Heromi — Privacy Policy

Effective date: June 13, 2026
Last updated: June 13, 2026

1. Who we are & who this app is for

Heromi (“Heromi”, “we”, “us”, “our”) is a mobile application published by Heromi. Heromi turns a child into the hero of a short, cinematic scene, writes a multilingual story about them, and narrates that story in a parent’s cloned voice.

Heromi is intended for adults aged 18 and over. The account holder must be an adult. Heromi is not directed to children, is not listed in the Apple “Kids” category, and is not designed for use by children.

The app is designed so that a parent or legal guardian creates content featuring their own child. By uploading a child’s photo or recording a voice, the adult account holder confirms that they are the parent or legal guardian of the child depicted (or otherwise have full legal authority over that child’s image), that the voice recorded is their own, and that they consent on their own behalf and on behalf of the child to the processing described in this policy.

This policy explains what we collect, why, who we share it with, and the choices and rights you have.

2. Data we collect

We collect only what is needed to make the app work.

Category	What it is	How we get it
Child photo (User Content / biometric-adjacent)	A photograph of a child’s face that you supply, plus tightly-cropped face images derived from it on your device. Because it depicts identifiable facial features, it may be treated as biometric-adjacent / special-category data under GDPR and as personal information under COPPA’s 2025 amendments and CCPA.	Captured with the camera or chosen from your photo library, with your permission.
Parent voice recording (Audio Data / biometric-adjacent)	An audio recording of a parent’s voice, used to create a synthetic (“cloned”) voice for narration. A voiceprint may be treated as biometric-adjacent / special-category data.	Recorded with the microphone, with your permission.
Generated outputs	The hero image(s), short video, story text, and narration audio that the app generates from your inputs.	Produced by the AI services described in Section 4 from your inputs.
Subscription data	Your subscription status, plan (Weekly / Monthly), and renewal state. We do not receive your full payment-card details — payment is handled by Apple.	From Apple’s StoreKit / App Store.
Diagnostics & technical data	Crash logs, error reports, and basic technical information used to keep the app stable.	Generated automatically while you use the app.

We do not ask for your name, postal address, or contact details to use the core features. We do not knowingly collect more than is described above.

3. How we use your data

We use your data only to provide the app’s functionality, specifically to:

• generate the hero image, short video, story, and voice narration you request;
• preserve the child’s facial identity across generated images so the hero looks consistent;
• clone the parent’s voice and synthesize narration in your chosen language;
• manage your subscription and entitlements; and
• diagnose crashes and keep the app working.

We do not:

• use your data, the child’s photo, the parent’s voice, or generated outputs for advertising or to build advertising or marketing profiles;
• sell or “share” your personal information (as those terms are used under the CCPA);
• use your inputs or outputs to train our own AI models; or
• permit our AI processors to use your paid-API inputs to train their foundation models (see Section 4).

4. Third-party processors (sub-processors)

To generate your content, the app sends certain data to the specialized AI providers listed below. Each acts as our processor / service provider, processes the data only to perform the requested generation, and is bound by contractual terms requiring them to provide a level of protection for your data equivalent to the protections described in this policy. We send each provider only the minimum data needed for its task.

Google (Gemini API — story, descriptors & image generation)

• Models used: Gemini 2.5 Flash (story text, identity descriptors, edit suggestions) and “Nano Banana” (gemini-3.1-flash-image-preview) for image generation.
• Data sent: the child’s photo and derived face crops, plus the text prompts used to generate images and story content.
• Use restriction: accessed via the paid Gemini API, under which Google states the data is not used to train Google’s models.
• Provider terms: [link placeholder — Google API / Gemini terms]

Minimax (Hailuo-02 — video generation, api.minimax.io)

• Data sent: the generated hero image, supplied as the first frame for short video generation. (Minimax receives the generated image, not the original child photo, unless that image is itself a likeness derived from it.)
• Provider terms: [link placeholder — Minimax terms]

ElevenLabs (voice cloning + text-to-speech, api.elevenlabs.io)

• Data sent: the parent’s voice recording, for Instant Voice Cloning, and the story text to be synthesized as narration in your chosen voice and language.
• Provider terms: [link placeholder — ElevenLabs terms]

Apple (App Store / StoreKit — payments & subscriptions)

• Data sent / received: subscription purchase and entitlement status. Apple processes your payment; we do not receive your full card details.
• Provider terms: [link placeholder — Apple App Store / privacy terms]

Each of these providers maintains its own privacy practices. We require each to protect your data to a standard equivalent to this policy, but their own terms govern their independent practices.

