Privacy Policy

This policy explains what personal data Hiera collects, why, and what rights you have. The data controller is Hiera, Inc., 1111B S Governors Ave, STE 48131, Dover, DE 19904, United States ("Hiera", "we", "us"). Contact:[email protected].

• Account data — your email address and, if you sign in with Google, your name and profile picture as provided by Google. We do not receive or store your Google password.
• Content — projects, images, drawings, PDFs, notes, comments and prompts you upload or create, and metadata about them (timestamps, authorship, project membership).
• Payment data — when you buy AI credits, payment is handled by Stripe. We receive confirmation of the transaction and your billing country, but never your full card details.
• Usage data — product analytics events (pages visited, features used, device and browser type) collected via PostHog to understand how Hiera is used and improve it.
• Technical data — server logs, IP addresses and error reports (via Sentry) needed to keep the Service secure and reliable.
• Communications — messages you send us, and email delivery/engagement data for notification emails.

• To provide the Service — operating your account, storing and syncing your Content, enabling collaboration and processing payments (performance of a contract).
• To provide AI features — sending your prompts and selected images to our AI providers to generate results (performance of a contract).
• To keep the Service secure and fix errors — logs and error monitoring (legitimate interest).
• To improve the product — aggregated analytics about feature usage (legitimate interest; you can object, see Section 8).
• To send notifications — emails about activity relevant to you (mentions, comments, invitations). You can turn these off per type in notification preferences or via the unsubscribe link in any email.
• To comply with legal obligations — accounting and tax records for purchases.

When you use AI features, the prompt and the images you select are sent to third-party AI model providers (currently OpenAI, accessed through Vercel's AI gateway) to generate the result. These providers process the data to deliver the feature and are contractually restricted from using API content to train their models. We do not use your Content to train our own models.

We never sell your personal data. We share it only with service providers that help us run Hiera, under data processing agreements:

• Cloudflare — hosting, file storage and real-time collaboration infrastructure
• Stripe — payment processing
• Google — sign-in with Google (if you choose it)
• OpenAI and Vercel — AI generation (see Section 4)
• PostHog — product analytics
• Sentry — error monitoring
• Our email delivery provider — transactional and notification emails

We may also disclose data if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

Content you share is also visible to the people you share it with: workspace and project collaborators, and — for public links — anyone who has the link.

Our providers may process data outside your country, including in the United States. Where data leaves the EEA/UK, we rely on safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We keep your data while your account is active. If you delete Content or your account, we delete the associated personal data within a reasonable period, except where we must keep it longer (for example, transaction records for tax law) or in routine encrypted backups that are purged on their normal schedule. Anonymized or aggregated data may be retained.

Depending on where you live (including under the GDPR), you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to certain processing (including analytics based on legitimate interest), and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, email[email protected]. You also have the right to lodge a complaint with your local data protection authority.

Hiera uses strictly necessary storage (such as your session token) to keep you signed in; this does not require consent. Our analytics (PostHog) runs in cookieless mode: it does not set cookies or store identifiers on your device, and anonymous visits reset each session. That is why Hiera shows no cookie banner — there is nothing to consent to.

Hiera is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the product evolves. For material changes we will notify you by email or in-app notice before they take effect. The "Last updated" date at the top shows the current version. See also our Terms of Service.