Privacy Policy

1. Information we collect

Account information includes your email address, name, authentication identifiers, profile details, and workspace membership. We also process the information you provide when contacting us or managing your account.

Content includes uploaded product photos, logos, brand assets, prompts, listing details, generated images, edits, and project history. Some content may contain personal information; upload only information you have the right to share.

Technical and usage information includes IP addresses, browser and device information, requests, service activity, error reports, and security logs. Subscription and payment-related records may include your selected plan, credit usage, transaction references, and billing status.

2. Google sign-in data

If you choose Google sign-in, we request basic identity permissions: your email address, basic profile information such as your name and profile picture, and an OpenID identifier. Ordinary Google sign-in does not request access to Gmail messages, Google Drive files, or your other Google content.

Google sends authentication information to our authentication provider, Supabase. Supabase manages your identity and session, and HeroImage uses account information to sign you in, display your profile, and associate you with your account and authorized workspaces. Identity and session information is stored in our authentication and account systems.

We do not use Google sign-in data to target advertising or train AI models. We share it only as needed for authentication, account operation, security, support, or legal obligations. HeroImage's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke HeroImage's Google access through your Google Account connections. Revoking access does not itself delete your HeroImage account or content; contact us to request deletion.

3. How we use information

We use information to authenticate users, enforce workspace permissions, provide requested research and creative tools, save and deliver assets, manage plans and usage, respond to support requests, diagnose errors, prevent abuse, and meet legal obligations.

Where applicable law requires a legal basis, we process information to perform our agreement with you, pursue legitimate interests such as service security and support, comply with legal obligations, or act on consent where required. You may withdraw consent without affecting earlier lawful processing.

4. Service providers and sharing

We use service providers for authentication and databases, hosting and asset storage, AI processing, monitoring, and payment processing where applicable. These include Supabase for authentication and Cloudflare for hosting or asset delivery. A selected AI workflow may send your prompt, relevant images, and other task inputs to the AI provider that processes that request. Google sign-in does not authorize those providers to access your Google account.

Workspace members can access content according to their permissions. If you share or export content, its recipients may retain copies. We may disclose information when required by law, to address fraud or security incidents, to protect legal rights, or as part of a business transfer subject to applicable safeguards.

5. Cookies and local storage

Our services use cookies or browser storage to maintain authentication sessions, remember relevant settings, and support application functionality. You can manage cookies and storage in your browser, but blocking or clearing them may sign you out or prevent features from working.

6. Retention and security

We retain account information and saved content while needed to provide the service, and retain relevant records where needed for security, resolving disputes, or legal obligations. Retention depends on the type of information and purpose. Deleted information may remain in backups or records that must be retained until those records are removed through their applicable retention process.

We use access controls, workspace permissions, and other technical measures to protect information. No online service can guarantee absolute security. Keep your account credentials private and tell us if you suspect unauthorized access.

7. Your choices and rights

You can manage available profile and workspace settings within the service. Depending on your location, you may have rights to access, correct, delete, or receive a copy of your personal information, object to or restrict certain processing, or complain to your local data protection authority.

For privacy requests or account deletion, email [email protected]. We may need to verify your identity and authority over the account or workspace before acting. Requests are subject to applicable law and the rights of other workspace members.

8. International processing

HeroImage and its service providers may process information in countries other than where you live. Where applicable law requires protections for international transfers, those transfers are subject to the safeguards required by that law.

9. Children

HeroImage is intended for adult business users, not children. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

10. Changes and contact

We may update this policy as the service changes. The date above identifies the latest version. We will provide additional notice of material changes where required by law.

Contact HeroImage at [email protected]. Our Terms of Service describe the rules for using the service.