Headroom privacy notice

Last updated: 19 October 2026

Headroom is a finance dashboard and review service for e-commerce founders, run by 89 Design Lab (trading as Lab89), Semenyih, Selangor, Malaysia. This notice explains what we collect, why, who helps us, and what you can ask us to do.

1. Who is responsible

For your application and your Headroom account, Lab89 is the controller: we decide how this data is used. Contact: support@lab-89.com.

2. What we collect

When you apply

• Your name and email
• Your store URL, the platforms you sell on, your revenue band and accounting tool
• Anything you choose to tell us in the free-text answer
• How you heard about us

When you become a client

• Business data you connect: sales, orders, fees, payouts, ad spend and accounting figures from the accounts you link (for example Shopify, Amazon, Meta, Google, Xero, QuickBooks).
• Details you give us: opening cash, product costs, supplier payment terms, planned stock orders.
• Your login details for your dashboard, and our emails and call notes with you.

We don’t collect your customers’ names, emails or addresses. Headroom works with business totals, not customer records.

3. Why we use it

Purpose	Data	Legal basis (GDPR)
Reply to your application and book your intro call	Application details	Steps before a contract, at your request
Build and run your dashboard, forecasts and reviews	Business data, details you give us	Contract
Support, billing and service emails	Contact details, account	Contract
Improve Headroom (e.g. which features clients use)	Usage, aggregated	Legitimate interest

We don’t sell your data, don’t use it for advertising, and never use it to train AI models. Your data is never shared with another business, including other Headroom clients. Stage targets never show or reveal another client’s numbers. Your figures are reviewed by our finance expert, who sees only the dashboards of the clients they review.

4. Where it lives and who helps us

We don’t keep a copy of your raw store, ad or accounting records. Your dashboard reads them through Windsor when it refreshes and keeps only the summarised numbers it shows you.

Provider	What for	Data
Windsor.ai	Connects to your store, ad and accounting accounts	The business data you connect
Cloudflare	Hosts your dashboard; caches its summarised numbers; login protection	Summarised dashboard figures, login
Brevo	Sends application and service emails	Name, email, message
Google (Gmail)	Our support inbox	Emails you send us
Anthropic	Drafts the weekly summary and review notes, which a person checks	Summarised figures only, no personal details. Anthropic does not train on API data.

Some of these providers process data outside Malaysia and the EU, including in the United States. Where the GDPR applies, we rely on their standard contractual clauses or equivalent safeguards.

5. How long we keep it

• Applications that don’t go ahead: deleted after 12 months.
• Client data: for as long as you’re a client. When you leave, we disconnect your accounts and delete your dashboard data within 14 days.
• Invoices and billing records: as long as the law requires (in Malaysia, usually 7 years).

6. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or Malaysia’s Personal Data Protection Act), you can ask to see, correct, export or delete your data, or object to how we use it. Email support@lab-89.com with the subject “Data request”. We reply within 7 days. You can also complain to your local data protection authority.

7. Security

Each dashboard is behind a login and separate from every other client’s. Connections are encrypted. Only the people who set up and review your dashboard can see it.

8. Changes

If we change this notice in a way that affects you, we’ll email you before it takes effect.