — including hiring, firing, promotion, compensation, or disciplinary action — are made solely or automatically by AI.
Managers and administrators exercise independent judgment when acting on AI-generated insights. The Service is not a substitute for professional HR, legal, or medical advice.
9. Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data.
For all users
- •Access: Request a copy of the personal data we hold about you
- •Correction: Request correction of inaccurate or incomplete data
- •Deletion: Request deletion of your personal data
- •Data Export: Request your data in a portable, machine-readable format
Additional rights under GDPR (EEA/UK)
- •Restrict Processing: Request that we limit how your data is used
- •Object to Processing: Object to processing based on legitimate interest
- •Withdraw Consent: Withdraw consent at any time without affecting prior processing
- •Automated Decision-Making: Right not to be subject to solely automated decisions with legal effects (our AI features are advisory — see Section 8)
- •Lodge a Complaint: File a complaint with your local data protection authority
Additional rights under CCPA (California)
- •Right to Know: Request categories and specific pieces of personal information collected
- •Right to Delete: Request deletion of personal information
- •Right to Opt-Out of Sale: We do not sell personal information
- •Right to Non-Discrimination: We will not discriminate for exercising your rights
Additional rights under India's DPDP Act
- •Right to information about processing of your personal data
- •Right to correction and erasure of inaccurate or unnecessary data
- •Right to grievance redressal regarding data processing
- •Right to nominate a person to exercise rights on your behalf
How to exercise your rights
If you are an employee using Headcount because your employer set it up: Please contact your employer (the workspace administrator) first. As the Data Controller, your employer is primarily responsible for fulfilling your data rights requests. We will assist your employer in responding.
If you are a workspace administrator or signed up directly: Contact us at privacy@headcounthq.ai.
Response timeline: We will acknowledge your request within 7 days and respond substantively within 30 days (or 45 days for CCPA requests). If we need additional time, we will notify you of the extension and reason.
10. International Data Transfers
Headcount's infrastructure is hosted in the United States (AWS us-east-1 region). If you are located outside the United States, your personal data will be transferred to and processed in the United States.
Transfers from the EEA or United Kingdom
- •We rely on the EU-U.S. Data Privacy Framework (DPF) where our sub-processors are certified participants
- •Where DPF certification is not available, we use Standard Contractual Clauses (SCCs) approved by the European Commission
- •We assess the data protection laws of the destination country and implement supplementary measures where necessary
Transfers from India
The Digital Personal Data Protection Act, 2023 permits transfers to countries not restricted by the Central Government. As of this policy's effective date, no restriction list has been published, and transfers to the United States are permitted.
11. Data Security
Technical measures
- •Encryption in transit (TLS/HTTPS for all connections)
- •Encryption at rest (database and file storage encryption via AWS)
- •Passwords stored using bcrypt cryptographic hashing
- •JWT-based authentication with token expiration
- •Role-based access control (admin, manager, member) enforced at the API level
- •Parameterized database queries (preventing SQL injection)
Organizational measures
- •Access to production systems is restricted to authorized personnel
- •Principle of least privilege for system access
- •Regular security reviews of code and infrastructure
- •Automated daily database backups with encrypted offsite storage
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to security@headcounthq.ai.
12. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms:
- •We will notify the affected workspace administrator(s) without undue delay and no later than 72 hours after becoming aware of the breach
- •We will notify the relevant supervisory authority where required by law
- •The notification will include: the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken to address the breach
- •If the breach is likely to result in a high risk to individuals, we will also notify affected individuals directly
14. Children's Privacy
Headcount is a workplace productivity tool designed for use by adults in professional settings. The Service is not directed at individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction).
We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will promptly delete it. If you believe a child has provided us with personal data, please contact us at privacy@headcounthq.ai.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
For material changes
- •We will notify workspace administrators by email at least 30 days before the changes take effect
- •We will display a notice within the Service
- •The updated policy will be posted at this URL with a revised date
For non-material changes
Clarifications and formatting updates will be reflected with an updated “Last Updated” date without separate notification.
Continued use of the Service after the effective date of changes constitutes acceptance of the updated policy. If you disagree with any changes, you may terminate your account before the changes take effect.
16. Slack-Specific Data Practices
This section provides additional detail about how we handle data from Slack, as required for Slack's App Directory and security review.
OAuth Scopes
We request only the Slack OAuth scopes necessary to provide our features. These include permissions to: post messages (bot DMs and channel messages where invited), read user profiles, manage the App Home tab, receive slash commands, and receive events for @mentions and direct messages to the bot.
What the bot does
- •Responds to slash commands (/off, /praise, /hc-feedback, /1on1)
- •Sends notifications via DM (leave request updates, pulse survey reminders, workload check-ins, recognition alerts)
- •Opens an inline modal in Slack for short pulse surveys, so users can answer without leaving Slack
- •Renders an interactive App Home tab with team dashboards
- •Responds to @mentions in channels and DMs with AI-powered answers
- •Detects @mentions of users who are on approved leave (out-of-office alerts)
Token storage
Slack OAuth tokens (bot tokens) are stored encrypted in our database. Each workspace's token is stored separately and used only for API calls to that workspace. Tokens are never logged, exposed in URLs, or shared with third parties.
When Slack is disconnected
- •All Slack OAuth tokens for that workspace are permanently deleted
- •The bot stops sending messages and responding to commands
- •Data previously collected through Slack interactions (pulse responses, feedback, etc.) is retained as part of the workspace data and subject to the retention periods in Section 7
17. Google API Data Practices
This section provides additional detail required by Google's API Services User Data Policy.
What Google data we access
- •Calendar event metadata (title, start/end time, attendees) for the connected user's calendar
- •User profile information (email address) during the OAuth flow
How we use Google data
Solely for creating, reading, updating, and deleting 1:1 meeting events in Google Calendar. We do not use Google data for advertising, marketing, or any purpose unrelated to 1:1 scheduling.
Limited Use compliance
Headcount's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read Google user data except where: (a) we have the user's affirmative consent, (b) it is necessary for security purposes, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized.
Revoking access
- •You can disconnect Google Calendar at any time from Settings > Integrations in the Headcount dashboard, or by removing Headcount from your Google Account permissions
- •When access is revoked, we delete all stored Google OAuth tokens for your account
- •Calendar events previously created by Headcount remain on your Google Calendar; Headcount will no longer be able to read or modify them
18. Data Processing Agreement
For workspace administrators and organizations subject to GDPR or other data protection regulations that require a written data processing agreement:
Headcount offers a Data Processing Agreement (DPA) that governs our obligations as a Data Processor. The DPA covers:
- •Our obligations to process data only on the controller's documented instructions
- •Confidentiality obligations of personnel with access to data
- •Technical and organizational security measures
- •Sub-processor engagement and notification procedures
- •Assistance with data subject rights requests
- •Data breach notification procedures
- •Data return and deletion upon termination
- •Audit and inspection rights
To request a copy of our DPA, contact privacy@headcounthq.ai.
19. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or our data practices:
- •General questions: hello@headcounthq.ai
- •Privacy / data subject rights: privacy@headcounthq.ai
- •Security issues: security@headcounthq.ai
- •Website: headcounthq.ai
For users in the EEA who wish to lodge a complaint, you have the right to contact your local data protection supervisory authority.