Hera Privacy Policy

Effective date: 21 August 2026

This policy is also available in Chinese. In case of any discrepancy between language versions, this English version prevails.

1. Who we are

Hera ("the app") is provided by Zhuhai Yuejiajun Technology Co., Ltd. (珠海跃嘉竣科技有限公司) ("we", "us"). This policy explains what personal data we process and your rights under the UK GDPR and applicable data-protection law. Contact: support@heraai.co.

2. Data we process

Account data: email address and/or phone number you use to sign in (via one-time code), and, when you choose Apple or Google sign-in, the provider account identifier and basic profile information such as name and email returned by that provider.
Recordings & transcripts: audio you record (in-app or via a paired recording device) and the text transcripts generated from it.
AI interaction data: the questions you ask Hera's AI assistant and its responses, which are based on your own content.
Derived memory: contacts, facts, to-dos and profile summaries automatically extracted from your meetings.
Shared content & link data: when you explicitly create a sharing link, the selected meeting, transcript, AI conversation or AI reply, together with an opaque link identifier and basic access/diagnostic events needed to operate the link.
Device & connectivity data: identifiers of paired recording hardware and Bluetooth/Wi-Fi connection data used to sync it.
Subscription & purchase data: App Store or Google Play product, base-plan and transaction identifiers, purchase tokens, subscription and entitlement status, purchase/renewal/cancellation/refund/expiry history, country/currency, limited app/device information, and the Hera account identifier used to provide and restore access. Apple or Google processes the payment; neither Hera nor RevenueCat receives your payment-card or bank-account details.
Diagnostics & usage: crash and performance logs (via Alibaba Cloud EMAS) and minimal usage events. Usage events that relate to your queries store only a one-way SHA-256 hash, never the query text. The Google Sign-In SDK may also process basic authentication usage data for app functionality and analytics.
Approximate location: Hera does not request or collect precise GPS location. If you choose Google Sign-In, Google's SDK may process coarse location (for example, an approximate region inferred from network signals) for app functionality. The iOS location permission is otherwise used only by the operating system for Bluetooth/Wi-Fi scanning to discover your recording device.

3. How we use your data and our lawful bases

To provide the service (record, transcribe, build and recall your memory): performance of a contract.
To authenticate you using the sign-in method you choose and protect account access: performance of a contract and our legitimate interests.
To process your content with AI (see §4): your consent.
To create a sharing link at your direction and display the selected content to people who use that link: performance of a contract.
To keep the service secure, diagnose crashes and improve it: our legitimate interests / your consent for analytics where required.
To verify App Store and Google Play transactions, provide and restore subscription access, prevent fraud and analyse subscription performance: performance of a contract and our legitimate interests / your consent for analytics where required.
To manage your account and deletion requests: legal obligation and contract.

You can disable Hera Usage Statistics at any time in Settings → Privacy & Data. Disabling it stops new Hera usage-event collection and clears events waiting to be sent. It does not disable processing required by a third-party sign-in method you actively choose; you may instead use another available sign-in method.

4. AI processing and third-party sub-processors (important)

When you choose cloud transcription or AI features, the data needed for that feature is sent to and processed by the named provider below. We disclose the provider and request your explicit consent before the first such transfer.

Alibaba Cloud — stores recordings in Object Storage Service (OSS), transcribes audio with Tingwu when that transcription route is selected, sends SMS one-time codes, and processes crash/performance diagnostics through EMAS. Depending on the feature, the data may include recordings, phone numbers, device/app identifiers and diagnostic events.
Google — when you choose Google Sign-In, processes the provider account identifier, name/email claims, basic authentication usage data and coarse location for sign-in, security, app functionality and analytics. Google also processes recordings with Cloud Speech-to-Text or Gemini transcription, and processes transcripts, meeting context and AI queries with Gemini for AI-generated results. Processing may occur on Google servers outside the UK/EEA. We do not use this data for advertising or cross-app tracking.
DeepSeek — processes transcripts, meeting context and AI queries for AI assistant and meeting-analysis results when the DeepSeek route is selected.
RevenueCat — processes App Store and Google Play purchase history, purchase tokens, transaction and entitlement status, country/currency, app/device information and the Hera account identifier to validate purchases, provide and restore subscription access, prevent fraud and produce subscription analytics. We do not use this data for advertising or cross-app tracking.

We send only the data needed for the selected feature. Provider routing is controlled by our service configuration; we do not route personal data to an undisclosed AI provider. We do not sell your data and do not use it for advertising.

5. International transfers

Where data is processed outside the UK/EEA (e.g. by Google for AI), we rely on appropriate safeguards such as Standard Contractual Clauses / the UK International Data Transfer Addendum. Details available on request.

6. Storage and security

Recordings and content are stored on Alibaba Cloud (UK region for UK users). We apply access controls and encryption in transit. No method is 100% secure.

7. Retention and account deletion

You can delete your entire account in-app (Settings → Delete Account). On request the account is immediately deactivated and access to the service is suspended. Within a 15-day recovery window you can restore the account by signing in and confirming; if you do not, once the window expires your Hera account data is permanently deleted or irreversibly de-identified and your email/phone binding is released. Diagnostic and usage logs are deleted. Apple, Google Play and RevenueCat may retain limited transaction records where required for legal, accounting, security or fraud-prevention purposes. Deleting your Hera account does not automatically cancel an App Store or Google Play subscription; you must manage or cancel it separately in the store where you purchased it.

8. Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. If you withdraw AI-processing consent, new cloud recording uploads, transcription and AI processing are suspended; account access, device management and other functions that do not require this processing may remain available. You may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. To exercise your rights, use the account-deletion and privacy choices page or email support@heraai.co.

9. Recordings of other people

Hera lets you record meetings that may capture other people's voices. You are responsible for obtaining any consent required by law in your jurisdiction before recording others.

10. Sharing links

If you choose to create a sharing link, anyone who receives or is forwarded that link can view the selected content without signing in to Hera. Do not create or distribute a link for content you are not entitled to share, and avoid sharing sensitive content unless every affected person has agreed. A shared page remains available while its link and source content remain available; deleting the source content or your account, or disabling the link, may make it unavailable. We do not use shared content for advertising or cross-app tracking.

11. Children

Hera is not intended for children under 16. We do not knowingly collect their data.

12. Changes

We may update this policy and will post the new version at https://api-global.heraai.co/legal/privacy with a revised effective date.

13. Contact

Zhuhai Yuejiajun Technology Co., Ltd., support@heraai.co.