Privacy Policy

This policy explains what personal data Hiera collects, why, and what rights you have. The data controller is Hiera, Inc., 1111B S Governors Ave, STE 48131, Dover, DE 19904, United States ("Hiera", "we", "us"), which also sells the credits you buy in Hiera. Contact: [email protected].

• Account data: your email address; the first and last name and username you enter when you set up your profile; an optional profile photo; and the name of any workspace you create. If you sign in with Google, we also receive your name and profile picture as provided by Google. We do not receive or store your Google password.
• Content: projects, images, drawings, PDFs, notes, comments and prompts you upload or create, and metadata about them (timestamps, authorship, project membership).
• Payment data: when you buy AI credits or subscribe to Hiera Pro, payment is handled by Stripe. Stripe securely keeps the payment method you use (for example your card) on your workspace's Stripe customer record for future purchases, including automatic top-ups if you turn them on in Billing and Hiera Pro renewals if you subscribe. We receive confirmation of the transaction, your billing country, and enough to show you which method is saved (card brand, last four digits and expiry date), but never your full card number or security code. We also keep records of refunds, payment disputes and any pause of AI features they cause. If you subscribe to Hiera Pro, we keep its subscription records: its status, renewal and cancellation dates, its invoices and the credits each payment added. When you buy credits or subscribe to Hiera Pro, we record who agreed to the purchase terms (for Hiera Pro, including its monthly renewal), when, the amount and the version of the wording you agreed to. When you turn automatic top-up on, change it or turn it off, we record who did it, when, the settings and the version of the wording you agreed to. Both records include the country of your internet connection (the country only, not your IP address).
• Usage data: product analytics events collected via PostHog on our sites (hiera.design and learn.hiera.design) and in the app: pages visited, the buttons and links you click, features used, device and browser type, and your approximate location (country and city) derived from your IP address. On our sites a click can include the visible text of what you clicked; in the app clicks are recorded without it. Once you sign in, events in the app are linked to your account by its user ID and workspace ID, never by your email address or name. Events recorded in the app before October 2026 may still include your email address and name; they stay in PostHog until we delete them. You can ask us at any time, at [email protected], to delete your analytics data: we delete the analytics profile linked to your account with its events and replays, and ask PostHog to remove any older events that carry your address but are not linked to your account (some pages before sign-in recorded it).
• Session replays: only if you switch them on (in the question shown after you sign in, or under Settings › Privacy), and only while you are signed in to the app — never on our public sites, on the sign-in screens (including when you add another account), or for people viewing a shared link without an account. PostHog then records a replay of how you use the app: what is shown on your screen, including images you upload or generate, together with your clicks and navigation. Text you type into a field is masked as you type, and the text of notes and comments and any email address shown on screen are masked in the replay; names and the rest of the canvas stay visible. Replays do not include network requests or console output, and page addresses are kept without their query string. Errors in the app are reported separately, with personal details removed (see Technical data below). Your saved card's brand, last four digits and expiry date are masked, and we never record payment card details. You can switch replays off at any time: recording stops immediately in every open tab of that browser, and on your other devices when you next load the app or return to an open tab (checked at most every few minutes). Replays are deleted automatically after 30 days. We keep a record of each answer you give to this question (on or off, when, whether in the question or in Settings, and the version of the wording), so we can show what you chose.
• Advertising and measurement data: if you accept cookies on our sites or in the app, advertising and measurement tags (loaded through Google Tag Manager) may collect information about your visit, such as pages viewed, referring campaign, device and an advertising identifier, to measure our campaigns and show you personalised ads. See Section 9.
• Security and fair use: when you sign in, Cloudflare Turnstile checks that you are not a bot (it reads browser and device signals for this). We count requests per IP address, email address and account. For free credits we keep a keyed, one-way hash of your IP address and network and a normalised form of your email address, so the same person cannot claim the welcome grant twice. Section 7 says how long we keep them.
• Technical data: server logs, IP addresses and error reports needed to keep the Service secure and reliable: errors on our servers via Sentry, and errors in the app via PostHog (the error message and where in our code it happened, with email addresses, sign-in codes, tokens and the query strings of web addresses removed from the message). A server error report can include your IP address, your account identifiers and the request that caused the error, which may contain content you sent, such as a prompt or your email address.
• Connected apps: if you connect Hiera to ChatGPT, we keep a record of the connection: which app, the access you approved, when you connected it, when it was last used and when it ended. We keep the keys that give the app access to your account only in hashed form. ChatGPT then sends us what you ask it to do in Hiera: the images you ask it to save, with the title, subject or short note ChatGPT writes from your conversation and the file's name, and the names of the pages and projects you ask it to create. We download each image from OpenAI's file storage and store it as received, including details embedded in the file, such as where a photo was taken. What ChatGPT saves becomes Content, like anything you add yourself. We don't use any other details ChatGPT attaches to its requests, such as your language or approximate location. Section 5 says what ChatGPT receives from us, and Section 7 how long we keep the connection record.
• Communications: messages you send us (including feedback from the in-app form, which reaches us through PostHog linked to your account even if you turned product analytics off), and delivery data for the emails we send you (for example, whether an email was delivered or bounced).
• People without an account: if someone invites you or mentions you, we receive your email address (and name, if given) from them to send you the invitation or notification (our and our users' legitimate interest). If you open a public link without an account, we collect the usage and technical data described above.
• Waitlist: if you joined our waitlist before launch, we keep the details you gave us: your name and email address and, if you gave them, details such as your company, role, how you heard about us and your level of interest. We use them only to tell you that Hiera is available and invite you to try it. You can ask to be removed at any time with the unsubscribe link in any such email or by writing to [email protected].

