HQMy Headquarters
Beta sign-inStart free

Privacy Policy

Last updated: July 23, 2026

A plain-English summary of how we handle your information while My Headquarters is in early access. Questions? Email hello@myheadquarters.ai.

Website vs. app. This policy covers the My Headquarters website, waitlist, and the private-beta app. The My Headquarters app keeps your working data — your emails, files, drafts, and teammate memories — in your own private workspace, encrypted in transit and at rest and isolated from other customers, and runs AI jobs through the AI providers you connect. We never use your working content to train AI models, and we never sell it. We improve My Headquarters only from the anonymous, count-only usage analytics described in section 2 — which record which features are used, never your content. You can download any of your documents anytime, or ask us by email to delete your account and everything in it. You are responsible for the data you choose to process with the app. See our Terms of Service for how the app is licensed.

1. Who we are

This website (myheadquarters.ai, “My Headquarters”) is operated by Nassau Group LLC(“we,” “us”), based in the United States at 2389 Main Street, Ste 100, Glastonbury, CT 06033, United States. Nassau Group LLC is the data controller for the information described here. For any privacy question or request, contact hello@myheadquarters.ai.

2. What we collect

We only collect what you give us, plus a little basic technical data:

  • Waitlist: your name, email address, and which plan you’re interested in.
  • Early access: your email address, your profession, an optional description of a task you’d like help with, and an optional answer to whether you already pay for a similar tool.
  • Marketing attribution: if you arrive from a campaign link, the referring site and campaign tags (utm_source, utm_medium, utm_campaign), so we know which channels work.
  • Security data: we briefly process your IP address to prevent spam and abuse of our forms. We do not store it with your sign-up.
  • Website analytics: on this website we use Vercel Web Analytics, a privacy-friendly, cookieless tool that measures aggregate page views and does not identify you personally.
  • In-app usage analytics (private beta): while you use the app, we record anonymous, count-only events tied to your account: sign-ins; which catalogue teammates you hire; which skills you switch on; which connectors you add; when you open a coaching session in the Training Room and which teammate it was for; the kind of change you applied there (playbook, skill, task, reference file, or voice) and when a session finished; the file type of a document you add (for example “pdf” or “docx”) and, if one can’t be read, the reason (for example “scanned-pdf”); and a once-a-day “this office was used today” heartbeat. These are stored as short category codes only: they are designed to contain no email, URL, message, draft, file, filename, search term, or other content, and we report them to ourselves de-identified (grouped, by an opaque account id — never your email). They help us learn what’s useful during the beta. You can turn this off: in the app, open Security → Data & privacy and switch off “Share anonymous usage stats”. Nothing is then recorded — not even a sign-in count — on this device or on our servers, and the choice follows your account to your other devices.
  • Messages you send us: if you use the in-app “Talk to HQ” box to send feedback or a question, our team reads it (shown to us with an opaque account id, not your email) so we can act on it. Don’t include sensitive personal data in that box.

Retention. Anonymous in-app usage events are kept while My Headquarters is in private beta so we can measure trends, and may be deleted or aggregated further over time. You can ask us to delete your account data anytime at hello@myheadquarters.ai.

3. Why we use it

To operate our waitlist and early-access list; to contact you about early access, launch, and founding pricing; to understand demand across professions and plans; and to keep our forms secure. We do not make automated decisions about you.

4. Legal basis (UK/EU visitors)

We rely on your consent when you submit a form to join our list (you can withdraw it anytime by unsubscribing or emailing us), and on our legitimate interests in measuring demand and protecting our site from abuse.

