HERO NETWORK PRIVACY POLICY

Hero Network is operated by 134 Main Street Heroes, LLC ("Hero Network," "we," "us"). This policy explains what we collect, why, who processes it, how long we keep it, and the rights you have, when you visit heronetwork.io or use our video platform (the "Services"). It is written to be read: if anything here is unclear, write to [email protected] and we will explain it.

1. Information you provide

Account data: name, email address, password, organization, and profile details. Hero Network is a real-identity platform; accounts carry real names. Payment data: our payment processor (Stripe) collects your card details; we receive billing address and transaction confirmations and never store card numbers. Content: the videos, voice recordings, photos, documents, and project materials you and your invited participants record, upload, or create. This is the heart of the product and it gets its own rules (Sections 4, 5, and 7). Participant data: when a project invites a guest, we process the guest's name, email, title/organization if provided, and their recordings and consent records. Support and correspondence: anything you send our team.

2. Information collected automatically

Device type, operating system, browser, IP address; pages and features used, clicks, and navigation; content-creation activity (videos created, recordings completed, projects created); referral source and UTM parameters; subscription plan, trial status, and feature usage; onboarding progress. Collected via cookies, browser local storage (key: hero_attribution), and the analytics services in Section 3. Cookies: _ga and _gid (Google Analytics; 2 years / 24 hours), session cookies for authentication (expire on browser close). You can control cookies in your browser settings; blocking some may affect functionality. Our sites do not respond to "Do Not Track" or Global Privacy Control browser signals; because we do not sell your personal information or share it for advertising (Section 3), there is nothing for those signals to opt out of.

3. Who processes your data (the real list)

We use third-party processors to run the Services. This list is complete as of the "Last updated" date; it names what each provider receives.

Infrastructure and delivery

Supabase (database and authentication): account profiles, project metadata, guest records, transcripts, and application data. Amazon Web Services (file storage and rendering): your uploaded and recorded media files (S3); final video composition runs on AWS Lambda. Stripe (payments): card details and billing address (we never store card numbers). Resend (email delivery): names, email addresses, and invitation/notification content.

AI processing (what makes your videos)

AssemblyAI (transcription): audio from your recordings, via time-limited links, to produce transcripts, speaker labels, and highlights. We have opted out of AssemblyAI's model improvement program: our audio is not used to train their models. Google Gemini (visual analysis): video and image files you provide for editing (for example, b-roll), uploaded for analysis; Google's file API retains uploads for up to 48 hours, and on the paid tier we use, Google does not use content to improve its products. Anthropic (Claude) (editorial assembly): transcript excerpts and editing instructions as text. Your audio and video files are not sent to Anthropic, and Anthropic does not use our inputs or outputs to train its models. Google Lyria (music generation): text descriptions only, to generate soundtrack music. No user audio or video is sent. Twelve Labs (video understanding): b-roll video footage you upload is indexed by this service so the editor can find the right moments in it. Auphonic (speech cleanup): when a soundtrack is added and the dialogue needs cleanup, the dialogue audio track is processed by this service. It runs only for projects that accepted the AI-music disclosure. Auphonic's servers automatically delete productions after a short period (21 days for audio, 7 days for video); Auphonic's published terms also permit it to keep selected audio excerpts to improve its processing algorithms, and we have asked that our productions be excluded from that practice. Vocal-delivery (prosody) analysis is computed on our own servers, not by a third party. We hold our AI providers to no-training terms, and we verify their data terms and keep dated records of them. AssemblyAI, Google, and Anthropic are covered by the statements above; equivalent commitments from Twelve Labs and Auphonic are in progress, and we will update this section when they land.