To have an account you need an email address, a first and last name and a username, and a workspace name if you create a workspace. To buy credits or subscribe to Hiera Pro you also need a payment method, with the billing details Stripe asks for (such as your country). Everything else, including a profile photo, is optional.

• To provide the Service: operating your account, storing and syncing your Content, enabling collaboration, processing payments, including recurring Hiera Pro charges, and keeping your payment method on file for future purchases and renewals (performance of a contract).
• To provide AI features: sending your prompts and selected images to our AI providers to generate results (performance of a contract).
• To connect Hiera to ChatGPT when you ask us to: checking the connection you approve, listing your projects, pages and workspaces for ChatGPT, and creating the pages and projects and saving the images you ask for (performance of a contract). We keep the record of a connection for 30 days after it ends, so we can answer questions about which apps had access to your account and look into misuse (legitimate interest in keeping your account secure). Names that other people chose, in projects and workspaces they share with the person who connected, are passed on to ChatGPT for our and our users' legitimate interest in letting collaborators work with the tools they choose.
• To keep the Service secure and fix errors: logs and error monitoring (legitimate interest).
• To protect the Service and our free credits from abuse, automated sign-ups and fraud, including bot checks, rate limits and limits on free-credit grants, and keeping the hashes described in Section 7 for 12 months after an account is deleted (legitimate interest). If our checks refuse a free-credit grant, this does not affect your account, your projects or your ability to buy credits; email [email protected] if you think a check got it wrong and a person will review it.
• To understand and improve the product: the usage data in Section 2 (in the app linked to your account by its user ID, never by your email address or name), based on our legitimate interest in improving Hiera. You can object at any time: switch product analytics off in Settings › Privacy, which applies in the browser where you set it (Section 9), or email [email protected] and we stop analytics for your whole account; we handle email requests by hand within 30 days.
• Session replays (Section 2): only if you switch them on when we ask after you sign in, or in Settings › Privacy (consent). You can withdraw at any time, and recording stops immediately.
• To measure our advertising and show you personalised ads: cookies and similar technologies on our sites and in the app, only with your consent (see Section 9), which you can withdraw at any time.
• To send notifications about activity relevant to you (mentions, comments, invitations) and about your account, purchases and Hiera Pro subscription (performance of a contract; for optional activity notifications, our legitimate interest in keeping collaborators informed). You can turn activity notifications off by type or with the unsubscribe link in any email. Service messages such as receipts, Hiera Pro emails (each payment's receipt, credits added and Pro ending), security notices and notice of changes to our Terms or prices cannot be turned off.
• To tell you about new Hiera features and offers, such as free credits, by email. In Georgia we do this only if you agreed to it (consent). In the UK and the EEA we do this if you agreed to it (consent), or if you are an existing user who was given the chance to refuse such emails when you signed up and did not (legitimate interest). You can withdraw your consent or opt out at any time with the link in every such email or by writing to us.
• To tell people on our waitlist that Hiera is available and invite them to try it (legitimate interest: you asked to hear from us when you joined).
• To handle refunds, chargebacks and disputes about automatic top-up or Hiera Pro (legitimate interest in establishing, exercising or defending legal claims).
• To keep invoices, transaction records and the records tax law requires (legal obligation). Where those laws are not UK or EU laws, such as US tax law, we keep these records on the basis of our legitimate interest in meeting them.

