Privacy Policy

HeadRail, getheadrail.com

Last updated November 4, 2026.

HeadRail is software for window treatment dealers. Dealers and their reps use it to show blinds, shades and shutters on a photo of a customer's window, quote from the dealer's price book, send proposals that customers can sign online, and run their sales, scheduling, service and commercial bid work in the HeadRail CRM. Dealers can also put a HeadRail preview widget on their own website.

This policy explains what we collect on this website and in the HeadRail app, who receives it, how long we keep it and what choices you have. HeadRail is operated by HeadRail LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702 ("HeadRail", "we", "us"). HeadRail is offered to businesses in the United States.

The short version

• We don't sell personal information, we don't share it for advertising, and we don't use window photos or customer records to train AI models.
• This marketing site has no analytics, no advertising or tracking cookies and no third-party scripts.
• A dealer can choose to keep a history of visits to its own website, using a random visitor ID instead of a cookie. You can say no, and browsers that send Global Privacy Control or Do Not Track are never recorded.
• For homeowners and other customers of a dealer, the dealer decides how their information is used. We store and process it for the dealer.
• Some features send information to our AI provider, OpenAI: window photos to make previews, product questions to the Blinds Buddy assistant, CRM questions to the Ask HeadRail assistant (with customer names and contact details removed first) and plan drawings to AI takeoff. OpenAI does not train its models on this data.
• Online signatures are recorded with the signer's name, drawn signature, IP address, browser and time, so the dealer can show who signed what and when.
• HeadRail never receives full card or bank numbers.

1. Who is responsible for your information

HeadRail is responsible for information about people who send a demo request, dealer staff accounts and our own operations.

The dealer is responsible for information about its customers and contacts: homeowners who make a preview or ask for a quote, customers a rep enters or imports, people who sign a proposal, service customers, and the builders, architects and other contacts in commercial bids. HeadRail processes that information on the dealer's behalf and following the dealer's settings. If you are a dealer's customer, the dealer is the best first contact for questions or requests. We will help the dealer answer them.

2. This website and demo requests

You can read getheadrail.com without giving us anything. The marketing pages set no cookies, run no analytics and load nothing from other companies; our fonts are hosted on our own server. To remember where you came from and keep a draft of the demo form if you leave the page, the site uses your browser's session storage, which is cleared when you close the tab and never sent to anyone else.

When you fill in the demo request form, we collect your name, business name and email address; your phone number and website if you give them; the main manufacturer you sell, your team size and your message; and which page or button you came from, any campaign tags in the link (for example utm_source) and the name of the website that linked you here.

We store the request and email it to HeadRail staff so someone can follow up. We use it only to contact you about HeadRail, set up a walkthrough and, if you become a dealer, start your account. We don't add you to a marketing list unless you ask. To stop spam, we limit requests from one connection using a keyed one-way hash of your IP address that is never stored with your request.

3. What the app collects about a dealer's customers

Previews and quote requests

• Window photos. When you or a rep make a preview, the photo is re-drawn on the device before upload, which removes hidden location data (such as GPS). It is sent to our AI provider to create the preview.
• Design choices: product, fabric, color, mount, options, room names and window sizes.
• Quote requests. If you ask for a quote, we store your name, email and/or phone, your optional message, your design, the quote and the preview image (your photo with the chosen product shown on it). A rep's whole-house consultation can store several rooms and photos.
• Consent records. The exact consent wording you agreed to, when, and a one-way hash of the IP address it came from (not the address itself). If a rep enters you or imports you from another system, the record says so instead. The quote consent lets the dealer contact you about your quote and project, including follow-ups and a review request; the dealer keeps the request in its customer records (see section 6).
• Optional texts consent. If the dealer uses HeadRail's texting add-on, a separate box, unticked by default, asks whether the dealer may text you about your appointments and quote, including automated texts. It is not needed for a quote or a purchase. We store its exact wording, when and who recorded it. You can reply STOP to any text to stop them.
• Emailing yourself a design. If you ask the widget to email you your design, we store your email address and the design as we do for a quote request and send you the email on the dealer's behalf. The dealer sees that you saved a design, not that you asked for a quote.
• Optional follow-up consent. A separate box, unticked by default, lets the dealer keep your photos and project to show you ideas for other rooms and send occasional offers by email. You can unsubscribe at any time with the link in those emails; unsubscribing covers every quote you have with that dealer.

