1. Introduction
HeaderHawk ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you use our CSP monitoring service.
2. Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Name (optional)
- Organization name
- Authentication credentials (managed by our auth provider)
CSP Report Data
When you configure your sites to send reports to HeaderHawk, we receive:
- CSP violation details (blocked URI, violated directive, etc.)
- Document URL where the violation occurred
- The referring URL, where the browser sends one
- Browser and user agent information
- The IP address the report was sent from, stored with the raw report
- Timestamps
CSP reports may contain URLs from your users' browsers. We do not use this data to track individual users, and we do not sell or share it. It is deleted on the retention schedule for your plan.
Payment Information
For paid subscriptions, payment details are collected and processed by Stripe. We do not store credit card numbers on our servers.
Usage Data
We collect anonymized analytics about how you use our service, including pages visited and features used.
3. How We Use Your Information
We use your information to:
- Provide and maintain the HeaderHawk service
- Process your CSP reports and display analytics
- Send service-related notifications
- Process payments for paid subscriptions
- Improve our service based on usage patterns
- Respond to support requests
- Detect and prevent abuse
4. Third-Party Services
We use the following third-party services to operate HeaderHawk:
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe | Payment processing | Email, billing address, payment method |
| Descope | Authentication | Email, name, auth tokens |
| Tinybird | CSP report analytics | CSP reports (your data) |
| Axiom | Application logging | Request logs, error traces |
| Neon | Database hosting | Account and site configuration |
| AWS | Infrastructure hosting | All service data |
| Umami | Product analytics | Anonymized page views |
Each service has its own privacy policy governing their use of data. The security page lists what each one receives and the region it runs in, with the date the list was last reviewed.
5. Data Retention
We retain your data according to these guidelines:
- Account data: Retained while your account is active, deleted within 30 days of account closure
- CSP violation reports: Retained according to your plan — 15 days on Free, 30 on Team, and 60 on Professional and Business — then deleted from both the raw report store and the analytics store
- Script integrity reports: Retained on the same schedule as violation reports — 15 days on Free, 30 on Team, and 60 on Professional and Business
- Payment records: Retained for 7 years for tax and legal compliance
- Usage logs: Retained for 90 days
6. Data Security
We implement appropriate technical and organizational measures to protect your data:
- Data encrypted in transit (TLS) and at rest
- Access controls and authentication requirements
- Regular security assessments
- Incident response procedures
7. Your Rights
You have the right to:
- Access: Request a copy of your data
- Correction: Update inaccurate information
- Deletion: Request deletion of your account and data
- Portability: Receive a copy of your data. HeaderHawk has no export or download feature, so this is fulfilled by hand from the stores described on the security page
- Object: Opt out of certain data processing
To exercise these rights, contact us at privacy@headerhawk.com.
8. Cookies
We use cookies for:
- Authentication: To keep you logged in
- Preferences: To remember your settings (e.g., dark mode)
- Analytics: To understand service usage (via Umami, privacy-focused)
We do not use cookies for advertising or tracking across websites.
9. International Data Transfers
Our services are hosted in the United States. If you access Header Hawk from outside the US, your data will be transferred to and processed in the US. We use standard contractual clauses and other safeguards for international transfers where required.
10. Children's Privacy
HeaderHawk is not intended for use by children under 16. We do not knowingly collect information from children. If we learn we have collected data from a child, we will delete it promptly.
11. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of material changes via email or through the service. The "Effective" date at the top indicates when the policy was last updated.
12. Contact Us
For privacy questions or concerns, contact us at:
- Email: privacy@headerhawk.com