5. Where your data is stored & who processes it

We use trusted service providers (“sub-processors”) who process data on our behalf under contract:

  • Supabase — database hosting and sign-in (stores your account and app data).
  • Vercel — website and app hosting, and cookieless analytics.
  • Umami — privacy-first, cookieless analytics (aggregate page views only; no cookies and no identifier tied to you).
  • Google Analytics — deeper website analytics that does set cookies. It runs on the marketing site only after you accept the cookie banner; decline and it never loads. Provided by Google acting as our processor.
  • Resend — email delivery, used to send your sign-in code and any email about your account or spot.
  • The AI provider you connect — to carry out a task, the app sends only what that task needs (for example, the text of an email you ask a teammate to read) to the AI account you’ve connected — for example ChatGPT, Claude, DeepSeek, Gemini, Grok or Mistral. Your content runs under your own provider account and is governed by that provider’s terms; we never mark it up.
  • Web search (Tavily) — when a teammate does web research, the search query it composes is sent to Tavily, our managed search provider, to fetch results. Queries are used only to answer your request and are not used to train AI models.
  • Voice (ElevenLabs) — if spoken replies are enabled, the text a teammate says is sent to ElevenLabs to generate the audio. Off unless you turn it on.
  • Other tools you switch on — if you connect another tool, the app sends only what that tool needs (for example, a search query) to the service that powers it. We keep this list current as connectors are added.

Google user data & Limited Use

If you choose to connect a Google account (Gmail or Google Calendar), My Headquarters’s access to, and use and transfer of, information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

  • What we access. Only with your explicit consent on Google’s own screen, we request read access to your Gmail messages and permission to create Gmail drafts (gmail.readonly, gmail.compose), and read access to your calendar and permission to create calendar events (calendar.readonly, calendar.events). You can grant Gmail and Calendar separately, and connect neither.
  • Why. Solely to provide the features you ask for — for example summarizing an email, drafting a reply, or proposing and creating a calendar event. Everything is draft-only: we never send an email or finalize an event without your explicit approval.
  • We do not. We do not use your Google data for advertising; we do not sell it; and we do not use it to develop, improve, or train generalized or non-personalized AI/ML models.
  • Human access. No human reads your Google data, except: with your explicit consent (for example, to help you troubleshoot), where strictly necessary for security (such as investigating abuse), or to comply with applicable law.
  • Transfers. To carry out your request, only the specific content that task needs (for example, the text of the email you ask a teammate to reply to) is sent to the AI provider you have connected under your own account(for example Anthropic, OpenAI, or Google), and — only if you enable it — to a tool you connect. It is used only to fulfill your request, never to train those providers’ general models.
  • Storage & deletion. Google account tokens are stored encrypted and used only to perform your tasks. You can disconnect a Google account at any time in the app’s Connections settings, and you can ask us to delete your account and all associated data at hello@myheadquarters.ai.

6. How long we keep it

We keep waitlist and early-access details until we launch and for a reasonable period after, or until you ask us to delete them or unsubscribe — whichever comes first. We then delete or anonymize the data.

7. We don’t sell your data

We do not sell, rent, or trade your personal information, and we do not “share” it for cross-context behavioral advertising. We disclose it only to the sub-processors above, or if legally required.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your data, to object to or restrict processing, and to withdraw consent. California residents (CCPA/CPRA) have the right to know, delete, correct, and opt out of sale/sharing (we do neither), and not to be discriminated against for exercising these rights. UK/EU residents (GDPR) have the rights above and may complain to their local data-protection authority. To exercise any right, email hello@myheadquarters.aiand we’ll respond within the time the law requires. We may verify your identity by confirming control of the email on file.

9. Security

Your data is stored on managed infrastructure that encrypts it in transit and at rest, and access controls isolate your workspace so other customers’ teammates can’t reach it. Sensitive credentials — such as the API keys and connected-account tokens you provide — are additionally encrypted by us before they are stored. We decrypt your data only to carry out the tasks you ask for. No method is 100% secure, but we take reasonable steps to protect your information.

10. Children

This site and product are for adults and are not directed to children. We do not knowingly collect information from anyone under 18. If you believe someone under 18 gave us data, contact us and we’ll delete it.

11. International visitors

We are based in the United States and store data in the United States. If you access the site from elsewhere, you understand your information will be transferred to and processed in the US. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) with our providers.

12. Changes

We may update this policy; we’ll change the “Last updated” date above and, for material changes, take reasonable steps to notify you.

13. Contact

Nassau Group LLC, 2389 Main Street, Ste 100, Glastonbury, CT 06033, United States — hello@myheadquarters.ai.

← Back to home