Privacy Policy

1. Who is responsible for your data

Softway Solutions S.R.L., trading as HeadwayApps, is the data controller for the personal data described in this policy. Our registered office is Nicolae Filipescu 53-55, 4th Floor, Room 6, Bucharest, Romania (trade register number RO48862248, VAT/CUI RO48862248). For any privacy question, email[email protected].

Where you use our products to process data about your own customers — files uploaded through a FileDrop form, rows merged by ActiveMerge, addresses checked by Verifence — you are the controller of that data and we act as your processor, handling it only on your instructions.

2. What we collect

Data you give us

• Account data: name, email address, password hash, company name, and the products or plans on your account.
• Purchase data: what you bought, when, the amount, billing country, VAT number where relevant, and the last four digits and brand of the card. Full card details go to Stripe, not to us.
• Support data: the content of emails and support messages you send us.
• Content you submit: files, spreadsheet data, templates, video links, and the output generated from them.

Data we collect automatically

• Usage data: features used, credits consumed, jobs run, error logs, and timestamps.
• Device and connection data: IP address, browser type, operating system, and referring page.
• Analytics and session data: pages viewed and interactions on this website, collected through the tools listed in section 6.

Data from connected services

If you connect a Google account, we access only the Google data needed to run the feature you asked for. What we access and how we use it is set out in full in theGoogle Disclosure.

3. Why we use it, and our legal basis

• To provide the services — creating your account, running jobs, delivering output and licence keys. Legal basis: performance of a contract.
• To take payment and meet accounting obligations — invoicing, tax records, fraud prevention. Legal basis: contract and legal obligation.
• To support you — answering questions, investigating bugs. Legal basis: contract and legitimate interests.
• To keep the services secure and working — rate limiting, abuse detection, diagnostics. Legal basis: legitimate interests in running a safe service.
• To understand and improve the site — analytics and session replay. Legal basis: consent where required, otherwise legitimate interests.
• To market our products — product updates and offers by email, and advertising measurement. Legal basis: consent, or legitimate interests for emails to existing customers about similar products. Every marketing email has an unsubscribe link.

4. Who we share it with

We do not sell personal data. We share it with service providers who process it on our behalf under contract, including:

• Stripe — payment processing and billing;
• Google Cloud and Google Workspace APIs — hosting and connected features;
• Email and support providers — transactional and support email;
• Analytics providers — the tools named in section 6;
• AI processing providers — for features that generate documents, summaries, or transcripts. Content sent for AI processing is used to produce your output, not to train third-party models.

We may also disclose data where the law requires it, to enforce ourTerms and Conditions, or in connection with a merger or sale of the business — in which case we will tell you before your data becomes subject to a different policy.

5. International transfers

Some of our providers are based outside the European Economic Area. Where data is transferred outside the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with additional safeguards where they are needed. You can ask us for details of the safeguards used for a specific transfer.

6. Cookies, analytics, and tracking

This website uses:

• Clicky — privacy-oriented website analytics, to see which pages and products get attention.
• Microsoft Clarity — session and heatmap analytics, to see where pages confuse people. Clarity records interactions with the page, not your keystrokes in form fields.
• Meta Pixel — advertising measurement, so we can tell which campaigns lead to sign-ups.

Our products also set cookies that are strictly necessary to keep you signed in and to keep sessions secure. You can block or delete cookies in your browser, though necessary cookies have to be allowed for the apps to work. Where consent is required for analytics or advertising cookies, we ask for it before those tools load.

7. How long we keep it

• Account data: for as long as your account is open, then up to 12 months.
• Content you submit: until you delete it, or according to the retention setting in the product you are using.
• Invoices and tax records: for the period Romanian accounting law requires, currently 10 years.
• Support email: up to 3 years after the conversation ends.
• Server and security logs: up to 12 months.

8. Security

We use encryption in transit, access controls, least-privilege credentials for internal systems, and regular patching. No system is perfectly secure, but if a breach affects your personal data and is likely to put your rights at risk, we will notify you and the supervisory authority as the GDPR requires.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data, where we have no overriding obligation to keep it;
• restrict or object to processing, including a blanket objection to direct marketing;
• port your data to another provider in a machine-readable format;
• withdraw consent at any time, without affecting processing done before you withdrew it.

Email [email protected] to exercise any of these. We respond within one month. If you think we have handled your data badly, you can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

10. Automated decision-making

We do not make decisions with legal or similarly significant effects about you by purely automated means. Verifence scores email addresses and form submissions automatically, but the decision to accept or reject a signup based on that score is made by the customer running the form, not by us.

11. Children

Our services are for business use and are not directed at children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We will update this policy as our products and obligations change. The date at the top shows the current version, and we will tell account holders by email before any material change takes effect.

13. Contact

Softway Solutions S.R.L., Nicolae Filipescu 53-55, 4th Floor, Room 6, Bucharest, Romania. Email:[email protected].