Visits to a dealer's website

A dealer can turn on website visit history for its own website. It is off unless the dealer turns it on.

• Asking first. By default the dealer's site shows a short notice, and nothing is recorded until you choose OK. If you choose No thanks, or your browser sends Global Privacy Control or Do Not Track, nothing is recorded. A dealer can turn the notice off, in which case visits are recorded unless your browser sends one of those signals.
• The visitor ID. The HeadRail script on the dealer's site keeps a random ID in your browser's local storage for that site. It is not a cookie, is different on every dealer's site, and is removed if you clear that site's data or choose No thanks.
• What is recorded. The pages you open (address and title) and when, how you first arrived (for example a search engine, a Google or Facebook ad, or a campaign name in the link), and your steps in the preview widget, such as opening it, adding a photo, making a preview and opening the quote form. Email addresses, phone numbers, names and codes in page addresses are removed before anything is stored. We do not store your IP address, ad click IDs or what you type, and your photo is handled only as described above.
• Anonymous until you get in touch. Without a quote request, the dealer sees only anonymous counts and activity, not who you are. If you send a quote request or email yourself a design from the same browser, the history is added to your customer record, and if you come back to the site later the dealer's staff may get a reminder to follow up.
• Not used elsewhere. HeadRail does not combine visit histories across dealers, sell them, use them for advertising or match them with information from other companies to find out who you are.

Customer records in the dealer's CRM

• Contact and address details, the stage of your project, its value and source, tags and internal notes.
• Appointments, tasks and reminders, including their time, location and notes.
• A log of calls, texts, emails and visits with their outcome. HeadRail does not record calls; a call is made from the rep's own phone.
• Texts. Without the texting add-on, the app opens the rep's own phone to send a text, and HeadRail does not send it. With the add-on, HeadRail sends and receives the dealer's texts from the dealer's own business number through our texting provider (see Service providers), and stores the messages, your number, delivery status and any STOP reply with your customer record. Automatic appointment and review texts go only to people who ticked the texts box (or told a rep yes), only between 8 AM and 8 PM, and never after a STOP. Mobile numbers and texting consent are never shared with anyone for their own marketing.
• Emails from the dealer. Emails the dealer sends you through HeadRail (appointment confirmations and reminders, proposal links, deposit receipts, quote follow-ups, review requests, a website offer or a design you asked for) go out in the dealer's name through our email delivery provider, with replies going to the dealer. Follow-ups, review requests and offers carry an unsubscribe link and the dealer's postal address.
• Orders: products, sizes, prices, sale and install dates.
• Service tickets: the problem, its items, visits, installer and resolution.
• Deposits: the amount, how it was paid (for example check or card), a short note and the date. Payments are made directly to the dealer, through the dealer's own payment link or, if the dealer has connected Stripe, on Stripe's checkout page. There you enter your card or bank details with Stripe, and Stripe and the dealer receive them; HeadRail receives only the amount, whether it was paid by card or bank, and whether it succeeded or was refunded. HeadRail never receives or stores card or bank details.

Proposals and online signatures

• Proposal links. A proposal link shows your name, designs, prices and the rep's name, never your email, phone, address or notes. We record how many times a link was opened and when it was last opened, not who opened it or from where. Links expire after the dealer's set period and can be turned off by the dealer.
• Signatures. When you accept a proposal online, we store your typed name, your drawn signature, the time, your IP address, your browser type, the terms shown to you, and a fingerprint of the exact proposal you signed, so it can later be shown that the signed proposal was not changed. Signed proposals are kept as a contract record (see section 6). Before signing you agree to sign and receive the records electronically, and that agreement is stored with the signature.

