Apply for a founding spotApply now

Privacy Policy

HeadRail, getheadrail.com

Draft, last updated October 14, 2026. Under legal review.

HeadRail is software for window treatment dealers. Reps use it to show blinds and shades on a photo of a customer's window and to quote from the dealer's price book. Dealers can also put a HeadRail widget on their own website so homeowners can try a preview and ask for a quote.

This policy explains what we collect on this marketing site, what the HeadRail app collects for dealers and their customers, and what we do with it. HeadRail is operated by [legal entity name], [business address] ("HeadRail", "we", "us").

The short version

  • This marketing site has no analytics, no tracking cookies and no third-party scripts. Our fonts are hosted on our own server.
  • If you ask for a demo, we keep what you type in the form so we can contact you about HeadRail.
  • Homeowner window photos are used only to make previews and to attach to a quote request. We never sell them and never use them for advertising.
  • For homeowner leads, the dealer decides what happens to the data. We process it for the dealer.

This website and demo requests

You can read getheadrail.com without giving us anything. The marketing pages set no cookies, run no analytics and load nothing from other companies. Our server keeps basic request logs (time, page, result code and a request id) to run and secure the site. It does not log form contents.

When you fill in the demo request form on /demo, we collect:

  • your name, business name and email address;
  • your phone number and website, if you give them;
  • the main manufacturer you sell and your team size;
  • your message, if you write one;
  • which page or button you came from, any campaign tags in the link (for example utm_source) and the name of the website that linked you here, so we know which parts of the site are useful.

We store the request in the HeadRail database and email it to HeadRail staff so someone can follow up. We use it only to contact you about HeadRail, set up a walkthrough and, if you become a dealer, start your account. We don't sell it, and we don't add you to a marketing list unless you ask.

To stop spam, we limit how many requests can come from one connection. For that we keep a one-way hash of your IP address for about an hour, not the address itself. The hash is not stored with your request.

We keep demo requests for [retention period for demo requests] unless you become a dealer, in which case the details move into your dealer account. You can ask us to delete your request at any time.

Cookies

The marketing pages use no cookies. The HeadRail app sets one session cookie, only after a dealer or staff member signs in, to keep them signed in. It is not used for tracking or advertising.

Who is responsible for what

For demo requests and dealer accounts, HeadRail decides how the data is used and is responsible for it.

For homeowner data collected through the app or a dealer's website widget, the dealer is in charge (the "controller"). HeadRail processes that data on the dealer's behalf and following the dealer's settings (the "processor"). If you are a homeowner and want to see, change or delete your information, the dealer you asked for a quote is the best first contact. We will help the dealer handle the request.

What the app collects about homeowners

  • Your window photo, when you or a rep make a preview. It is sent to our AI image provider to create the preview.
  • Your design choices, such as product, fabric, color, mount and options.
  • Contact details, only if you ask for a quote: name, email and/or phone, an optional message, the design and, if you choose, the photo.
  • The consent wording you agreed to and when you agreed.
  • Optional follow-up consent. A separate box, unticked by default, lets the dealer keep your photos and project to show you ideas for other rooms and send occasional offers by email. You can unsubscribe at any time with the link in those emails.
  • Orders, if you buy: products, sizes and install date.
  • Technical data. Your IP address is used briefly to limit abuse and kept only as a one-way hash. Server logs never contain photos or form contents.

What the app collects about dealer staff

For each staff account we keep a name, email address, a hashed password (we never store the password itself), the role, and the activity needed to run the account. A dealer's catalog, prices and logo belong to the dealer.

How we use homeowner photos

Photos are used to make the preview and, if you send a quote request, to attach to that request in the dealer's inbox. We do not sell photos, do not use them in advertising and do not use them to train AI models. [Confirm that the AI image provider's terms also rule out training on these photos.]

People sometimes appear in window photos by accident. If you can, take the photo without faces in it.

Who we share data with

We share data only to run the service:

  • The dealer you asked for a quote, and anyone or anything the dealer connects, such as their staff, a notification email or a webhook to their own CRM.
  • Our AI image provider, [AI image provider name], which receives the window photo and a description of the chosen product to create each preview. [Provider location and whether it keeps inputs: to be verified.]
  • Our hosting provider, [hosting provider and region], which runs our servers and stores the database.
  • Our email provider, [email provider name], when email notifications are turned on.
  • Authorities, when the law requires it.

We keep a list of these service providers and will tell dealers before we add or change one.

How long we keep it

  • Preview photos not sent with a quote request are not stored by us after the preview is made.
  • Photos attached to a quote request are deleted automatically after the dealer's retention period. The default is 90 days, and the dealer can change it. If you gave the optional follow-up consent, the photos are kept until the quote record is deleted, or until you unsubscribe or ask the dealer to stop, whichever comes first.
  • Quote details and orders are deleted automatically after the dealer's maximum period. The default is 24 months from your quote or, if you bought, from your latest purchase or install date. The dealer can set it between 1 and 60 months, or delete a lead sooner.
  • Demo requests are kept as described above.
  • Backups may hold a copy for up to [backup retention period] after deletion.

Your choices and rights

You can ask to see, correct or delete your information. Homeowners should start with the dealer; dealers and anyone who sent a demo request can contact us. We delete records on request, typically within [number of days] days. If a dealer exported your data or sent it to their own systems, the dealer must delete those copies too.

[Region-specific rights, for example under CCPA/CPRA or GDPR, to be added after legal review.]

Security

Passwords are hashed, connections use HTTPS, each dealer's data is kept separate from every other dealer's, and access inside a dealer account depends on the person's role. Reps never see the dealer's cost or margins. No system is perfectly secure. [Breach notification commitments to be added after legal review.]

Children

HeadRail is meant for adults. We do not knowingly collect information from children.

Changes

When we change this policy we will update it here and change the date at the top. For significant changes we will also tell dealers directly.

Contact

A contact email for privacy questions will be listed here. Until then, please reach us through the demo request page and say your message is about privacy.