Governance document

CA-D-000706

Heap Privacy Policy

Heap

Last change detected August 18, 2026 Privacy policy

SHA-256: eac209e010b03674ebd… 2 versions captured 0 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Heap ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

93 Total

27 High severity

52 Medium severity

14 Low severity

Key Facts

What right does Heap grant to California users?

Heap grants California users the right to request deletion of their personal information that Heap has collected from them.

What personal information does Heap grant California users the right to request deletion of?

Heap grants California users the right to request deletion of their personal information that Heap has collected from them.

Do users have the right not to receive discriminatory treatment because they exercised rights under the CCPA?

Heap acknowledges that users have the right not to receive discriminatory treatment because they exercised any of their rights under the CCPA.

What right does Heap grant users regarding their personal information?

Heap grants users the right to request that Heap not sell their personal information or share it for cross-context behavioral advertising purposes, as those terms are defined under the CCPA.

Does Heap grant users the right to request that Heap not sell their personal information or share it for cross-context behavioral advertising purposes?

Heap grants users the right to request that Heap not sell their personal information or share it for cross-context behavioral advertising purposes, as those terms are defined under the CCPA.

When must these safeguards be in place?

Heap places responsibility on the Customer to ensure that appropriate data protection safeguards are in place before processing personal data from the Customer's Visitor.

What have Heap's US CS entities committed to refer unresolved privacy complaints under the Data Privacy Framework to?

Heap's US CS entities have committed to refer unresolved privacy complaints under the Data Privacy Framework to the American Arbitration Association's International Centre for Dispute Resolution (ICDR-AAA).

What governs over the Heap Privacy Policy in the event of any conflict?

Heap establishes that the Data Privacy Framework Principles govern over the Heap Privacy Policy in the event of any conflict between them.

Do the Data Privacy Framework Principles govern over the Heap Privacy Policy?

Heap establishes that the Data Privacy Framework Principles govern over the Heap Privacy Policy in the event of any conflict between them.

Does Heap reserve the right to change its Privacy Policy?

Heap reserves the right to change its Privacy Policy from time to time in its sole discretion.

Stay ahead of the changes

Track Heap and get the diff the day its terms change.

Monitor Heap + up to 20 platforms — $4.99/mo →

Featured, High severity

California right to delete personal information Compare →

This clause establishes a user-actionable right to seek erasure of personal data Heap holds, giving users a mechanism to limit Heap's retention of their information.

Added July 11, 2026 Standard Seen across 290 platforms
California right to nondiscrimination for exercising rights Compare →

This clause establishes that users are protected from retaliation or differential treatment when they invoke their CCPA privacy rights, reinforcing the practical usability of those rights.

Added July 11, 2026 Standard Seen across 290 platforms
California right to opt out of sale or sharing Compare →

This clause establishes an opt-out right that directly limits how Heap can monetize or distribute user data for advertising, as defined by California law.

Added July 11, 2026 Standard Seen across 290 platforms
Customer must ensure data protection safeguards for visitors Compare →

This clause shifts the compliance burden for Visitor data protection onto the Customer rather than Heap, which affects who bears legal and operational responsibility for protecting end-user data.

Added July 11, 2026 Standard Seen across 297 platforms
Data Privacy Framework Principles govern over privacy policy Compare →

This clause determines the controlling authority when Heap's stated privacy practices diverge from the Data Privacy Framework Principles, meaning the Principles set the effective floor for data handling regardless of what the Privacy Policy says.

Added July 11, 2026 Standard Seen across 267 platforms
DPF complaints referred to ICDR-AAA arbitration Compare →

This clause designates the specific dispute resolution forum and mechanism for unresolved Data Privacy Framework privacy complaints, determining where and how users can escalate such complaints.

Added July 11, 2026 Standard Seen across 206 platforms
Heap reserves right to change privacy policy Compare →

This clause means the terms governing how Heap handles user data can be altered by Heap alone, without requiring user consent or agreement.

Added July 11, 2026 Standard Seen across 289 platforms
Heap sold or shared personal data categories in last 12 months Compare →

This clause discloses that Heap has actually engaged in the sale or sharing of specific categories of personal information within the past year, which directly informs users of the scope of data monetization or distribution that has occurred.

Added July 11, 2026 Standard Seen across 288 platforms
Prohibition on using user content for ads Compare →

This clause establishes a firm prohibition on using or sharing user content for advertising or marketing, with a narrow exception only where the user explicitly submitted content for that purpose, directly limiting how Heap can monetize user content.

Added July 11, 2026 Standard Seen across 245 platforms
Service not intended for children under 16 Compare →

This clause establishes both an intended-audience restriction and a data collection prohibition with respect to children under 16, limiting Heap's permissible engagement with that age group.

Added July 11, 2026 Common Seen across 148 platforms
Sharing with online advertising and social networks Compare →

This clause discloses an active practice of sharing or enabling collection of personal information for targeted advertising, directly affecting user privacy with respect to third-party ad partners.

Added July 11, 2026 Standard Seen across 288 platforms
System recording of unsubmitted typed information Compare →

This clause discloses that data capture is not limited to information the user intentionally submits, meaning unsubmitted drafts or partially typed entries may still be collected and retained by Heap.

Added July 11, 2026 Standard Seen across 296 platforms