Hera Privacy Policy

Effective date: 4 September 2026

This policy is also available in Chinese. In case of any discrepancy between language versions, this English version prevails.

1. Who we are

Hera ("the app") is provided by Zhuhai Yuejiajun Technology Co., Ltd. (珠海跃嘉竣科技有限公司) ("we", "us"). This policy explains what personal data we process and your rights under the UK GDPR and applicable data-protection law. Contact: support@heraai.co.

2. Data we process

Account data: email address and/or phone number you use to sign in (via one-time code), and, when you choose Apple or Google sign-in, the provider account identifier and basic profile information such as name and email returned by that provider.
Recordings & transcripts: audio you record (in-app or via a paired recording device) and the text transcripts generated from it.
AI interaction data: the questions you ask Hera's AI assistant and its responses, which are based on your own content.
Derived memory: contacts, facts, to-dos and profile summaries automatically extracted from your meetings.
Shared content & link data: when you explicitly create a sharing link, the selected meeting, transcript, AI conversation or AI reply, together with an opaque link identifier and basic access/diagnostic events needed to operate the link.
Device & connectivity data: identifiers of paired recording hardware and Bluetooth/Wi-Fi connection data used to sync it.
Subscription & purchase data: App Store or Google Play product, base-plan and transaction identifiers, purchase tokens, subscription and entitlement status, purchase/renewal/cancellation/refund/expiry history, country/currency, limited app/device information, and the Hera account identifier used to provide and restore access. Apple or Google processes the payment; neither Hera nor RevenueCat receives your payment-card or bank-account details.
Diagnostics & usage: crash and performance logs (via Alibaba Cloud EMAS) and minimal usage events. Usage events that relate to your queries store only a one-way SHA-256 hash, never the query text. The Google Sign-In SDK may also process basic authentication usage data for app functionality and analytics.
Advertising attribution data: on iOS, if you allow tracking through Apple's App Tracking Transparency (ATT) prompt, Hera may send Meta a device advertising identifier and limited App events (such as installation and activation) to attribute installations to Meta ads and measure advertising effectiveness. If you decline or iOS restricts tracking, Hera does not enable advertiser identifier collection; privacy-preserving aggregated attribution such as SKAdNetwork and limited events permitted by the platform may still operate.
Approximate location: Hera does not request or collect precise GPS location. If you choose Google Sign-In, Google's SDK may process coarse location (for example, an approximate region inferred from network signals) for app functionality. The iOS location permission is otherwise used only by the operating system for Bluetooth/Wi-Fi scanning to discover your recording device.
Voiceprints (biometric data): if you choose to use voice recognition, a voiceprint of you extracted from the passage you read aloud; and voiceprints accumulated for your contacts once you confirm them as speakers in a meeting. See §5.

3. How we use your data and our lawful bases

To provide the service (record, transcribe, build and recall your memory): performance of a contract.
To authenticate you using the sign-in method you choose and protect account access: performance of a contract and our legitimate interests.
To process your content with AI (see §4): your consent.
To create a sharing link at your direction and display the selected content to people who use that link: performance of a contract.
To keep the service secure, diagnose crashes and improve it: our legitimate interests / your consent for analytics where required.
To attribute installations to Meta ads and measure advertising effectiveness using an advertising identifier: your consent where required by applicable law. ATT separately controls whether iOS gives Hera technical permission to access and enable that identifier. When ATT is denied or restricted, sending limited App events and operating privacy-preserving aggregated attribution without enabling advertising identifier collection relies on our legitimate interests in measuring campaign effectiveness, where permitted by applicable law and platform settings.
To verify App Store and Google Play transactions, provide and restore subscription access, prevent fraud and analyse subscription performance: performance of a contract and our legitimate interests / your consent for analytics where required.
To manage your account and deletion requests: legal obligation and contract.
Storing and using voiceprints to tell speakers apart in meetings (see §5): your explicit consent (special category data, UK GDPR Article 9(2)(a)).

You can disable Hera Usage Statistics at any time in Settings → Privacy & Data. Disabling it stops new Hera usage-event collection and clears events waiting to be sent. It does not disable processing required by a third-party sign-in method you actively choose, or the limited Meta attribution events described below. ATT separately controls whether Hera may enable advertiser identifier collection for Meta; some limited events and privacy-preserving aggregated attribution may continue when ATT is denied.

4. AI processing and third-party recipients (important)

When you choose cloud transcription or AI features, the content needed for that feature is sent to and processed by the named AI provider below; we disclose that provider and request your explicit consent before the first such content transfer. Other recipients in this section receive only the data described for authentication, storage, diagnostics, subscriptions or advertising attribution, under the separate triggers and controls stated here.

