Privacy Policy

Headless HQ is operated by Lunoa Labs Inc., Ontario, Canada ("Lunoa Labs", "we", "us"). This policy explains how Lunoa Labs handles personal information collected through Headless HQ. It is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there.

1. Information We Collect

When you use Headless HQ, we collect information you provide directly, including:

• Account information (name, email address, organization name)
• Ad platform credentials and OAuth tokens for connected services
• Campaign data, creative assets, and performance metrics you import or generate
• Messages and instructions you provide to AI agents
• Usage data, including feature interactions and session information

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve the Headless HQ platform
• Execute AI agent actions on your behalf (campaign management, analytics, creative generation)
• Send transactional emails (password resets, approval notifications, account alerts)
• Analyze usage patterns to improve our services
• Detect and prevent fraud, abuse, or security incidents

3. Third-Party Services

Headless HQ integrates with third-party services to deliver its functionality. These include:

• Ad and Social Platforms: Meta, Google, and TikTok for campaign management; LinkedIn, X, and Meta for social publishing
• AI Providers: Anthropic (Claude) and Google (Gemini) for agent reasoning, and OpenAI for creative generation (text, image, video) and agent reasoning
• Cloud Infrastructure: Google Cloud Platform for hosting and task processing
• Email: SendGrid for transactional email and for email that agents send on your behalf. Agents can also send through email and marketing services you connect, such as Gmail, Outlook, Resend, Postmark, or HubSpot
• Product Analytics: PostHog, which receives page views, product events, and session recordings (form inputs are masked), and, when you are signed in, your user ID, role, and organization ID
• Website Analytics: Plausible, which measures site traffic without cookies

Each third-party service is governed by its own privacy policy. Integrations you connect, such as your ad platforms or email tools, receive the data needed for the actions agents take on your behalf.

4. Cookies & Local Storage

We use essential cookies and browser local storage to maintain your authentication session and store application preferences. We do not use third-party tracking cookies or advertising pixels. Session tokens are stored as secure, HTTP-only cookies where possible.

5. Data Retention

We retain your data while your account is active. To have your account and its data deleted, email us at the address below; we handle deletion requests manually.

6. Security

We use encrypted data transmission (TLS), hashed passwords (bcrypt), and rate-limited authentication endpoints. Stored platform credentials are never returned through our API.

7. Your Rights

You may ask to access, correct, or delete your personal data, or for a copy of it. Email us at the address below and we will respond to the request manually.

8. Contact

For privacy-related inquiries, contact us at hello@headlesshq.com.