When you use AI features, the prompt and the images you select are sent through Vercel's AI Gateway to Google's Gemini models to generate the result. Along with your request we may send your country, derived from your IP address. Vercel and Google process this data to deliver the feature and, under Vercel's terms and the Google terms that apply through it, may not use it to train their models. Google may keep it for a limited period to detect abuse. Our search provider Exa is different: see the next paragraph. We do not use your Content to train our own models.

When a feature searches the web or looks for products (for example in a Note or a Cost Estimate), it sends search text: text that our AI writes from your request, which can include words from your prompt or describe an image you pointed the search at, or the search words you type yourself, such as a Cost Estimate row's name and note. We are moving our search from Serper to Exa, so each search goes to whichever of the two is switched on at the time. That search text is all they receive, plus, for a search in the Georgian market (chosen from the country you connect from or the language of your request), the fact that the search is for Georgia. They never receive your images, files or account details. Exa receives the search text through Vercel's AI Gateway, where a Google Gemini model passes it on and sees the same text. Under its terms, Exa may use search queries to improve its own service.

Search results show product photos. For shops on our list of Georgian shops, we may keep a copy of the product photo in our own storage and show you that copy. Other photos load directly from the website that hosts them (usually the shop's) or, for some results, from Google's servers, so viewing them sends your IP address and browser details to those sites, as any website you visit does. Nothing else about you is sent to them.

Some features, such as selecting an object, removing a background and estimating depth, run on your device: the image is processed in your browser and is not sent to an AI provider for that step. Your browser downloads the model files for these features from our own servers. If they are unreachable, it downloads them from Hugging Face or jsDelivr instead, which then receive your IP address and browser details, as any website you visit does; no image is sent to them.

ChatGPT is not one of our AI providers: OpenAI runs it under its own terms. If you connect Hiera to ChatGPT (Section 5), ChatGPT's requests to Hiera don't use our AI features.

We never sell your personal data for money. We share it with the recipients below.

Service providers that process data only on our instructions, under data processing agreements:

• Hetzner Online GmbH: application servers (Falkenstein, Germany)
• Neon, Inc.: database hosting for account, workspace, billing and credit records (EU, Frankfurt)
• Cloudflare, Inc.: website hosting, file storage, real-time collaboration, and Turnstile, a bot check at sign-in
• Vercel, Inc. (AI Gateway): AI generation. Vercel passes your request to Google's Gemini models, and Google processes it as Vercel's sub-processor (see Section 4)
• PostHog, Inc. (EU cloud): product analytics, error reports from the app, in-app feedback and, only if you switch them on, session replays
• Functional Software, Inc. (Sentry, EU region): error monitoring for our servers
• Twilio Inc. (SendGrid): transactional and notification email
• Google LLC (Google Workspace): our inboxes, including messages you send to legal@ and [email protected]
• Only if you accept cookies: Google Tag Manager and Google Analytics

Search providers, which receive only search text (see Section 4):

• Exa: web and product search, reached through Vercel's AI Gateway. Exa receives the search text (written by our AI from your request, or the search words you type yourself) and, for a search in the Georgian market (chosen from the country you connect from or the language of your request), the fact that the search is for Georgia. It never receives your images, files or account details. A Google Gemini model passes the request on and sees the same search text. Under its terms, Exa may use search queries to improve its own service.
• Serper: web and product search, while we move to Exa. Serper receives only the search text and, for a search in the Georgian market (chosen the same way), a Georgia market setting.

Independent controllers, covered by their own privacy policies:

• Stripe processes your payments, keeps your saved payment method and handles refunds and disputes, including passing dispute evidence to card issuers and networks. For Hiera Pro, Stripe also runs the monthly renewal, retries a failed payment and emails you about it, and hosts the page where you manage or cancel Pro. It also uses payment data for fraud prevention and its own legal obligations (stripe.com/privacy).
• Google: the app's sign-in pages load Google's sign-in script ("Continue with Google"), so when you open them your browser sends Google your IP address, browser details and any Google cookies it holds. If you sign in with Google, Google also confirms your identity to us (policies.google.com/privacy).
• OpenAI: only when you, or someone you share a workspace or project with, connect Hiera to ChatGPT. ChatGPT then receives what its requests ask for: the names and identifiers of the projects that person can edit, of those projects' pages and workspaces, and of the workspaces where that person can create projects, including which of those workspaces they own. Some of these names may have been chosen by other people. For what it saves or creates, ChatGPT also receives the names used (such as an image's subject), an image's version number, the project and page it went to, a link to the project (which opens only for people who can see the project) and a link to each saved image (which opens for anyone who has it). The keys ChatGPT receives don't contain an email address or name. We send OpenAI nothing about you except in answer to ChatGPT's requests. What ChatGPT receives becomes part of that person's ChatGPT conversations, and OpenAI's handling of it is governed by OpenAI's own terms and privacy policy (openai.com/policies/privacy-policy). In a ChatGPT workspace an organisation runs, OpenAI handles it on that organisation's behalf.