5. Legal basis for processing (GDPR / UK GDPR)

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver the generation, narration, and subscription features you have asked for.
• Explicit consent for special-category / biometric-adjacent data (Art. 9(2)(a)) — the child’s facial image and the parent’s voiceprint may constitute special-category data. We process them only on the basis of your explicit consent, which you give by uploading the photo and recording the voice after being informed of this processing. You may withdraw this consent at any time (see Sections 8 and 9); withdrawal does not affect processing already carried out.
• Legitimate interests (Art. 6(1)(f)) — for limited diagnostics and security, where this does not override your rights.

6. International data transfers

Our processors may process your data outside your country of residence, including outside the European Economic Area and the United Kingdom. Where data is transferred internationally, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) (and the UK Addendum where applicable), together with the contractual protections described in Section 4, to ensure your data receives an equivalent level of protection.

7. Data retention

• Child photos, face crops, and parent voice recordings are stored locally on your device and transmitted to the relevant processor only for the time needed to generate your content. We retain them only as long as needed to provide the features you use.
• Generated outputs (images, video, story, narration audio) are stored on your device for you to keep, and you may delete them at any time.
• Processor-side data: our AI processors retain and delete transient request data according to their own published retention practices for the paid APIs we use.
• Subscription and diagnostic data is retained only as long as needed for the relevant purpose (e.g. managing entitlements, fixing crashes) or as required by law.

When you delete a creation or a voice in the app (Section 9), the associated local data is removed from your device.

8. Your rights

Depending on where you live (EU/UK GDPR, CCPA/CPRA, and similar laws), you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data (“right to be forgotten”);
• Withdraw consent at any time for biometric-adjacent processing (the child’s image and the parent’s voice);
• Data portability — receive your data in a portable format;
• Object to or restrict certain processing;
• Non-discrimination for exercising your CCPA rights; and
• Lodge a complaint with your local data protection authority (e.g. your EU supervisory authority, the UK ICO, or the California Privacy Protection Agency).

To exercise any of these rights, use the in-app controls described in Section 9 or contact us at support@heromi.app. We will respond within the timeframes required by applicable law.

9. How to delete your data

You can delete your data directly and at any time:

• Delete a creation — In the app, open the creation and delete it. This removes the associated hero image, video, story, and narration from your device.
• Delete a voice — In Settings → Voices, remove any saved voice. This deletes the local recording and stops that voice from being used for narration.
• Delete everything / request erasure — Email support@heromi.app with the subject “Data Deletion Request.” We will delete the personal data we control and instruct our processors to delete associated data to the extent they retain it.

If you withdraw consent for biometric-adjacent processing, stop using the photo and voice features and delete the relevant creations and voices as above.

10. Children’s data

Heromi is intended for adults (18+) and is not directed to children. We do not knowingly allow children to create accounts or use the app directly.

The app’s purpose is for an adult parent or guardian to create content of their own child. The child’s photo is provided by the responsible adult, who confirms they have the legal authority and parental consent to do so. Consistent with COPPA’s 2025 amendments, we treat a child’s faceprint-adjacent image as personal information and process it only as a processor acting on the responsible adult’s instructions, for the limited purpose of generating the requested content — never for advertising, profiling, or model training.

If you believe a child has used the app without appropriate adult authority, or that we hold a child’s data without a proper basis, contact us at support@heromi.app and we will delete it.

11. AI-generated content notice

Heromi creates AI-generated images, video, story text, and synthetic (“cloned”) voice narration. These outputs are produced by artificial intelligence and are not real photographs, recordings, or footage, and the narration voice is a synthetic clone, not a genuine recording of the speaker performing that text.

In line with transparency expectations under the EU AI Act and similar frameworks, we mark generated content as AI-generated and ask that you do the same when you share it. Do not use Heromi to create misleading, deceptive, or impersonating content, or content of anyone without their (or their guardian’s) consent.

12. Security

We use reasonable technical and organizational measures to protect your data, including transport encryption (HTTPS/TLS) for data sent to our processors, on-device storage of sensitive inputs, and minimization of the data we transmit. No method of transmission or storage is completely secure, but we work to protect your data and to require our processors to do the same.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Continued use of the app after an update means you accept the revised policy.

14. Contact us

Heromi
Email: support@heromi.app
Website: https://heromi-app-67749.web.app

If you are in the EU/UK and are not satisfied with our response, you may contact your local data protection authority.