Analytics and business operations

PostHog (product analytics): email address and usage events. Google Analytics 4 (web analytics): page views and interactions, via cookies. Opt-out: tools.google.com/dlpage/gaoptout. Pipedrive (CRM): names, emails, organizations, and marketing opt-in status of contacts and guests. Jina AI and Apify (public web and social lookup): when a project adds social or web context, public profile URLs or handles are fetched through these services. We send these services only the specific URL or handle the project supplies; we do not direct any broader collection about people who are not users, and what is fetched is used only inside the requesting project and is deleted with it. People in your project, and the public if you publish. Members and invited guests of a project can see the names, recordings, and materials shared within that project. Videos stay private to their project unless someone with permission publishes them to the community gallery; a published video, and the names of the people appearing in it, are visible to other users and can be viewed, copied, or shared by them. Business transfers. If Hero Network is involved in a merger, acquisition, financing, reorganization, bankruptcy, or a sale of some or all of its assets, your information may be reviewed in diligence (under confidentiality obligations) and transferred to the successor as part of that transaction. Any successor takes your information subject to this policy as it stood when the information was collected — including the purpose-limited content license and the commitment that third-party AI providers may not train on your content. Legal disclosures. We may disclose information when required by law or legal process, or when reasonably necessary to protect the rights, property, or safety of Hero Network, our users, or others — for example, to respond to a lawful subpoena or to investigate fraud, abuse, or a security incident. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined in U.S. state privacy laws).

4. How we use information

Provide, operate, and improve the Services (including producing your finished videos); Process payments and manage subscriptions; Provide support and send service communications, and, with consent, marketing messages; Understand usage to improve features; measure how people find us; Detect and prevent fraud, abuse, and security incidents, and enforce our Terms of Service; Comply with legal obligations.

5. How the system learns from you (and how to opt out)

When you edit a video the Service produced (keeping, swapping, trimming, or reordering clips), the system records those editing choices and uses them to improve its editing for everyone. What it learns is aggregate: statistical weights about what makes a good edit, pooled across users. The underlying AI models are not trained on your footage, we build no per-user model of your voice or face, and we create no voiceprints. Voice and audio data used to evaluate or improve the system is de-identified first. We do not attempt to re-identify de-identified or aggregate data. You can opt out of having your editing activity used for improvement in your account settings, without losing AI editing. We also test editing improvements by comparing versions of our editing system (for example, learned editing weights versus defaults) across projects. This affects only how a video is edited, never who can see it.

6. Data retention

7. Your rights and choices

Access, correction, deletion: you can access and update account data in your profile, and delete content in the Service. To close your account, contact us at [email protected] and we will complete closure within 30 days. You may also email [email protected] to request access to, a copy of, or deletion of your personal information, and we will respond within 45 days. If we decline a request, we will tell you why, and you can appeal by replying to our response. People on camera who are not account holders: if you appear in a video on Hero Network and want your appearance removed, email [email protected]. We honor these requests through a mediated removal process described in the Terms of Service, whether or not you have an account. Marketing communications: unsubscribe links in every marketing email. Cookies and analytics: browser controls (Section 2) and the Google Analytics opt-out. AI improvement opt-out: Section 5.

8. Children's privacy

Children appear in family stories; that is a normal use of Hero Network, and it is governed by consent, not by pretending children are not on camera. Children on camera: a minor may appear in recordings only with a parent or legal guardian's consent, obtained through the project's consent flow before recording begins. While a video featuring a child under 13 remains private to its project, that consent is confirmed by email plus a second verification step. Before any such video is published to the shared network, we require verifiable parental consent in the form of a signed parental consent form, consistent with COPPA. Photos, videos, and audio of a child are personal information under COPPA whether or not a name is attached. Accounts: you must be at least 18 years old to hold a Hero Network account. We do not knowingly collect personal information directly from children under 13. If we learn we have collected a child's personal information without the consent this section requires, we will delete it.

9. Security

Encryption in transit, access controls, and least-privilege service access. No method of transmission or storage is completely secure; we cannot guarantee absolute security. We will notify affected users of a breach as required by law — without unreasonable delay, and for Maine residents no later than 30 days after we identify the breach.

10. Where data is processed

We are a U.S. company; data is processed in the United States. If you use the Services from outside the U.S., your information will be transferred to the U.S.

11. Changes to this policy

We will post changes here and update the date above; for material changes we will give notice by email or in-product before they take effect.

12. Contact

134 Main Street Heroes, LLC d/b/a Hero Network PO Box 337, Wayne, ME 04284 [email protected]