Joint controller: only if you accept cookies, the Meta pixel sends information about your visit (pages viewed, the campaign that brought you, device data and an advertising identifier) to Meta. We are joint controllers with Meta for collecting and sending that data, under Meta's Controller Addendum. You can exercise your rights with us or with Meta. What Meta does with the data afterwards is covered by its own privacy policy. Some US state privacy laws may treat this as "selling" or "sharing" personal data for targeted advertising. The pixel never loads unless you accept, and you can withdraw at any time in Cookie settings or in Settings › Privacy.

We may also disclose data if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

Content you share is also visible to the people you share it with: workspace and project collaborators and, for public links, anyone who has the link. Content you add to a project may appear in the session replays of other signed-in people who open that project or its public link and have switched replays on, except the text of notes and comments and email addresses, which are masked. Those replays can also show your name and profile photo, for example next to your comments or in the project's list of members. If a collaborator connects ChatGPT, the names of the projects, pages and workspaces you share with them can also appear in their ChatGPT conversations (see OpenAI above).

Hiera, Inc. is based in the United States, and our service providers (Section 5) may process your data in the United States and other countries. Our application servers (Hetzner, Falkenstein, Germany), database (Neon, Frankfurt), product analytics (PostHog EU cloud) and error monitoring (Sentry EU region) are hosted in the EU. Other providers, including file storage (Cloudflare), AI generation (Vercel and Google), search (Exa or Serper) and email (SendGrid), may process data in the United States and other countries. When we share personal data from the EEA with a provider outside the EEA, we use either the EU-US Data Privacy Framework, for US providers certified under it, or the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). For UK data we use the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum. For Swiss data we use the Swiss-US Data Privacy Framework or the Standard Contractual Clauses as adapted for Swiss law. Some members of our team work in Georgia and can access data only as far as their role needs, under the same security measures. You can ask for a copy of the safeguards, or which one applies to a given provider, at [email protected]. OpenAI is not one of these providers: if you or a collaborator connects ChatGPT, OpenAI receives the data described in Section 5 as an independent controller (in a ChatGPT workspace an organisation runs, such as ChatGPT Business, Enterprise or Edu, on that organisation's behalf), and its handling of that data, including where it is processed, is governed by OpenAI's own terms and privacy policy.

We keep personal data only as long as we need it for the purposes above:

• Account data and Content: while your account exists. When you delete a project, page or workspace, it disappears from Hiera at once, but we keep it in a form we can restore, in case it was deleted by mistake. Deleted Content is removed for good when you ask us to delete the whole workspace or your account. There is no delete-account button yet: to ask, write to [email protected]. We then delete the workspace's Content, or your personal data and Content, within 30 days, except the records listed below. We must keep transaction, invoice and tax records (tax and accounting law requires them). We also keep consent records (for purchases, automatic top-up, Hiera Pro and session replays), Hiera Pro subscription records, and refund and dispute records (we need them to show what you agreed to and to answer payment disputes and legal claims), and, for 12 months, a keyed, one-way hash of your email address and of your IP address and network, only so the free-credit welcome grant can't be claimed twice. Our database provider keeps a restorable history of our database for 24 hours and daily backups for 14 days, so data we delete from the database is gone from them within 15 days; our file storage keeps no copies of deleted files. Content you added to a workspace owned by someone else stays with that workspace until its owner deletes it.
• Error reports from our servers (Sentry): deleted automatically after 30 days.
• Server logs on our application servers: deleted automatically within 15 days.
• Logs of our real-time collaboration service (Cloudflare): deleted automatically after 7 days.
• Product analytics events: PostHog does not delete them automatically. We delete the events linked to your account when you ask us (Section 2) or when your account is deleted. Events that aren't linked to an account (for example visits before sign-in, which carry only a random ID) stay with PostHog. Session replays: deleted automatically after 30 days.
• Rate-limit counters: at most 24 hours, in memory only. Free-credit eligibility records (hashed IP address and network, normalised email): while your account exists. When your account is deleted, we replace your email address in them with a keyed, one-way hash and keep that, with the hashed IP address and network, for 12 months, only to stop the same person claiming the welcome grant twice; then we delete these hashes.
• Records of the emails we send you (the address, subject, time and whether it was delivered): while your account exists. When your account is deleted, we delete them, except records of receipts and of notices we must give (such as changes to our prices or Terms), which we keep with your email address replaced by a keyed, one-way hash.
• Delivery data held by our email provider (SendGrid): up to 30 days. Its lists of bounced and unsubscribed addresses are kept until the address is removed from them.
• Support and privacy-request emails: 3 years after the conversation ends.
• Records of deletion requests (which account or workspace, when, and what we deleted, with email addresses only as keyed, one-way hashes): 3 years after we complete the request, to show that we handled it.
• Waitlist details: until you ask to be removed, or until launch, whichever comes first.
• Transaction, invoice and tax records: 6 years after the end of the year of the payment, as tax and accounting law requires.
• Consent records for purchases and automatic top-up, and refund and dispute records: 6 years after the purchase they relate to. Hiera Pro subscription and invoice records, and your agreement to its renewal: 6 years after the subscription ends. Your answers to the session-replay question: 6 years after you gave the answer. We keep these even after your account is deleted, linked only to an account ID that no longer carries your name or email address.
• Saved payment methods: kept by Stripe until you remove them in Billing or the workspace is deleted, when we remove every payment method saved for it. Stripe keeps the underlying transaction records as financial regulations require.
• Connections to ChatGPT (which app, the access you approved, when you connected it, when it was last used and when it ended): while the connection exists and for 30 days after it ends; when your account is deleted, they are deleted with it. A connection ends when you disconnect it under Settings › Connected apps, when your account is deleted, about 60 days after ChatGPT last received or renewed its access (ChatGPT renews it as it uses Hiera), or at once if we end it to protect your account, for example if its keys appear to have been copied. ChatGPT's access lasts an hour at a time, and ChatGPT renews it with a renewal key that lasts 60 days and is replaced each time it is used. We keep these keys, and the one-time code used to connect, only in hashed form: each key is deleted about a day after it expires, or at once when you disconnect, when we end the connection or when your account is deleted; the code is kept with the connection record. A request to connect that you cancel or don't finish is deleted about a day later. What ChatGPT keeps from your conversations is governed by OpenAI's terms and privacy policy (Section 5).

We may keep anonymised data that no longer identifies you.

Depending on where you live (including under the GDPR), you have the right to access, correct, delete and receive a copy of your personal data, to restrict certain processing, and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, email [email protected]. To delete your account, you can also write to [email protected] (see Section 7). You can remove a saved payment method yourself from Billing in the app. You can disconnect ChatGPT yourself under Settings › Connected apps, which ends its access to your account at once. What ChatGPT already saved stays where it was saved, as Content you added (Section 7), until it is deleted there, and a link to a saved image that ChatGPT already has keeps opening until the image is removed for good (Section 7). Disconnecting doesn't remove what is already in your ChatGPT conversations: OpenAI's terms and privacy policy govern it (Section 5). If you remove Hiera inside ChatGPT instead, we are not told: the connection stays in Connected apps until you disconnect it there or it ends on its own (Section 7). You also have the right to lodge a complaint with your local data protection authority.

Your right to object. Where we process your data based on our legitimate interests, such as product analytics, you can object at any time on grounds relating to your situation, and we stop unless we have compelling reasons that override yours or need the data for legal claims. For product analytics, Section 3 explains how. You can object to direct marketing at any time, without giving a reason, and we then stop.

We reply within one month; for complex requests we may extend this by two more months and tell you why. We may ask you to confirm your identity from your account email.

If you are in Georgia, you have these rights under the Law of Georgia on Personal Data Protection, including the right to ask us to block (restrict) processing. We answer your requests within 10 working days. In justified cases we may extend this by up to 10 more working days, and if we do we tell you why. You can complain to the Georgian data protection supervisory authority or go to court.

Hiera uses strictly necessary storage (such as your session token and your cookie and privacy choices) to keep you signed in and remember your preferences; this does not require consent. Our product analytics (PostHog) runs without cookies by default: it keeps its data in memory only, so nothing is stored on your device and anonymous visits start afresh on each page load. Turnstile's check is strictly necessary for the sign-in you ask for and is not subject to cookie consent. The app's sign-in pages also load Google's sign-in script so that "Continue with Google" works; Google may read its own cookies when it loads (Section 5). Session replays are a separate choice: we record them only if you switch them on (Section 2), and that choice is separate from the cookie choice below.