Commercial bids

For commercial work, dealers can store companies (such as general contractors and architects), their contacts (name, title, email, phone and notes) and project details. Plan drawings opened for a takeoff stay on the user's device unless AI takeoff is used (see section 4).

4. How AI is used

All AI features use OpenAI's API. According to OpenAI, data sent through its API is not used to train its models, and OpenAI may keep it for up to 30 days to monitor for abuse, or longer where the law requires.

• Previews. The window photo and a description of the chosen product (for example "white roller shade, inside mount") are sent to create the preview. Typed text such as names or messages is never part of the image request.
• Blinds Buddy (for signed-in dealer staff) answers product and pricing questions. It sends the question, the recent conversation and the dealer's product and selling-price information. It does not send the dealer's costs or margins. Staff are asked not to type customer details into it.
• Ask HeadRail (for signed-in dealer staff) answers questions about the dealer's sales and service data. Before anything is sent, customer names, email addresses and phone numbers are replaced with codes, and only figures and labels such as stages, dates, values, products and sources are sent. The codes are turned back into names only on our server, and only for people the staff member is allowed to see. Text the system can't recognize as a name, such as a street address, may be sent as typed, so staff are asked to leave it out.
• AI takeoff (for commercial dealers who turn it on) sends images of the plan sheets the user chooses, which can include title-block details such as the architect, owner and project address. Images are not stored by HeadRail.

We do not use AI to make decisions about people. AI answers and previews can be wrong; see our Terms of Service.

5. Who receives information

• The dealer and its staff, according to their role. Reps see their own customers; owners see the whole account.
• Tools the dealer connects. A dealer can have new quote requests sent by email or to its own systems through a signed webhook (name, contact details, message and design, no photo). A dealer can export customer lists, for example to send its own marketing emails with an unsubscribe link. Once exported, those copies are the dealer's responsibility.
• QuickBooks Online, if the dealer connects its QuickBooks company: when you sign a proposal, your name, email, phone and the proposal's prices are sent to the dealer's QuickBooks to create your invoice, and deposits are added to it. Intuit holds that copy for the dealer under the dealer's agreement with Intuit.
• Stripe, if the dealer takes deposits online: Stripe processes the payment for the dealer. HeadRail sends Stripe only the amount, the dealer's name and an internal reference number, not your name, email or phone; you give Stripe your payment details yourself on its page.
• Calendar feeds. Staff and installers can subscribe to a private calendar link that shows their appointments with the customer's name, address, phone and visit notes. The link works like a password and stops working when the person's password changes or the dealer turns it off.
• Maps. When a rep taps a customer's address or a day's route, the address opens in the rep's map app (such as Google Maps).
• Our service providers (sub-processors), only to run HeadRail: listed below.
• Authorities or others when the law requires it, or to protect people, our service or our rights.
• A buyer or successor if HeadRail is sold or merged, under this policy.

Service providers (sub-processors)

These companies process personal information for us, only to run HeadRail and under contract terms that limit what they may do with it. This is the full list the Terms of Service refer to. We tell dealers before we add or replace a provider that handles their customers' information.

Two more services receive a dealer's customer information only when the dealer connects its own account, and they hold it under the dealer's own agreement with them: Stripe for online deposits (the amount, the dealer's name and a reference number) and Intuit QuickBooks Online for invoices (the signer's name, email, phone and the proposal's prices), as described above.

