Privacy Policy
The short version
We collect the minimum needed to make your book: your account email, the child's first name, age, gender and interests you choose to share, and the photo you upload. The photo is kept only so we can redraw the character if the likeness is wrong, and it is deleted automatically seven days after upload. Everything in the book is made from the illustration, not the photo. We never sell personal data, we build and train no AI models of our own, and we use no advertising tools at all.
Children's privacy
Hero of You is a service for adults (18+). It is not directed to children, and we do not knowingly let children create accounts or upload their own information. A child's first name, age and photo are provided by the adult making the book, who confirms they are the parent or guardian (or have their permission).
If you believe a child has provided us information directly, contact us at shushanran@gmail.com and we will delete it.
Your child's photo and details
Photos are uploaded by you, an adult, and never collected from children directly. We do not build or train AI models ourselves. The illustrations are generated by an external provider - Google's Gemini API - which receives the photo once, in order to draw the illustrated character.
We do not train any model on your photo or your child's details, and we do not sell them or share them with anyone except the processors listed below, strictly to provide the service. We use Google's Gemini API on a paid plan, under terms in which Google states it does not use the prompts or files we send - including images - to improve its products.
Then we delete it. The photo is kept for seven days after upload, only so that "Draw again" can redraw the character if the likeness is wrong, and then it is erased from our storage automatically. Your book, its cover and every chapter are generated from the illustration, and so is the file we send to the printer, so we never need your child's photo after that and we do not keep it.
What we collect
Account: email address, name (optional), a hashed password (never the password itself) or your Google account id.
Book creation: the child's first name, age, gender/pronouns, interests, occasion, dedication text, and the uploaded photo.
Guest delivery address: if you make a preview without an account, the email address you give us so we can send it to you.
Orders: the shipping name and address you enter for printed books, and your order history. Card details go directly to Stripe - they never touch our servers.
Technical: basic, privacy-friendly, cookieless page analytics (Vercel), which carry no advertising identifiers.
With your consent only: product analytics that record how pages are used, including mouse movement, clicks and scrolling (Microsoft Clarity). It writes cookies, it is off until you accept, and it is not loaded at all if you decline. The photograph you upload is masked out of those recordings.
With your consent only: the Google Ads tag, which tells us whether a visit came from one of our Google ads and lets Google count it. It writes Google's advertising cookies, it is off until you accept, and it is not loaded at all if you decline. We do not send your name, email, photos or your child's details to Google Ads.
How we use your data, and our legal basis
We use your data to create and deliver your book, process payments and shipping, provide support, honor the guarantee, keep the service secure, and meet legal and accounting obligations.
Where the law (such as the EU/UK GDPR) requires a legal basis, we rely on: performing our contract with you (making and delivering the book); your consent (uploading a child's photo for illustration); and our legitimate interests (running, securing and improving the service). The photo is held for that purpose only, and erased automatically seven days after upload.
We send the optional notes described under "Emails and communications" because you started a book or placed an order with us, and they are only about that book or other books from us (our legitimate interests). You can stop them at any time.
Who processes data for us
Stripe (payments), Gelato (printing and shipping of physical books - receives the book file and shipping address), Google Gemini API (story text and illustrations - receives the photo and personalization details), Vercel (hosting, file storage, analytics), Neon (database), Resend (sending our emails - receipts, book and shipping updates, and the optional notes described below). Each acts on our instructions to provide the service.
Only if you accept cookies: Microsoft (Clarity product analytics) and Google (the Google Ads tag). Decline and neither receives anything.
International data transfers
Hero of You is operated from Israel, and our providers may process data in the United States, the EU and other countries. Where data is transferred internationally (for example from the EU/UK), we rely on appropriate safeguards, such as our providers' standard contractual clauses, to protect it.
How we keep data safe
Data is encrypted in transit (HTTPS), passwords are stored only as salted hashes (never in plain text), sign-in uses a secure HttpOnly session cookie, and access to systems is limited. No method is perfectly secure, but we take reasonable steps to protect your information.
Faces, and what we do not do with them
A photo of your child is used for exactly one thing: our AI illustrator looks at it once and draws an illustrated character. We do not create a faceprint, a facial-recognition template, a biometric identifier or any mathematical map of facial geometry. We do not use a face to identify anyone, to match one person against another, or to search for them anywhere. We never sell or share a photo, and we never use it to train an AI model.
The original photograph is deleted automatically seven days after upload. Until then it is used only to redraw the character if the likeness is wrong; every page of the book is drawn from the illustration, never from the photo. You can also delete your photos, books and account yourself at any time from your account page, which removes the images for good.
If you are in a place with specific biometric-privacy laws (for example Illinois, Texas or Washington), this is our disclosure to you: we do not collect or store biometric identifiers or biometric information as those laws define them. If you believe we hold something you did not intend to give us, write to shushanran@gmail.com and we will delete it.
Emails and communications
We send two kinds of email.
Emails about something you asked for or bought. The link to your preview as soon as it is ready (or a note if it gets stuck), your receipt, a note when your full book is ready, reminders when a printed book is waiting for your approval before we print it, shipping updates, a note if a book you paid for did not finish drawing, and password resets. These are part of the service, so they still reach you if you have unsubscribed from everything else.
Short notes about a book you started or an order you placed. These are optional, every one carries an unsubscribe link, and one click stops all of them. After you make a preview: up to three follow-ups, about 1, 3 and 7 days later, if you have not ordered it. If you leave checkout before paying: up to two reminders, about an hour and about a day later. After an order: an offer to add a printed copy about 3 days after a digital-only purchase, a request for a review about a week after your book arrives, and an idea for a second book about a month after a printed book is delivered. And a welcome email when you create an account, plus one check-in about two months later if you made a preview and never ordered. Each is sent at most once for the same book or order.
Where the address comes from. We use the email on your account or, if you make a book as a guest, the address you give us for it. A guest address is used only to send these emails. It is not an account, and nothing signs in with it.
Stopping them. Use the unsubscribe link in any of these notes, or write to shushanran@gmail.com. Unsubscribing does not stop receipts or updates about an order you have placed. We never sell or share your address, and we never email you about other companies. Support replies go to the address you write from.
Cookies
One essential HttpOnly session cookie keeps you signed in. It is always on, because without it you cannot stay signed in, and it carries no advertising identifier.
The optional set needs your agreement first: Microsoft Clarity's cookies (_clck, _clsk) for the session recordings described above, and Google Ads' advertising cookies for measuring our ads. In the UK, Ireland and the EU/EEA we ask before loading them, and "Decline" is as easy to click as "Accept". Elsewhere it runs unless you tell us otherwise, and you can change your mind at any time by emailing us.
Your rights
You can access, correct, download or delete your data. "Delete my account" on the account page erases your books, pages, child profiles, uploaded photos and generated art, and scrubs your account details, including any email address you gave us for sending your book.
Depending on where you live (for example under the EU/UK GDPR or the CCPA in California), you may also have rights to portability, to object to or restrict certain processing, and to lodge a complaint with your data-protection authority. We do not sell personal information. To exercise any right, email shushanran@gmail.com.
Retention and deletion
The uploaded photo is deleted automatically seven days after upload. Your books, illustrations and child profiles stay in your account until you delete them. Order records (amounts, shipping details) are kept as required for accounting and disputes, then removed when no longer needed.
Changes and contact
We may update this policy as the product evolves; material changes will be shown here with a new "last updated" date. Privacy questions or requests: shushanran@gmail.com.