Privacy Policy

Last updated: April 25, 2026 · Headwater Intelligence · Vancouver, BC, Canada

Headwater provides community intelligence services by analyzing publicly available data. This policy explains what data we collect, how we use it, and what rights you have. We are committed to transparency about our practices and to protecting the privacy of both our clients and the community members whose public data we analyze.

1. Who We Are

Headwater is operated by Sam Fath, based in Vancouver, British Columbia, Canada. For any privacy-related questions, contact us at [email protected].

2. Data We Collect From Clients

When you engage Headwater for a report or ongoing service, we collect:

• Your name, email address, and contact information
• Your YouTube channel URL
• Payment information (processed by Stripe; we do not store card details)
• Communications between you and Headwater

3. Data We Analyze (Public YouTube Data)

We analyze publicly available data from YouTube via the YouTube Data API v3. This includes:

• Channel metadata (title, description, subscriber count, video count)
• Video metadata (titles, publication dates, view counts, like counts, comment counts)
• Comment metadata (author display names, like counts, publication dates, reply counts)
• Commenter engagement patterns (videos commented on, engagement frequency)

4. How We Handle Community Member Data

Community members (YouTube commenters) whose public data we analyze are treated with the following protections:

• Pseudonymization by default: Everyday community members are represented by anonymous identifiers in our reports, not their real usernames
• VIP exception: Verified accounts, known brands, or established creators are identified by name when their engagement is relevant to the analysis
• No cross-platform tracking: We do not attempt to identify community members across platforms
• No PII collection: We do not collect personally identifying information about community members beyond their public YouTube display names
• Behavioral patterns, not profiles: Our reports describe community-level behavioral patterns, not individual surveillance profiles
• AI processing: Public comment text is processed through Anthropic's Claude API (for pattern recognition and thematic analysis) and Google's embedding models (for semantic clustering and similarity analysis). These services process the data to return results to us and do not retain it for their own purposes. Anthropic does not use API inputs for model training

5. What We Store

We do store:

• Aggregated, derivative intelligence (community health scores, engagement tier classifications, growth metrics)
• Video performance metrics and engagement patterns
• Generated reports (retained for 12 months after delivery unless earlier deletion is requested)

We do not permanently store:

• Raw comment text (fetched from YouTube API when generating reports, not retained in persistent databases)
• Private or restricted YouTube content
• YouTube account credentials or access tokens

6. Data Retention

• Analysis data: Retained for 90 days after report delivery to support follow-up questions and check-ins, then deleted
• Monthly partnership data: Retained for the duration of the engagement
• Generated reports: Retained for 12 months after delivery
• YouTube API data: Refreshed or deleted within 30 days per YouTube's Developer Policies
• Client contact information: Retained for the duration of the service relationship plus 90 days

You may request deletion of your data at any time by emailing [email protected].

7. Third-Party Services

We use the following third-party services in delivering our work:

• YouTube Data API v3: For accessing public channel and comment data. Subject to Google's Privacy Policy
• Anthropic (Claude): For AI-assisted pattern recognition, thematic analysis, and natural language processing of public comment data. Public comment text is sent to Anthropic's API for analysis. Subject to Anthropic's Privacy Policy. Anthropic does not use API inputs to train its models
• Google Embedding Models: For generating text embeddings used in semantic analysis, clustering, and similarity scoring of public comment data. Public comment text is sent to Google's API for embedding generation. Subject to Google's Privacy Policy
• Web3Forms: Powers the intake form on our website. When you submit the intake form, your name, email, channel URL, niche, audience size, and decision text are transmitted to Web3Forms, which forwards the submission to us by email. Subject to Web3Forms' Privacy Policy
• Stripe: For payment processing on paid engagements. Stripe handles all payment card data; we never see or store your full card number
• Cloudflare: For website hosting and security

8. Your Rights

Under British Columbia's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Know what personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw consent for data processing
• Receive a copy of your data in a portable format

To exercise any of these rights, email [email protected] with the subject line "Privacy Request." We will respond within 30 days.

9. Cookies and Website Analytics

The Headwater website (headwater.cc) does not use cookies for tracking, analytics, or advertising. Our hosting and security provider may set strictly necessary cookies (such as Cloudflare's __cf_bm and _cfuvid) for bot detection and DDoS protection. If we add analytics or other cookies in the future, this policy will be updated accordingly.

10. YouTube API Services Disclosure

This service uses YouTube API Services. By using our Service, you acknowledge and agree to be bound by the YouTube Terms of Service. Please review Google's Privacy Policy for information about how Google handles data.

Headwater accesses YouTube data via the public YouTube Data API v3 using our own API credentials. We do not authenticate as you, request OAuth access to your account, or hold any access tokens that grant continued access to your account — so there is no per-user account access for you to revoke. If you want us to stop analyzing your channel's public data, contact us at [email protected] and we will cease analysis and delete any retained data per Section 6.

11. Changes to This Policy

We may update this policy as our practices evolve. Material changes will be communicated via email to active clients. The "last updated" date at the top of this page reflects the most recent revision.

12. Contact

For any privacy-related questions or concerns:

Headwater Intelligence
Sam Fath
Email: [email protected]
Vancouver, BC, Canada