HeadlarkPrivacy Policy
This policy explains how Headlark handles personal data when we are the controller: for account holders, people who contact us, and visitors to headlark.com. When we process personal data that appears on our customers' websites, we do so on the customer's behalf under the data processing agreement.
Who is responsible
The controller is Felwood Studios (Gustav Henning, enskild näringsverksamhet), Fleminggatan 63A, 112 32 Stockholm, Sweden, headlark.info@gmail.com. Felwood Studios is a sole proprietorship registered in Sweden and runs Headlark. See also company information.
What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address, sign-in links, account and plan details, accepted terms version | Creating and running your account | Contract (6.1.b) |
| Sites, domains, page addresses, usage counts | Providing the service and enforcing plan limits | Contract (6.1.b) (or legitimate interest, 6.1.f, where you act for your employer) |
| Billing details, VAT number, invoices (held by Stripe, which sells paid plans as merchant of record and is a separate controller for payment data) | Charging for paid plans, bookkeeping | Contract (6.1.b), legal obligation (6.1.c) |
| Messages you send us | Answering you | Legitimate interest (6.1.f) |
| Technical logs from our hosting provider (IP address, requested URL, time) | Security and troubleshooting | Legitimate interest (6.1.f) |
| Visits to headlark.com: page, referring site, campaign parameters, browser and screen type, country, and clicks on "Start free" and runs of the SEO checker, site checker, llms.txt generator and structured data checker | Counting visits to see which pages and channels work | Legitimate interest (6.1.f) |
The text of the pages you connect and the metadata we generate from it are processed on your behalf as processor under the DPA, not under this policy.
Visits to headlark.com are counted with GoatCounter, without cookies and without storing anything in your browser. Your IP address and browser details are used only in memory, for up to 8 hours, to avoid counting the same visit twice; they are never saved, so the counts can't be traced back to you. The dashboard at /app and the script customers add to their sites are not counted. We use no advertising trackers and we do not sell personal data. The script customers can add to their sites sets no cookies and sends us nothing about their visitors beyond the ordinary request for the metadata file, which our hosting provider (Vercel) serves from its CDN and may log like any static file.
Providers that process data for us
| Provider | What for | Where |
|---|---|---|
| Anthropic | The AI model that writes metadata from page content | United States |
| Vercel | Hosting and file storage for published metadata | EU (Frankfurt, Stockholm); company in the US |
| Upstash | Database for accounts, sites and usage | EU (Frankfurt); company in the US |
| Stripe | Payments, tax and invoices (merchant of record for paid plans) | EU and United States |
| Resend | Sending sign-in and service emails | United States |
| GoatCounter (Martin Tournoij, Ireland) | Cookieless visit counts for headlark.com | EU (Hetzner, Finland and Germany) |
| Google (Gmail, Drive) | Email correspondence and bookkeeping records | EU/United States (DPF) |
Where data is transferred outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission's Standard Contractual Clauses. Anthropic does not use data sent through its commercial API to train its models.
How long we keep data
- Account data: as long as the account exists. Deleting your account removes it immediately, along with your sites, keys, usage records, stored page content and published metadata. Encrypted daily backups keep a copy for up to 14 days, after which it is gone.
- Sign-in links: 15 minutes.
- Invoices and payment records: 7 years, as Swedish bookkeeping law requires (held by Stripe and in our bookkeeping).
- Hosting logs: according to our hosting provider's retention period.
- Visit counts: aggregate numbers without personal data, kept as long as they're useful.
- Generated metadata is stored in a cache keyed by a hash of the page text it was generated from, with no link to any account, site or URL, and may be reused when identical content is submitted again.
Your rights
You have the right to access your data, to get it in a portable format, and to have it corrected or erased. You can also restrict or object to certain processing. You can download your data and delete your account yourself in the dashboard, or email us. We answer within one month; in complex cases we may extend this by two months and tell you so within the first month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se).
Cookies
We use only cookies that are strictly necessary. See the cookie statement.
Changes
We update this policy when our processing changes, and tell account holders by email about material changes.