Privacy Policy

1Who we are

Heroco (“we”, “us”) is a gamified platform that teaches children aged 7–15 to create with AI. The service is operated by Heroco LLC, a company registered in Ukraine, USREOU 46203561, which is the data controller. An account is created and held by a parent or guardian; a child uses the service under that account.

2Data we collect

From the parent/guardian: email address; the child’s age or age band; billing information processed by our payment provider (we never see or store your full card number); device and connection data (IP address, browser/OS, approximate region) and usage/analytics on the adult-facing pages.

From the child (minimised): age band; in-app activity and learning progress; the prompts they enter and the creations they generate with our AI features; an optional avatar/display name. We do not ask children for their real name, address, phone number, precise location, or photos.

3Why we use it & legal bases

For children below the applicable age of digital consent, our lawful basis relies on verifiable parental consent (see the Children’s Notice).

4AI processing

When a user creates with AI, their input (prompt) and the generated output are processed by our AI providers (including Anthropic / Claude), solely to generate and safety-filter the result. Children’s inputs and creations are not used to train third-party AI models, and we do not build advertising or behavioural profiles of children. Outputs are moderated and, for children, kept private by default.

5Who we share with (processors)

We do not sell personal data. We share it only with service providers acting on our instructions:

• WayForPay — payments, deposits, refunds;
• our AI providers (including Anthropic / Claude) — AI generation & safety filtering;
• Cloudflare — hosting/infrastructure; our email delivery provider — email/waitlist;
• Microsoft Clarity — product analytics and session diagnostics on the adult-facing pages;
• Google Analytics 4 — aggregate traffic analytics on the adult-facing pages;
• Meta Conversions API — server-side confirmation of adult waitlist sign-ups and account registrations (hashed email; adults only, never children's data).

Sharing a child’s data with third parties (including AI providers) is covered by the separate parental consent described in the Children’s Notice. We may also disclose data where required by law.

6International transfers

We operate across Taiwan, Southeast Asia and beyond, and data may be processed in globally distributed data centres (Cloudflare edge network). Where data leaves your region, we rely on appropriate safeguards such as EU Standard Contractual Clauses (or an adequacy decision) where applicable.

7Data retention

We keep personal data only as long as necessary for the purposes above. We do not retain children’s data indefinitely: data is kept while the account is active and is deleted or anonymised within 90 days after the account is closed, except where we must keep limited records for legal, tax or fraud-prevention reasons. Limited technical telemetry that contains no content (for example model latency and token counts) may be kept for up to 12 months from creation.

8Your rights

Subject to local law, you may request access to, correction of, deletion of, or a copy of your (and your child’s) personal data; restrict or object to processing; and withdraw consent at any time. To exercise these, contact us (§12); we respond within 30 days. You may also complain to your local data-protection authority.

9Security

We use encryption in transit, access controls, and reputable processors. Card data is handled by our PCI-compliant payment provider — Heroco never stores full card numbers. No method of transmission is 100% secure, but we work to protect your information.

10Cookies

We use strictly-necessary cookies to run the service and, with consent where required, limited analytics on adult-facing pages. We do not use advertising or cross-site tracking cookies in the children’s experience. You can limit analytics via your browser settings and standard opt-out tools; the children’s experience carries no analytics identifiers.

11Regional notes

Taiwan (PDPA): the notice required by Article 8 of the Personal Data Protection Act is given in this policy: our identity (§1), the purposes (§3), the categories of data (§2), and the period, area, recipients and method of use: data is used while the account is active plus the retention window in §7, in Taiwan and in the regions where the processors listed in §5 and §6 operate, by automated electronic means over the internet. Under Article 3 you may query or review your data, request a copy, ask us to supplement or correct it, demand that we cease collecting, processing or using it, and demand deletion (contact §12). If you choose not to provide the required data (for example the parent’s email), we cannot create the account or provide the service. We bear the burden of proving consent, and children’s data is never exposed publicly.

EU/UK (GDPR / UK Children’s Code): the mandatory disclosures in this policy, privacy-by-default and data-minimisation for anyone likely under 18, and no behavioural advertising or unnecessary profiling of children. EU/UK representative: an EU/UK representative will be appointed before the Service is offered to EU/UK users; contact hi@heroco.ai.

US (COPPA) & Singapore (PDPA): see the Children’s Notice for parental-consent details; California/US-state privacy rights available on request.

12Contact & changes