Alibaba Cloud — stores recordings in Object Storage Service (OSS), transcribes audio with Tingwu when that transcription route is selected, sends SMS one-time codes, and processes crash/performance diagnostics through EMAS. Depending on the feature, the data may include recordings, phone numbers, device/app identifiers and diagnostic events.
Google — when you choose Google Sign-In, processes the provider account identifier, name/email claims, basic authentication usage data and coarse location for sign-in, security, app functionality and analytics. Google also processes recordings with Cloud Speech-to-Text or Gemini transcription, and processes transcripts, meeting context and AI queries with Gemini for AI-generated results. Processing may occur on Google servers outside the UK/EEA. We do not use this data for advertising or cross-app tracking.
DeepSeek — processes transcripts, meeting context and AI queries for AI assistant and meeting-analysis results when the DeepSeek route is selected.
RevenueCat — processes App Store and Google Play purchase history, purchase tokens, transaction and entitlement status, country/currency, app/device information and the Hera account identifier to validate purchases, provide and restore subscription access, prevent fraud and produce subscription analytics. We do not use this data for advertising or cross-app tracking.
Meta Platforms (Meta Platforms Ireland Limited and/or Meta Platforms, Inc., as applicable) — when you allow tracking through Apple's ATT prompt, receives a device advertising identifier and limited App events to attribute installations to Meta ads and measure advertising effectiveness. Meta may link that identifier with data from apps, websites or offline properties it operates or receives for advertising measurement. If you decline tracking, Hera does not enable advertiser identifier collection; limited App events and privacy-preserving aggregated attribution such as SKAdNetwork may still be processed as permitted by iOS. Depending on the processing and applicable terms, Meta may act as an independent or joint controller rather than solely as Hera's processor. See Meta's Privacy Policy.

We send only the data needed for the selected feature. Provider routing is controlled by our service configuration; we do not route personal data to an undisclosed AI provider. We do not sell your data. Except for the Meta advertising attribution and measurement described above, we do not use personal data for third-party advertising or cross-app tracking.

5. Voiceprints and biometric data

If you choose to use voice recognition, Hera stores a voiceprint. A voiceprint is special category data (biometric data) under the UK GDPR Article 9, and we obtain your explicit consent for it separately — agreeing to AI transcription does not mean agreeing to store a voiceprint. The two are asked for, and can be withdrawn, independently.

How it is created — two sources: (i) you: you read a short passage aloud in the App; that recording is uploaded and a voiceprint is extracted from it and stored; (ii) your contacts: once you confirm a speaker in a meeting as a particular contact, we extract and accumulate a voiceprint for that contact from the meeting audio.
What it is used for — only to tell speakers apart in meeting transcripts and label them by name. Not for identity verification, not to unlock or authorise anything, not for advertising, and never shared with third parties.
Lawful basis — your explicit consent (UK GDPR Article 9(2)(a)).
How to withdraw and delete — in the App under “Settings → My voiceprint” you can delete your own voiceprint at any time, and any contact’s voiceprint. Deleting stops automatic recognition immediately and removes the stored voiceprint; deleting your own voiceprint also withdraws this consent, and we will ask again if you want to use the feature later.
Existing content is unaffected — deleting a voiceprint does not delete your recordings, transcripts, or speaker names you already confirmed.

If you would rather not use the feature, simply do not enrol. Recording, transcription and the other AI features work without it.

6. International transfers

Where data is processed outside the UK/EEA (including by Google for AI or by the applicable Meta entity for advertising attribution), we rely on appropriate safeguards such as Standard Contractual Clauses / the UK International Data Transfer Addendum. Details are available on request.

7. Storage and security

Recordings and content are stored on Alibaba Cloud (UK region for UK users). We apply access controls and encryption in transit. No method is 100% secure.

8. Retention and account deletion

You can delete your entire account in-app (Settings → Delete Account). On request the account is immediately deactivated and access to the service is suspended. Within a 15-day recovery window you can restore the account by signing in and confirming; if you do not, once the window expires your Hera account data is permanently deleted or irreversibly de-identified and your email/phone binding is released. Diagnostic and usage logs are deleted. Apple, Google Play and RevenueCat may retain limited transaction records where required for legal, accounting, security or fraud-prevention purposes. Deleting your Hera account does not automatically cancel an App Store or Google Play subscription; you must manage or cancel it separately in the store where you purchased it.

That permanent-deletion step includes voiceprints (biometric data): your own voiceprint and the voiceprints of all contacts held under your account are deleted from our databases (see §5). You do not have to wait for account deletion — you can delete them immediately at any time under “Settings → My voiceprint”.

Meta determines how long it retains attribution information under its applicable privacy policy, considering the need to provide its products, comply with legal obligations and protect its or others' interests. Withdrawing ATT permission stops Hera from enabling future advertiser identifier collection, but does not itself retroactively delete information already held by Meta. You may use Meta's privacy controls and may contact us for assistance with an applicable data-rights request.

9. Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. If you withdraw AI-processing consent, new cloud recording uploads, transcription and AI processing are suspended; account access, device management and other functions that do not require this processing may remain available. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. To exercise your rights, use the account-deletion and privacy choices page or email support@heraai.co.

You can allow, deny or later withdraw iOS tracking permission under Settings → Privacy & Security → Tracking. Denying or withdrawing it does not disable Hera's core features and prevents Hera from enabling future advertiser identifier collection for Meta.

You may object to our legitimate-interest processing of limited Meta attribution events by emailing support@heraai.co. We will assess and honour the objection where required by applicable law.

10. Recordings of other people

Hera lets you record meetings that may capture other people's voices. You are responsible for obtaining any consent required by law in your jurisdiction before recording others.

11. Sharing links

If you choose to create a sharing link, anyone who receives or is forwarded that link can view the selected content without signing in to Hera. Do not create or distribute a link for content you are not entitled to share, and avoid sharing sensitive content unless every affected person has agreed. A shared page remains available while its link and source content remain available; deleting the source content or your account, or disabling the link, may make it unavailable. We do not use shared content for advertising or cross-app tracking.

12. Children

Hera is not intended for children under 16. We do not knowingly collect their data.

13. Changes

We may update this policy and will post the new version at https://api-global.heraai.co/legal/privacy with a revised effective date.

14. Contact

Zhuhai Yuejiajun Technology Co., Ltd., support@heraai.co.