Privacy Policy

Effective date: October 27, 2026

Who we are

Heads Up ("Heads Up", "we", "us") provides SMS marketing tools for small service businesses. This policy explains what we collect from the businesses that use the service ("Customers") and how we handle the contact information those businesses upload or collect about their own customers ("Recipients").

Operator: Heads Up, 21508 Parker Road, Tomball, TX 77377.

Our role: controller and processor

For account, billing, and usage data about our Customers, Heads Up is the controller (CCPA: "business").

For Recipient data — the phone numbers, names, and consent records a Customer uploads or collects — the Customer is the controller and Heads Up acts as a processor (CCPA: "service provider"). We process that data only to provide the service and on the Customer's documented instructions. We do not sell it, share it for cross-context behavioural advertising, or use it to build our own marketing lists.

Recipients who want their information corrected or deleted should contact the business that messaged them; we will assist that business in responding. You may also contact us at headsupsupport@gmail.com and we will route the request.

Information we collect

Account data: your name, email, business details, and authentication identifiers (via Clerk).

Billing data: subscription and payment status (processed by Stripe; we never receive or store card numbers).

Audience data: the phone numbers, names, and consent records you upload or collect in order to send SMS.

Consent evidence: for each opt-in we store the phone number, the verbatim consent language shown, the collection method, a timestamp, and the IP address and browser user-agent of the device that submitted it. This is the record that defends a TCPA claim, which is why we keep it.

Message data: the content of campaigns you send, delivery status from the carrier, and inbound replies to the messaging number (including STOP/HELP keywords).

Usage and diagnostic data: request logs and error reports, with phone numbers, email addresses, and message bodies scrubbed before they reach our error tracker (Sentry).

How we use it

To provide the service: authenticate you, send the campaigns you create, enforce consent and opt-outs, meter usage against your plan, and bill your subscription.

To keep the service working and safe: error diagnosis, abuse and fraud prevention, rate limiting, and carrier compliance.

To contact you about your account: transactional email such as receipts, failed payments, trial expiry, and campaign completion. These are not marketing and you cannot opt out of them while you hold an account; you can unsubscribe from any non-essential email using the link in its footer.

We do not sell personal information, and we do not use Recipient data to advertise to Recipients on our own behalf.

Text messages from Heads Up

You can opt in to recurring automated marketing text messages from Heads Up by texting Heads Up to (424) 331-1892 (see https://headsuptexting.com/opt-in) or by signing our demo consent form at https://headsuptexting.com/demo. Message frequency: up to 4 msgs/month. Msg & data rates may apply.

What we collect: when you opt in by text, your mobile phone number, the content of the message you sent, and the date and time you opted in. When you sign the demo form, also your name, business name, optional email, the exact consent wording shown, your typed signature, and the IP address and browser user-agent that submitted it. We also keep the messages we send you and your replies, including STOP and HELP.

How we use it: only to send you the text messages you opted into, to answer your HELP requests, and to honor your opt-out.

We do not sell, rent, or share mobile phone numbers or SMS opt-in data with third parties or affiliates for their marketing purposes.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except the service providers listed below that deliver the messages on our behalf.

Reply STOP to cancel or HELP for help at any time. For help call 979-587-4777 or email headsupsupport@gmail.com.

Cookies and tracking

We use only what the application needs to function: a session cookie set by our authentication provider (Clerk) and browser local storage for interface state. We do not use advertising cookies, cross-site trackers, or third-party analytics that profile you.

Service providers (subprocessors)

We share data only as needed with: Clerk (authentication), Stripe (billing), Twilio (SMS delivery and carrier registration), Resend (transactional email), Supabase (database hosting), Upstash/Redis (job queue), Railway and Vercel (application hosting), and Sentry (error monitoring). Each is bound by its own data-processing terms.

Data is processed in the United States. We disclose personal information to a government or law enforcement body only where legally compelled, and will notify the affected Customer unless prohibited from doing so.

Retention

Account and billing records: for the life of the account and 7 years afterwards, as required for tax and accounting.

Audience data: until you delete it or close your account, then removed within 30 days of a verified deletion request.

Consent and opt-out records: retained for at least 5 years even after the underlying contact is deleted. This is deliberate — an opt-out record is what stops a deleted-then-re-imported number from being messaged again, and a consent record is the evidence that the original opt-in happened. We treat these as a legal-obligation carve-out from deletion requests.

Message content and delivery logs: 2 years.

Error and diagnostic logs: 90 days.

Your rights

Depending on where you live you may have the right to access, correct, delete, or receive a portable copy of your personal information, to opt out of sale or sharing (we do neither), and to be free from discrimination for exercising these rights.

California residents (CCPA/CPRA), and residents of states with comparable laws, may exercise these rights by emailing headsupsupport@gmail.com. We will acknowledge within 10 business days and respond within 45 days, extendable once. We verify requests using the email address on the account.

If you are in the EEA or UK, we act on the legal bases of contract performance (providing the service), legitimate interests (security and service improvement), and legal obligation (retaining consent evidence). You may lodge a complaint with your supervisory authority.

To appeal a denied request, reply to our decision email; we will provide a substantive response within 45 days.

Security

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to production data is limited to personnel who need it. Application errors are reported with personal information stripped out.

No system is perfectly secure. If a breach affects your personal information we will notify affected Customers, and any regulators as required, without undue delay and in any case within the timeframes the applicable law requires.

Children

The service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child's information has been uploaded to the service, contact headsupsupport@gmail.com and we will delete it.

Changes and contact

We will post any change here and update the date above. Material changes will also be emailed to account owners at least 30 days before they take effect.

Contact: headsupsupport@gmail.com, 979-587-4777, 21508 Parker Road, Tomball, TX 77377.