Privacy Policy

1. Information We Collect

Information You Provide. We collect information you provide directly to us:

• Account Information: Email address, name, and authentication credentials when you register
• User Content: Prompts, text inputs, uploaded images, audio files, and other content you provide to the Service
• Payment Information: Billing details processed through our payment providers (we do not store complete payment card numbers)
• Communications: Information you provide when contacting support or providing feedback

Information Collected Automatically. When you use the Service, we automatically collect:

• Usage Data: Features used, workflows created, generations performed, and interaction patterns
• Device Information: IP address, browser type, operating system, device identifiers, and screen resolution
• Log Data: Access times, pages viewed, referring URLs, and error reports

AI-Generated Content. We store AI-generated outputs (images, videos, audio, text) that you create using the Service, along with associated metadata such as prompts, model selections, and generation parameters.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: Process your requests, generate AI content, manage your account, and provide customer support
• Service Improvement: Analyze usage patterns, develop new features, and improve performance (using anonymized or aggregated data)
• Communications: Send service updates, security alerts, and (with your consent) marketing communications
• Security: Detect fraud, prevent abuse, enforce our Terms, and protect user safety
• Legal Compliance: Comply with legal obligations, respond to lawful requests, and protect our rights

3. AI Training and Third-Party Data Processing

Our Practices. We do not use your personal content (prompts, uploads, or generated outputs) to train proprietary AI models without your explicit consent. Anonymized and aggregated usage data may be used to improve the Service.

Third-Party AI Providers. When you use AI features, your inputs are processed by third-party AI providers. Each provider has their own data practices:

• OpenAI: May use API data to improve models unless opted out via their platform
• Google (Gemini/Imagen/Veo): Subject to Google Cloud data processing terms
• Anthropic: Claude API data subject to Anthropic's data policies
• FAL.AI: Processes data to generate outputs per their terms
• ElevenLabs: Audio data processed for voice synthesis per their terms

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With trusted third parties who help operate the Service (hosting, payment processing, authentication, analytics)
• AI Providers: With AI model providers to process your generation requests as described above
• Legal Requirements: When required by law, court order, or government request
• Safety and Rights: To protect the safety, rights, or property of Hermosa Labs, our users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Consent: When you explicitly authorize us to share your information

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Strict role-based access controls and authentication requirements
• Infrastructure: Hosted on secure cloud infrastructure with regular security assessments
• Monitoring: Continuous monitoring for security threats and unauthorized access

While we strive to protect your data, no method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

6. Data Retention

We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account Data: Retained while your account is active and for thirty (30) days after deletion request
• Generated Content: Stored until you delete it or close your account
• Usage Logs: Retained for ninety (90) days for security and analytics purposes
• Payment Records: Retained for seven (7) years as required by tax and financial regulations

Some data may be retained longer if required by law or for legitimate business purposes such as resolving disputes or enforcing agreements.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication, security, and basic functionality
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Service
• Performance Cookies: Monitor and improve Service performance

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect Service functionality.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request access to personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent where processing is based on consent
• Opt-Out: Opt out of marketing communications at any time

To exercise these rights, contact us at [email protected]. We will respond within thirty (30) days.

9. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information (subject to exceptions)
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Do Not Sell: We do not sell your personal information as defined by the CCPA

California residents may designate an authorized agent to make requests on their behalf. We may require verification of identity before processing requests.

10. International Data Transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Service providers who participate in recognized transfer mechanisms
• Your explicit consent where appropriate

11. Children's Privacy

The Service is not intended for children under eighteen (18) years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

In compliance with COPPA, we do not knowingly collect information from children under 13. If we discover that we have collected personal information from a child under 13, we will delete such information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last Updated” date. For significant changes, we may provide additional notice such as email notification. Your continued use of the Service after changes constitutes acceptance of the updated policy.