Privacy Policy
1. Who we are
HeadlessEngineer (“we”, “us”, “our”) is the data controller for the personal data collected through this website and the Data Map product at headlessengineer.xyz.
Contact: privacy@headlessengineer.xyz
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Email address | Account creation, authentication, and transactional emails (verification, password reset) | Art. 6(1)(b) — performance of contract |
| Password (hashed) | Authentication | Art. 6(1)(b) — performance of contract |
| GitHub username & email (OAuth only) | Authentication via GitHub OAuth | Art. 6(1)(b) — performance of contract |
| Dataset metadata (identifier, label, description) | Delivering the Data Map product | Art. 6(1)(b) — performance of contract |
| Profile data (first name, last name, bio, date of birth, GitHub URL, LinkedIn URL) | Personalising your account | Art. 6(1)(b) — performance of contract |
| Newsletter subscription flag & consent timestamp | Sending the HeadlessEngineer newsletter (no external provider active) | Art. 6(1)(a) — consent (Art. 7); consent timestamp recorded |
| Consent record (timestamp, policy version) | Recording informed consent at signup | Art. 6(1)(c) — legal obligation |
| Last activity timestamp | Data retention management | Art. 6(1)(f) — legitimate interest |
| IP address & request logs | Security, fraud prevention, and abuse detection | Art. 6(1)(f) — legitimate interest |
We do not sell your data or use it for advertising.
3. Third-party processors
We share data with the following sub-processors, each bound by a Data Processing Agreement (DPA) and operating under adequate safeguards:
| Processor | Purpose | Data transferred | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database, authentication, storage | Email, hashed password, dataset records, activity logs | DPA + Standard Contractual Clauses (SCCs) |
| GitHub Inc. (Microsoft) | OAuth authentication (optional) | GitHub email and username — read-only, no further storage | GitHub Data Processing Agreement |
| Vercel Inc. | Hosting and CDN | IP address, request metadata | Vercel Data Processing Agreement |
4. Data retention
- Account and dataset data is retained while your account is active.
- On account deletion, all personal data (auth record, datasets, activity record) is deleted immediately and permanently.
- Accounts inactive for 24 months are subject to a manual review and deletion notice.
- Server logs (IP addresses) are retained for up to 90 days by our infrastructure processors for security purposes.
5. Your rights
Under the UK GDPR and EU GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data (change email/password via your account page)
- Erasure — delete your account and all associated data via your account page
- Portability — download your data as JSON via your account page
- Restriction — request that we restrict processing of your data
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent, you may withdraw it at any time (this does not affect the lawfulness of prior processing)
To exercise any right not available through your account page, email privacy@headlessengineer.xyz. We will respond within 30 days.
6. Complaints
You have the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO). In the EU, contact your national Data Protection Authority.
7. Cookies
We use only functional cookies necessary to maintain your authenticated session. These cookies are set by Supabase SSR and are HttpOnly, Secure, and SameSite=Lax. No advertising or analytics cookies are in use. No consent banner is required for functional-only cookies under ePrivacy Directive Recital 25.
8. Changes to this policy
We will notify you by email if we make material changes. The version number and effective date at the top of this page will be updated. Continued use of the service after notification constitutes acceptance of the updated policy.