1. Scope and controller
This policy applies to Heremio's website, mobile applications, and connected support services. Heremio acts as the data controller for these services. Send privacy questions and data-subject requests to [email protected].
This policy explains why, how, and for how long Heremio processes personal data across its web and mobile services.
Effective date:
This policy applies to Heremio's website, mobile applications, and connected support services. Heremio acts as the data controller for these services. Send privacy questions and data-subject requests to [email protected].
We process account and authentication details; profile, wishlist, setup, item, image, and comment content; follows, saves, and reservation relationships; subscription status; support messages; and limited device, security, session, and usage records. Heremio does not ask you to send passwords, one-time codes, or sensitive-category data.
We receive data directly from you, from your use of Heremio, from an authentication provider you choose, and from service providers that support functions such as subscriptions. If you add content about another person, you must have the right to share it.
We process data to create and perform your account agreement, provide requested features, enforce visibility choices, deliver support, secure the service, prevent fraud and abuse, comply with law, and establish or defend rights. Where we rely on legitimate interests, we balance them against your rights. Optional analytics, marketing, and similar processing rely on consent where required.
Profiles and collections you mark public can be viewed and shared on the internet with your username. Link-only and private choices limit access for that content, but we cannot fully prevent a recipient from resharing a link. Do not include addresses, documents, serial numbers, or unwanted personal details in images.
We disclose data only as needed to hosting, database, object storage, authentication, security, support, and payment infrastructure providers. Resend processes the recipient email address and limited delivery data on Heremio's behalf for transactional account email, including verification and password reset messages. Paddle processes account, customer, and transaction data for web Plus checkout, payment, tax, invoicing, renewal, cancellation, and refund flows, and may act as merchant of record where stated at checkout. Heremio does not store full card details. We may also disclose data to competent authorities where legally required. Heremio is not a party to checkout, delivery, or returns on an external merchant site.
Some infrastructure providers may process data outside your country. Where required, we use an adequacy decision, standard contractual clauses, binding corporate rules, or another valid safeguard under applicable GDPR and Turkish data-protection transfer rules.
We keep data only as long as needed for its purpose and documented legal obligations. An account-deletion request starts a reversible 15-day period; access and public visibility end at the cutoff. Profile, content, credentials, media, social graph, billing, security, and audit data are deleted or anonymized under category-specific schedules. A valid official preservation request can temporarily delay only its narrowly scoped categories.
We apply risk-appropriate access controls, session revocation, rate limiting, encryption, logging, backups, and separation of duties. No system can guarantee absolute security. Report suspicious account activity to [email protected].
Essential cookies support authentication, security, language, and consent choices. Analytics and marketing categories are off by default and activate only after your positive choice. Accept, reject, and detailed preferences appear together; you can withdraw or change your choice at any time through Cookie preferences in the footer.
Depending on applicable law, you may request confirmation, access, correction, deletion or destruction, restriction, portability, objection, withdrawal of consent, and review by a competent data-protection authority. Contact [email protected]. We may need to verify your account and request securely.
Heremio is not directed to anyone under 18, and we do not knowingly collect account data from children. If you believe such an account or content exists, contact [email protected].
We may use automated signals in security and content review. AI review is advisory: it cannot publish content or impose a final material sanction by itself. Human review and relevant appeal context remain part of important moderation decisions.
We may update this policy when the service or law changes. We will provide an appropriate in-product notice for material changes and show the new effective date here. Contact [email protected] for privacy matters and [email protected] for general support.
© 2026 Heremio, Inc. All rights reserved.
v0.1.0