6. How long we keep it

• Preview photos that are not sent with a quote request are not stored on our servers. A rep's unfinished consultation is saved on the rep's own device for up to 3 days so it isn't lost.
• Photos with a quote request are deleted automatically after the dealer's photo period: 24 months unless the dealer changes it (the dealer can choose a shorter or longer period, or to keep photos). This applies with or without the optional follow-up consent. Photos shown in a signed proposal are kept with that contract record.
• Customer records (quote, CRM history, orders, service tickets and deposits) are kept for as long as the dealer uses HeadRail, so the dealer has your history for future orders, warranty and service. They are not deleted on a timer; they are deleted when the dealer deletes them, when you ask the dealer to delete them, or when the dealer's account and data are deleted.
• Signed proposals are kept as a contract record: the dealer cannot delete a customer record that has a signed proposal, and the private link to the signed proposal keeps working (read-only) for 7 years after signing, so you can always get your copy. Signed proposals are deleted when the dealer's account and data are deleted, or by HeadRail when the law requires it.
• Commercial bid records and demo requests are kept until the dealer (or, for demo requests, HeadRail) deletes them or you ask us to.
• Dealer staff accounts are kept while the dealer uses HeadRail. Expired sign-in sessions and unused invitations are deleted automatically.
• Website visit history: for a visitor with no customer record, each recorded page or step and the visitor itself are deleted 180 days after it happened. Once a visit is linked to a customer record, its history is kept with that record.
• Abuse-prevention records keep only one-way hashes of IP addresses, not the addresses, and are cleared after about an hour of use.
• Server logs record the time, page, result and a request id, never photos, form contents, IP addresses or link tokens.
• Backups may hold a copy of deleted information for up to 30 days before they are overwritten.

When a dealer stops using HeadRail, we delete its account data within 30 days of its request, except where the law requires us to keep it.

7. Cookies and storage on your device

The marketing site and the dealer website widget set no cookies. If a dealer turns on website visit history, the dealer's site keeps the random visitor ID and your answer to the notice in local storage, as described in section 3. The HeadRail app sets cookies only after a dealer staff member or HeadRail operator signs in:

• a session cookie that keeps you signed in (up to 14 days without use for dealer staff, 12 hours for operators); and
• a device cookie (up to one year) that recognizes a browser you have signed in from before, so a lockout caused by someone else guessing your password doesn't lock you out too.

The app also saves preferences on the device, such as recently used colors, CRM views and the last few customers opened (cleared when you sign out), and a rep's unfinished consultation as described above. None of these cookies or saved items is used for advertising or shared with advertisers.

8. Your choices and rights

Wherever you live, you can ask to see the personal information we or a dealer hold about you, correct it, get a copy of it or have it deleted, and you can withdraw the optional follow-up consent at any time. Homeowners and other customers of a dealer should start with the dealer; we will help the dealer act on the request. Dealers, dealer staff and anyone who sent a demo request can contact us directly. We answer requests within 45 days and won't treat you differently for making one. We may need to confirm your identity first, and we may keep information the law requires us to keep, such as a signed contract the dealer must retain.

Some U.S. states give their residents specific privacy rights, such as the right to know, correct and delete personal information and to opt out of its sale or of sharing for targeted advertising. We don't sell personal information or share it for targeted advertising, and we honor the other rights for everyone as described above. You can use an authorized agent to make a request on your behalf.

9. Security

Connections use HTTPS. Passwords are stored only as salted scrypt hashes, sign-in links and session tokens are stored only as hashes, and repeated wrong passwords lock the account for a while. Each dealer's data is kept separate from every other dealer's, access inside an account depends on the person's role, and reps never see the dealer's costs or margins. Stored data is encrypted on disk by our host. No system is perfectly secure. If we learn of a security incident that affects personal information, we will tell the affected dealers promptly, within 72 hours of confirming it, and help them notify the people involved as the law requires.

10. Children

HeadRail is meant for adults and businesses. We do not knowingly collect information from children under 13. If you think a child has given us information, contact us and we will delete it.

11. Changes

When we change this policy we will post the new version here and update the date at the top. For significant changes we will also tell dealers directly before they take effect.

12. Contact

For privacy questions or requests, email admin@getheadrail.com or write to HeadRail LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702. You can also reach us through the demo request page; say your message is about privacy.