Privacy Policy

The data controller for your personal data in the Hero Cloud service is Hero Invest Ltd.. Our contact details are at the end of this page.

• Account details: your email address, the display name you choose and your account language.
• Security details: your sessions (browser and operating system, start and last activity time) and, if you turn on two-step verification, your encrypted verification key and hashes of your recovery codes. Sign-in links, session keys and passwords are stored only as hashes.
• Content: the files you upload, folder and file names, your transfer messages, the recipient email addresses you add and your transfer settings (duration, password protection, download count).
• Technical details: IP address, request time and browser information in web server logs; account ID and request ID in application logs. IP addresses, file contents, passwords and keys are never written to application logs.

We process your data to provide the service (creating your account, storing your files, delivering your transfers and sending emails; performance of a contract), to keep the service secure (preventing abuse, unauthorised access and malware, and scanning files for viruses; legitimate interests) and to meet our legal obligations. We do not use your data for advertising or profiling, and we do not sell it.

We share your data only with the service providers needed to run the service, and only within the scope of their service: the hosting provider that operates our servers, the email provider that delivers our emails and the domain name (DNS) provider. The DNS provider does not see your files or account details. Virus scanning runs on our own server. We do not disclose your data to third parties unless we are legally required to.

Our service providers may be located in different countries. When your data is transferred to a country without an adequacy decision, we apply the safeguards required by applicable law, such as standard contractual clauses.

• Account details and files in My Files: until you delete your account.
• Transfers: files are deleted automatically when the period you chose (1, 3 or 7 days) ends or when you cancel the transfer.
• Trash: deleted items are permanently removed after 30 days. Unfinished uploads are deleted after 24 hours.
• Sessions are valid for at most 30 days; sign-in links are valid for 15 minutes and can be used once.
• Web server logs (including IP addresses) are kept for at most 7 days; application logs are kept for as long as needed for operations and are deleted automatically.
• Backups: database backups are kept for 14 days and file backups for 7 days. Deleted data also disappears from backups after these periods.

Connections are encrypted with TLS. Accounts are isolated from each other at database level. Share links, passwords and recovery codes are stored as hashes, and two-step verification keys are stored encrypted. Our administrators cannot see the contents or names of your files in the admin panel.

You have the right to access your personal data, to ask for it to be corrected, erased or its processing restricted, to object to processing and to receive your data in a portable format.

You can use most of these rights directly: on the Account settings page you can correct your profile, download your data and delete your account. For other requests, contact us; we reply within 30 days at the latest.

You can complain about how your data is processed to the data protection authority of your country; in the United Kingdom this is the Information Commissioner’s Office (ICO).

Under Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Hero Invest Ltd.. Your personal data is collected electronically for the purposes above, on the legal bases of establishing and performing a contract, fulfilling legal obligations and legitimate interests. To use your rights under Article 11 of the Law, contact us; your request is resolved free of charge within 30 days at the latest. If your request is rejected or you find the answer insufficient, you can complain to the Personal Data Protection Board (KVKK Kurulu).

We only use what is strictly necessary for the service to work. We do not use analytics, advertising or tracking cookies, so we do not need to ask for cookie preferences.

• hc_session: the session cookie that remembers that you are signed in. It is strictly necessary, valid for at most 30 days and cannot be read by page scripts.
• NEXT_LOCALE: remembers the language you chose. It is deleted when you close your browser.
• Browser storage: the theme you chose (light or dark) and the upload session ID that lets interrupted uploads resume are kept only in your browser and are not sent to us.

The service is not designed for people under 16. If we learn that we are processing data of someone under 16, we delete it.

We may update this policy. We notify the email address of your account about important changes before they take effect. The current version is always on this page.

Company

Hero Invest Ltd.

Address

71-75 Shelton StreetCovent GardenLondon WC2H 9JQUnited Kingdom

Phone

+44 746 350 79 77