Legal

Privacy Policy

Effective October 9, 2026

headcount1 is operated by GMGM sp. z o.o., a company registered in Poland, referred to in this document as “headcount1”, “we” and “us”. This policy explains what personal data we collect through the headcount1 website and through headcount1 Cloud, the hosted service at app.headcount1.ai, what we do with it, and what choices you have.

01Scope

This policy covers this website and headcount1 Cloud. GMGM sp. z o.o. is the controller of the personal data described here.

It does not cover self-hosted headcount1. If you run the open-source software yourself, your data stays on your infrastructure, the software sends us no telemetry, and whoever operates that instance is responsible for the data in it.

02Data we collect

On this website we collect almost nothing. It sets no cookies and runs no analytics or advertising trackers. Like any website, our hosting provider processes your IP address and browser details to deliver the pages, and the fonts are loaded from Google Fonts, so Google receives your IP address when the page loads.

In headcount1 Cloud we process:

Account data. Your email address, your team memberships, and the email addresses of people you invite.
Passkey data. The public key and identifier of each passkey you register. Your fingerprint, face or device PIN never leaves your device and we never receive it.
Your content. Companies, projects, tasks, comments, agent conversations and results, the files and repositories in your workspaces, and the memory the agents keep about your projects.
Stored secrets. The API keys, MCP tokens and SSH keys you add. They are encrypted with AES-256-GCM under a key that your passkey unlocks and that exists only in memory while you are signed in. We hold no master key, so we cannot read them while you are signed out.
Integration data. If you connect GitHub or other tools: installation and repository identifiers, your username on that service, and the events and comments those services send us for your repositories.
Usage and billing data. Which models your agents called, how many tokens they used and what that cost. Card details are handled by our payment processor; we do not store card numbers.
Technical data. IP address, browser type, and timestamps in server and security logs.
Messages you send us. Support requests and other correspondence.

03Cookies

This website sets no cookies.

headcount1 Cloud sets only the cookies it needs to work: session and refresh cookies that keep you signed in, a CSRF token that protects your requests, and a short-lived cookie used during account recovery. There are no advertising or cross-site tracking cookies.

04How we use data

to run the service: sign you in, store your work, and carry out the tasks you give your agents
to keep the service secure and to prevent abuse and fraud
to measure usage and bill you for it
to send service emails: account recovery links, team invitations, billing and security notices, and notices of changes to our terms
to answer you when you contact us
to understand, in aggregate, how the service is used so that we can fix and improve it
to meet legal obligations

We do not sell personal data, we do not show ads, and we do not use your content to train AI models.

05Legal bases

Where the GDPR or similar law applies, we rely on: performance of our contract with you (running the service and billing), our legitimate interests (security, abuse prevention, improving the service), legal obligations (tax and accounting records), and your consent where we ask for it.

06Who receives data

AI model and inference providers. To carry out a step of a task, the relevant prompt and task content is sent to the model chosen for it, either the provider you connected or one selected by our router. Their handling of that data is governed by their own terms.
Services you connect. GitHub, MCP servers and other tools receive what your agents send them when acting on your tasks.
Infrastructure providers. Hosting and content delivery, email delivery, and payment processing, each acting on our instructions and only to the extent needed.
Your teammates. People you invite can see the companies you share with them.
Authorities and counterparties. When the law requires it, or when it is necessary to protect rights, safety or the security of the service.
A successor. If the service is merged or acquired, your data may move to the new operator under terms no less protective than these.

07Retention

We keep account data and your content while your account exists. When you delete a company, a project or your account, we delete the data in it. Stored secrets are destroyed at that moment by discarding their encryption key.

Copies in backups disappear as those backups rotate out. Logs are kept for a limited period for security and debugging. Billing records are kept for as long as tax and accounting law requires.

08Security

Sign-in uses passkeys only, so there are no passwords to steal. Stored secrets are encrypted per user with no master key on our servers. Agents run in a sandbox that can write only to the workspace of their task and cannot see the server’s data or keys. Traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

09International transfers

We and our providers may process data in countries other than yours. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on a lawful transfer mechanism such as the standard contractual clauses.

10Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can withdraw consent at any time where we rely on it, and you can complain to your local data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO).

You can see and change most of your data directly in the app. For anything else, write to legal@headcount1.ai. We answer within 30 days.

We do not sell or share personal data as those terms are defined in California law, and we do not treat you differently for exercising your rights.

11Children

The service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, tell us and we will delete it.

12Changes to this policy

We may update this policy. The date at the top shows the current version. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.

13Contact

GMGM sp. z o.o., ul. Szlak 77/222, 31-153 Kraków, Poland, NIP 6762685956. Privacy questions and requests: legal@headcount1.ai.