Privacy Policy

Effective date: October 4, 2026

This Privacy Policy describes how Heimdall ("Heimdall," "we," "us," or "our") collects, uses, stores, protects, and shares information when you use our website and services. By using Heimdall, you agree to the practices described in this policy.

1. Information provided by users

When you use Heimdall, we collect information you choose to provide, including:

Account and contact details, such as your name and email address.
Education and professional background, such as your school and area of study.
Career interests and campaign preferences, such as the type of opportunity, industry, location, and compensation preferences you provide.
Résumés or other materials you upload.
Personal profile information you choose to share about your background, strengths, and interests.
Support communications, such as messages you send us and feedback you submit.
Subscription and payment records, such as your plan, subscription status, billing period, payment status, and identifiers from our payment processor (for example a customer or subscription ID).

Full payment card information is processed directly by our payment processor and is not collected or stored by Heimdall.

Early-access career tools. If we invite you to our early-access career tools and you connect GitHub, Heimdall reads only the repositories you choose, to understand the skills shown in your work. You can disconnect GitHub at any time.

2. Google account and Gmail information

Heimdall offers an optional Google account connection so that outreach emails can be sent from your own Gmail account. When you choose to connect Gmail, Heimdall requests the following Google permission:

gmail.send — used only to send outreach messages that you have reviewed and that have been approved for delivery from your connected Gmail account.

Heimdall does not use this permission to read the content of your inbox, and does not use this permission to modify or delete any messages in your inbox. Heimdall cannot access, search, or view your existing emails through this connection.

To maintain the connection, Heimdall may store limited information such as your connected Gmail address, the connection's status, and an authorization credential that allows Heimdall to send messages on your behalf. This authorization credential is used solely to provide the connected Gmail sending functionality described above, is stored using industry-standard safeguards, and is never used for any purpose beyond sending your approved outreach.

3. How information is used

We use the information described above to:

provide and improve the services you request;
research relevant opportunities on your behalf;
generate and quality-check outreach drafts;
send outreach only after the required review and approval steps;
maintain your account and any connected services, including Gmail;
prevent fraud, misuse, abuse, and security incidents;
process transactions and payments;
provide customer support; and
comply with applicable legal obligations.

4. Review and human access

Heimdall's process includes review steps to help ensure outreach is accurate and appropriate before it is sent. Authorized operators may review information as necessary to understand your campaign requirements, assess research evidence supporting a proposed contact, review drafted outreach, conduct quality control, and manage fulfillment of your campaign. Access to this information is limited to legitimate operational purposes connected to providing the service you requested.

Heimdall chat conversations. When you are signed in and send a message in the Heimdall chat on our home page, the message and Heimdall’s reply are saved to your account, together with the search details worked out in the conversation, so you can return to the conversation later. To generate replies, your messages are processed by our AI service provider. Authorized Heimdall operators can read these conversations through Heimdall’s internal operator dashboard to help you and to improve Heimdall, and each time an operator opens one of your conversations, that access is recorded. The text of these messages and replies, and the saved search details, are redacted 30 days after the conversation starts; we keep limited records without the text, such as when messages were sent and how many there were. The Heimdall chat does not currently offer a control to delete these conversations yourself; you may request deletion at any time by contacting heimdallnetwork@gmail.com. This is separate from optional live typing, described below.

Typing indicator. When you’re signed in, the Heimdall chat lets our team know while you’re typing. It shares only that you’re typing, never what you type, so we can help in real time.

Optional live typing (beta, when offered). If you turn on “Share live typing with the Heimdall team” in the Heimdall chat, authorized Heimdall operators can see what you type in the Heimdall chat box as you type it, including text you have not sent, and whether Heimdall is replying. It is off unless you turn it on, you can turn it off at any time next to the chat box, and the chat works the same either way. Only the Heimdall chat box is shared, not other fields, pages, tabs, or apps. Unsent text is transmitted live and is not saved or sent to our AI providers, and it disappears from the operator view when you send it, delete it, stop typing for two minutes, sign out, or turn sharing off. We keep a record of when you turned sharing on or off and when operators viewed live typing, without the text itself.

5. Service providers

We use service providers for functions such as cloud infrastructure, authentication, workflow operations, artificial-intelligence assistance, payment processing, email authorization, hosting, security, and customer support. These providers may process information only as necessary to provide services to Heimdall, comply with law, protect their own systems, or enforce their agreements with us.

Google is named specifically because you directly authorize Google to connect to Heimdall. Stripe is named specifically because you make payments directly through Stripe. We do not name every service provider individually, and this policy should not be read to imply that every provider we use receives Google user data.

6. Google API Services User Data Policy

Heimdall's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data obtained through the Gmail connection described above is not:

sold;
used for serving advertisements, including retargeting, personalized, or interest-based advertising;
transferred to data brokers or other information resellers;
used to determine credit-worthiness or for lending purposes; or
used for unrelated surveillance of individuals.

Heimdall does not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models, and does not transfer Google user data to any third party for that purpose. Outreach drafts are generated by our AI service provider, OpenAI, from information you provide to Heimdall (your search details, your résumé if you attach one) and from publicly available information about organizations. No data obtained from your Gmail account is sent to OpenAI or any other AI provider; Gmail access is used only to send messages you have approved.

7. Data sharing

We may share information:

with service providers who perform functions on our behalf, as described above;
when you direct or authorize us to do so;
when required by law, regulation, or valid legal process;
to protect the safety, rights, or property of Heimdall, our users, or others; and
in connection with a merger, acquisition, financing, or sale of business assets, subject to appropriate protections for the information involved.

8. Security

We use administrative, technical, and organizational safeguards designed to protect the information we handle. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Retention and deletion

We retain information for as long as reasonably necessary to provide our services, maintain business records, resolve disputes, prevent fraud, satisfy legal obligations, and protect the service. You may request deletion of your information by contacting heimdallnetwork@gmail.com. Some information may be retained where reasonably necessary for legal, accounting, security, or legitimate operational purposes even after a deletion request.

We may use, access, review, or analyze information from your interactions with Heimdall as reasonably necessary to provide, maintain, support, secure, troubleshoot, and improve our services. Raw career conversation content is generally retained for up to 30 days, after which it is deleted or redacted in accordance with our retention practices. Certain related account, usage, derived, security, or other information may be retained for longer as described in this Policy. The text of home page chats is erased automatically after 30 days. To delete it sooner, contact heimdallnetwork@gmail.com.

10. Revoking Google access

You may revoke Heimdall's access to your Google account at any time through your Google Account's third-party connections or permissions settings at myaccount.google.com/permissions. Revoking access prevents Heimdall from sending further messages through your connected Gmail account going forward.

11. Your choices and rights

You may contact us to request access to, correction of, or deletion of your information, to ask for help with your account, or to disconnect your Gmail connection. Contact us at heimdallnetwork@gmail.com.

12. Children and students

Heimdall's services are intended for use by students, including high-school-aged students, working with a parent or legal guardian's awareness and involvement where appropriate, particularly with respect to any payment made on their behalf. Heimdall does not knowingly collect personal information from children in a manner inconsistent with applicable law. If you believe a child has provided us with information in violation of this policy, please contact us at heimdallnetwork@gmail.com so we can address it.

13. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above. Your continued use of Heimdall after a change becomes effective constitutes acceptance of the revised policy.

14. Contact

Questions about this Privacy Policy can be directed to heimdallnetwork@gmail.com.