How HEIMDALL collects, uses, stores, and protects your data.
HEIMDALL is a lead-discovery and outreach platform for ecommerce operators. We process two kinds of data:
HEIMDALL is a product of AESIR, a defense technology and AI company founded by Gage Ludwig. The general AESIR privacy policy (projectaesir.com/privacy) covers all AESIR products at a high level; this policy is the detailed HEIMDALL-specific version that OAuth providers (TikTok, Meta, Google, LinkedIn, X) require us to publish.
When you sign up and use HEIMDALL we collect:
| Field | Source | Why |
|---|---|---|
| Email, name, hashed password | You provide at signup | Authentication, account ownership. |
| Organization / tenant name | You provide at signup | Multi-tenant data isolation. |
| Brand profile (services, value prop, tone) | You enter in Settings | AI-personalized outreach drafting. |
| Social handles for IG / TikTok / YouTube / LinkedIn / X | Optional — you enter | So the AI knows your niche & audience. |
| OAuth access tokens for connected platforms | Provider returns after you authorize | Read public profile data via the provider's API. AES-GCM encrypted at rest. |
| SMTP / IMAP credentials | Optional — you enter | Send outbound email & parse replies. AES-GCM encrypted at rest. |
| Approve / reject decisions on leads | You click in the UI | Train the per-tenant scoring priors so future leads are better. |
| Server logs (timestamps, endpoint, response code) | Automatic | Debugging, abuse detection. |
When you run a "hunt" or enrich a domain, HEIMDALL collects public business data about brands so you can decide whether to reach out. This data is scoped to your tenant — no other operator sees the leads in your queue.
All lead data is collected from public sources or returned by paid B2B enrichment APIs that warrant the data was lawfully obtained. We do not purchase consumer data, do not collect data from minors, and do not de-anonymize individuals.
HEIMDALL supports optional read-only OAuth connections to:
Each connection is initiated by you clicking Connect in HEIMDALL's Settings. You are redirected to the provider's official consent screen where you see exactly which permissions are being requested. You can decline, and you can revoke access at any time from both HEIMDALL's Settings and the provider's own permissions page.
We only read your data — bio, follower count, recent post titles or captions, and engagement metrics. We use this to tell the AI drafter what your voice and niche are, so the outreach emails it writes for you sound like you and reference relevant overlap with the brand you're contacting.
| Platform | Scope(s) | What it lets us do |
|---|---|---|
| TikTok | user.info.basic, user.info.profile, user.info.stats |
Read your username, display name, bio, follower / following / video counts. Nothing else. |
instagram_basic, pages_show_list |
Read your IG username, profile, and recent media metadata. Nothing else. | |
| YouTube | youtube.readonly |
Read your channel description, subscriber count, video titles. Nothing else. |
openid profile email |
Read your name, profile photo, and email. Nothing else. | |
| X / Twitter | tweet.read users.read offline.access |
Read your bio and recent public tweets. Nothing else. |
HEIMDALL uses the following services to operate:
| Provider | Purpose | Data sent |
|---|---|---|
| Anthropic | AI inference (brand analysis, outreach drafts, intent classification) | Public brand data + your written brand profile snippets, sent per-request, not retained for training. |
| Apify | Public-data scraping (Instagram / TikTok / YouTube / etc.) | The hashtag or handle you're hunting; no operator credentials. |
| Hunter.io | Email discovery for B2B contacts | Lead domain only. |
| Apollo.io | Optional, opt-in per-lead decision-maker phone reveal | Lead domain only, and only when you click "Enrich with Apollo". |
| Cloudflare | DNS, tunnel, and CDN | Request metadata (IP, user-agent) — standard web hosting. |
OAuth access tokens and SMTP / IMAP passwords are AES-GCM
encrypted at rest using a master key
(HEIMDALL_MAIL_KEY) held only on the application server.
Tokens are decrypted in memory only when a request actively needs them
and are never logged. If the master key is lost, every encrypted
credential becomes permanently undecryptable — there is no recovery path.
Session cookies use the HttpOnly and SameSite
flags and (in production) the Secure flag, so they are not
accessible to JavaScript and don't travel over insecure connections.
Passwords are hashed with bcrypt. We never store, log, or transmit plaintext passwords.
Regardless of where you live, HEIMDALL honors:
Email [email protected] with the subject "HEIMDALL Privacy Request". We respond within 30 days, usually within 72 hours.
In-app, immediate:
Full account deletion:
Material changes will be announced via email to active operators and prominent in-app notice at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent revision.
HEIMDALL / AESIR
Email: [email protected]
Privacy requests: [email protected]
General AESIR policy: projectaesir.com/privacy