Privacy Policy

This policy explains what personal data Hiera collects, why, and what rights you have. The data controller is Hiera, Inc., 1111B S Governors Ave, STE 48131, Dover, DE 19904, United States ("Hiera", "we", "us"). Contact:legal@hiera.design.

• Account data: your email address and, if you sign in with Google, your name and profile picture as provided by Google. We do not receive or store your Google password.
• Content: projects, images, drawings, PDFs, notes, comments and prompts you upload or create, and metadata about them (timestamps, authorship, project membership).
• Payment data: when you buy AI credits, payment is handled by Stripe. Stripe securely keeps the payment method you use (for example your card) on your workspace's Stripe customer record for future purchases, including automatic top-ups if you turn them on in Billing. We receive confirmation of the transaction, your billing country, and enough to show you which method is saved (card brand, last four digits and expiry date), but never your full card number or security code.
• Usage data: product analytics events (pages visited, features used, device and browser type) collected via PostHog to understand how Hiera is used and improve it.
• Advertising and measurement data: if you accept cookies on our sites or in the app, advertising and measurement tags (loaded through Google Tag Manager) may collect information about your visit, such as pages viewed, referring campaign, device and an advertising identifier, to measure our campaigns and show relevant ads. See Section 9.
• Technical data: server logs, IP addresses and error reports (via Sentry) needed to keep the Service secure and reliable.
• Communications: messages you send us, and email delivery/engagement data for notification emails.

• To provide the Service: operating your account, storing and syncing your Content, enabling collaboration, processing payments and keeping your payment method on file for future purchases (performance of a contract).
• To provide AI features: sending your prompts and selected images to our AI providers to generate results (performance of a contract).
• To keep the Service secure and fix errors: logs and error monitoring (legitimate interest).
• To improve the product: aggregated analytics about feature usage (legitimate interest; you can object, see Section 8).
• To measure and improve our advertising: cookies and similar technologies on our sites and in the app, only with your consent (see Section 9), which you can withdraw at any time.
• To send notifications: emails about activity relevant to you (mentions, comments, invitations). You can turn these off per type in notification preferences or via the unsubscribe link in any email.
• To comply with legal obligations: accounting and tax records for purchases.

When you use AI features, the prompt and the images you select are sent to third-party AI model providers (currently OpenAI, accessed through Vercel's AI gateway) to generate the result. These providers process the data to deliver the feature and are contractually restricted from using API content to train their models. We do not use your Content to train our own models.

We never sell your personal data. We share it only with service providers that help us run Hiera, under data processing agreements:

• Cloudflare: hosting, file storage and real-time collaboration infrastructure
• Stripe: payment processing and secure storage of your saved payment method
• Google: sign-in with Google (if you choose it)
• OpenAI and Vercel: AI generation (see Section 4)
• PostHog: product analytics
• Google (Tag Manager, Analytics), Meta and TikTok: advertising measurement on our sites and in the app, only if you accept cookies
• Sentry: error monitoring
• Our email delivery provider: transactional and notification emails

We may also disclose data if required by law, or as part of a merger or acquisition (in which case this policy continues to apply to your data).

Content you share is also visible to the people you share it with: workspace and project collaborators and, for public links, anyone who has the link.

Our providers may process data outside your country, including in the United States. Where data leaves the EEA/UK, we rely on safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

We keep your data while your account is active. If you delete Content or your account, we delete the associated personal data within a reasonable period, except where we must keep it longer (for example, transaction records for tax law) or in routine encrypted backups that are purged on their normal schedule. Anonymized or aggregated data may be retained.

Saved payment methods are kept by Stripe until you remove them. You can remove or change the saved payment method at any time from Billing in the app. When a workspace is deleted, we remove every payment method saved for it from Stripe; Stripe retains the underlying transaction records as required by financial regulations.

Depending on where you live (including under the GDPR), you have the right to access, correct, delete and receive a copy of your personal data, to restrict or object to certain processing (including analytics based on legitimate interest), and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, emaillegal@hiera.design. You can remove a saved payment method yourself from Billing in the app. You also have the right to lodge a complaint with your local data protection authority.

Hiera uses strictly necessary storage (such as your session token and your cookie choice) to keep you signed in and remember your preferences; this does not require consent. Our product analytics (PostHog) runs in cookieless mode: it does not set cookies or store identifiers on your device, and anonymous visits reset each session.

On our public sites (hiera.design and learn.hiera.design) and in the app (app.hiera.design) we also use cookies and similar technologies for advertising and measurement, for example Google Analytics, the Meta pixel and the TikTok pixel, loaded through Google Tag Manager. These are set only if you choose Accept in the cookie banner; one answer covers the sites and the app. If you choose Decline, or make no choice, no advertising or measurement tags load. You can change your choice at any time with the Cookie settings link in the footer of our sites, under Settings › Privacy in the app, or by clearing your browser's site data. Where these providers process data outside the EEA, they rely on standard contractual clauses or the EU-US Data Privacy Framework.

Hiera is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the product evolves. For material changes we will notify you by email or in-app notice before they take effect. The "Last updated" date at the top shows the current version. See also our Terms of Service.