Privacy Policyfor HeroSpace.

NextUI Inc. ("HeroSpace," "we," "us," or "our") provides the HeroSpace website, desktop application, and related services. This Privacy Policy explains how we handle personal information when you visit our website, create an account, or use those services.

When you use a workspace managed by another organization, that organization may determine how workspace information is used and who can access it. Its policies may also apply. Questions about this policy or your information can be sent to support@herospace.ai.

• Account and profile information. Your name, email address, email verification status, profile picture, account identifier, and the identity provider you use to sign in.
• Workspace information. Workspace names, identifiers, membership and roles, invitations, and information you submit through available workspace features.
• Authentication information. Session identifiers, sign-in verification records, and provider access or refresh tokens associated with your account. We do not receive your Google or GitHub password when you use those services to sign in.
• Technical information. IP addresses, browser and device information, request and sign-in timestamps, error information, and operational logs used to run and secure the service.
• Communications. Information you include when you contact us, report a problem, or provide feedback.

Please share only information you have permission to provide. You do not need to send us your account passwords or verification codes when asking for support.

When available and selected by you, Google sign-in requests your basic profile and email information through the openid, email, and profile permissions. We use your Google account identifier, name, email address, verification status, and profile picture to create your HeroSpace account, sign you in, and show your profile. Related authentication tokens are stored with your account to support that connection.

Signing in with Google does not give HeroSpace access to your Gmail messages, Google Drive files, or Google Calendar events. Any future feature requiring additional Google permissions will require separate authorization and an explanation of the data it accesses before access begins.

Our use and transfer of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only to provide the features you authorize. We do not sell it, use it for advertising or credit decisions, or use it to develop or train generalized AI or machine-learning models.

We share Google data only as needed for those features with your consent, for security, or as required by law. A business transfer involving this data requires your prior consent. Human access is limited to your permission, security needs, legal obligations, or aggregated internal operations allowed by Google's policy.

You can revoke HeroSpace's access from your Google Account connections. Revoking access stops future authorized access; it does not automatically delete information already stored in your HeroSpace account. To request deletion of that information, contact support@herospace.ai.

We use information to:

• Create and maintain accounts, authenticate sign-ins, and manage workspace access.
• Provide the features you use and synchronize authorized workspace information.
• Send sign-in codes and essential service, security, and account communications.
• Respond to requests, investigate errors, and improve service reliability.
• Detect abuse, protect accounts, enforce our terms, and meet legal obligations.

Where a legal basis is required, we process information to provide our services under our agreement with you, for legitimate interests such as security and support, to comply with law, or with your consent where required. You may withdraw consent without affecting the lawfulness of processing that happened before withdrawal.

• Within your workspace. Other authorized members may see your name, email, profile picture, membership role, and information you make available in shared features. Workspace administrators manage membership and access.
• With service providers. We use providers to host the service, store records, deliver sign-in emails, and support synchronization. Our infrastructure includes Cloudflare and PlanetScale. Providers process information for the functions they perform for us, subject to applicable agreements.
• With services you choose. Google and GitHub process sign-in requests when you select them. Loading a profile image from its provider may also send that provider ordinary network information, such as your IP address.
• For legal and security reasons. We may disclose information when required by law or reasonably necessary to protect people, investigate abuse, or protect legal rights.
• In a business transaction. Information may be transferred as part of a merger, acquisition, or sale, subject to applicable law and the protections in this policy. The more specific restrictions for Google data above continue to apply.

We do not sell personal information or share it for cross-context behavioral advertising.

HeroSpace is designed to work alongside tools and AI agents you choose. Signing in to HeroSpace does not itself authorize an AI provider to receive your Google account data. A separate integration or agent action may involve another service only when you choose to use and authorize that feature.

When you send information directly to an external tool or AI provider, its terms and privacy policy govern its handling of that information. Review its permissions, retention, and model-training settings before sharing content. We cannot make promises about a third-party provider's independent practices.

Account and workspace information is stored on our hosted infrastructure. Authorized workspace records and profile information may also be cached on your device so the app can display them efficiently. The desktop app uses operating-system-backed encryption for its stored session credentials. This does not mean that every local record is encrypted or that all service data is end-to-end encrypted.

We use HTTPS, access controls, restricted service credentials, and other technical and organizational measures appropriate to the service. Authentication records are kept separate from the workspace records that are synchronized to clients. No method of storage or transmission can guarantee complete security.

Our sign-in services use cookies or similar session technologies to authenticate you and complete sign-in redirects. The website stores your theme preference in browser storage. The app also stores preferences, onboarding state, cached profile information, and synchronized records on your device.

You can manage cookies and local storage through your browser or device settings. Clearing them may sign you out, reset preferences, or remove locally cached information. It does not delete the corresponding server-side account. We do not use advertising cookies on the HeroSpace website.

We retain personal information for as long as reasonably needed to provide the service, maintain your account, respond to requests, protect the service, and meet legal obligations. Retention depends on the type of record and why we hold it; a session or token's expiration does not by itself delete your account records.

To request deletion of your account, profile, connected-account data, or other personal information, email support@herospace.ai from the address associated with your account. We may verify your identity before acting. Information that must be retained for legal or security reasons is limited to those purposes, and backup copies may remain until removed through the backup lifecycle.

Signing out, disconnecting a provider, or uninstalling the app is not an account-deletion request. Shared workspace records may also be subject to your organization's instructions and other members' rights. Information already sent to an independent third-party service must be managed with that provider.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; object to or restrict processing; withdraw consent; or appeal our response. You may also complain to the privacy regulator responsible for your location. We will not discriminate against you for exercising applicable privacy rights.

Send requests to support@herospace.ai. If your account belongs to an organization, we may refer a request about its workspace records to its administrator. You can also control your device's local storage and revoke permissions in your connected provider's account settings.

Our account and workspace databases are currently hosted in the United States. Cloudflare and other providers may process network traffic or related information in other countries. These countries may have privacy laws that differ from those where you live. Where required, we use the applicable legal safeguards for cross-border transfers.

HeroSpace is a service for work and is not directed to children. We do not knowingly collect personal information from children who are not legally permitted to use the service. If you believe a child has provided personal information, contact support@herospace.ai so we can investigate and take appropriate action.

We may update this policy as the service or our practices change. The date at the top identifies the latest version. We will provide additional notice of material changes and request new consent when required, including before using Google data for a new purpose.

For privacy questions or requests, contact NextUI Inc. at support@herospace.ai. Your use of HeroSpace is also subject to our Terms of Service.