If you choose Accept in the cookie banner, PostHog also keeps, in a cookie and in your browser's local storage, a random visitor ID (in the app, your user ID once you sign in), a session ID, the workspace you are in, how you first reached us (referrer and campaign parameters) and the feature settings that apply to you. The cookie expires 365 days after your last visit; the local-storage copy stays until you decline or withdraw, and a per-tab window ID in session storage ends when you close the tab. If you declined the banner but switched session replays on in the app, PostHog keeps the same data only for the page you have open: each new page load in the app deletes it first, so every reload starts a new session and a new replay (a copy left when you close the tab is deleted the next time you open the app). In the app PostHog keeps all of this on app.hiera.design under its own name, apart from the data on our public sites, so PostHog does not link your use of the app to your visits to hiera.design or learn.hiera.design.

When you decline or withdraw your cookie choice in the app (and session replays are off), PostHog returns to memory-only mode and deletes its cookies at once, both the app's and the one our public sites use; each site's local-storage copy goes the next time you open that site. A Decline made on one of our public sites deletes that site's PostHog cookie and local storage at once. Unless session replays are on, the app's own copy is deleted the next time you open the app, or when you return to an app tab that is already open; with replays on, the app keeps its PostHog storage as described above.

If you turn product analytics off under Settings › Privacy, no usage events, error reports or replays are sent from that browser, in the app or on our public sites. The app still asks PostHog which features are switched on for you, sending only your user ID, your time zone and a random ID for that page load (like any request, it also reaches PostHog with your IP address and your browser's name and version). Your browser keeps a note of that choice in a cookie on hiera.design (set only if you turn analytics off, for 180 days, renewed each time you open the app) so that our public sites stop too. Some browsers, such as Safari, delete that cookie after 7 days; our sites then rely on their own copy of the choice, which exists only if you visited them in the meantime and expires 180 days after they last saw the cookie. When you turn analytics back on, the cookie says so for 30 days, so that a site that kept a copy drops it, and then expires. This objection does not change your cookie choice for the advertising and measurement tags below.

On our public sites (hiera.design and learn.hiera.design) and in the app (app.hiera.design) we also use cookies and similar technologies for advertising and measurement, and to show you personalised ads, for example Google Analytics and the Meta pixel, loaded through Google Tag Manager. The same Tag Manager container runs on our sites and in the app, and its advertising and analytics cookies are set on hiera.design, so these providers can recognise the same browser on both. These are set only if you choose Accept in the cookie banner; one answer covers the sites and the app, and is remembered for up to 180 days (Safari deletes the shared cookie after 7 days, after which each site and the app use the last answer it saw, until 180 days after it was given). An Accept given to the earlier wording of the banner, which did not mention personalised ads or product analytics cookies, no longer counts: nothing loads until you answer the updated question. A Decline given to the earlier wording still stands. If you choose Decline, or make no choice, no advertising or measurement tags load. If you withdraw while these tags are already running in a page, that page reloads so that they stop (a page open elsewhere does so when you return to it). You can change your choice at any time with the Cookie settings link in the footer of our sites, under Settings › Privacy in the app, or by clearing your browser's site data. Where these providers process data outside the UK or EEA, the safeguards in Section 6 apply.

Data travels between your browser and Hiera encrypted (HTTPS), and our database and file storage providers encrypt it at rest. Only team members who need access for their role have it. No system is completely secure; if a breach affects your personal data, we tell you and the authorities as the law requires.

Some decisions are made automatically: we pause AI features while a payment dispute, chargeback or bank inquiry is open, bot checks and rate limits can hold a sign-in or a request, our free-credit checks can refuse a grant, and Stripe screens payments for fraud. Hiera Pro also reacts to refunds and chargebacks automatically, as Section 3A of our Terms describes. If a Pro payment is refunded, other than for a withdrawal, Pro ends at once, and if that payment added credits we also cancel the workspace's free and Pro credits. If a chargeback is opened on any payment in the workspace, Pro ends at once and is not restored, and we cancel the workspace's free and Pro credits, even if the chargeback is later decided in our favour. A bank inquiry alone pauses AI features but does not end Pro. None of these affects your account beyond what our Terms describe. If you think one got it wrong, email [email protected] and a person will review it.

Hiera is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the product evolves. For material changes we will notify you by email or in-app notice before they take effect. The "Last updated" date at the top shows the current version. See also our Terms of Service.