Privacy Policy

Heralded is operated by Growth Path Agency S.R.L. ("we", "us"), Str. Drumul Putnei nr. 38-42, Et. 4, Ap. 33, Sector 3, Bucureşti, Romania, Trade Registry No. J2025042918007, CUI RO51980049. We are the controller of the personal data described in this policy.

This policy covers heralded.ai, the Heralded application at app.heralded.ai, its reports and its API. It does not cover sites we link to, or services we deliver under a separate signed agreement.

For any privacy question or request, email privacy@heralded.ai.

Information you give us. Your email address and name when you run a Snapshot, create an account or contact us, the websites you ask us to scan, your account settings and your messages to support.

Product data. The public pages we read for a scan, the questions we ask AI engines, their answers, and the scores and reports we produce for you.

Payment information. Stripe processes card payments. We receive billing details and transaction records, never your full card number.

Usage and device data. Your IP address, browser and device details, the pages you view and how you reached us, such as the referring site, campaign tags and the ad you clicked.

Connected services. If you sign in with Google, we receive the account details shown on Google's consent screen. If you connect Google Search Console, see Google Search Console data.

Heralded is built for businesses. We do not knowingly collect sensitive data or data from children under 16.

To provide Heralded. We run your scans, operate your account, bill you and answer your requests, as our contract with you requires.

To keep Heralded secure and working. We prevent abuse, enforce limits and fix errors, based on our legitimate interest in a safe, reliable service.

To improve Heralded. We count visits and product use with our own analytics, which sets no cookies, based on our legitimate interest.

To measure our marketing. We learn which campaigns and ads bring people to Heralded. See Advertising.

To email you. When you run a Snapshot or start a trial, we may send you tips and offers about our own products unless you opt out when you give us your address. Other marketing email needs your consent. Every email has an unsubscribe link.

To manage customer relationships. We keep account and sales records in our CRM, based on our legitimate interest.

To meet legal obligations. We keep invoices and tax records as Romanian and EU law requires.

You can object at any time to processing based on our legitimate interests, and withdraw any consent you gave.

We do not sell your personal data. We share it only with providers that process it for us under data processing agreements:

- Hosting and infrastructure: netcup in Austria, Vercel and Cloudflare.
- Email: Growstack, our in-house email platform, hosted by netcup in Austria and sending through Lettermint in the Netherlands.
- Payments: Stripe.
- Error monitoring: Sentry.
- Customer relationship management: Twenty.
- Scan providers: AI and search data services such as OpenRouter, Anthropic, DataForSEO and Firecrawl.
- Google, for Google sign-in and the Search Console connection you choose.
- Advertising partners: see Advertising.

We may also disclose data when the law requires it, or to protect our rights, our users or the public.

We advertise with Google Ads and ChatGPT ads by OpenAI, and use their tools to measure which ads lead to Snapshots, sign-ups and purchases. They may receive device and usage data and, when you run a Snapshot, start a trial or pay, a hashed version of your email address. They may not use it to personalize the ads you see.

In the EEA, UK and Switzerland, their cookies are set and your hashed email address is shared only if you accept cookies. Elsewhere this is on unless you opt out. You can change your choice at any time in Cookie settings in the footer.

Learn how Google and OpenAI use this data.

Necessary cookies keep you signed in, protect our forms from abuse and remember your choices. They need no consent.

Advertising cookies from our advertising partners measure our marketing and last up to a year. In the EEA, UK and Switzerland they are set only if you accept.

Our analytics sets no cookies. Marketing emails may contain a tracking pixel, which you can block by turning off remote images.

If you connect Google Search Console, we request read-only access (`webmasters.readonly`) to the properties you choose. We read search queries, clicks, impressions, average position and indexing information, and we cannot change anything in your Google account.

We use this data only to connect your search performance with your AI visibility in the analyses you request. We do not sell it, use it for advertising or use it to train general-purpose models. Tokens and imported data are encrypted at rest in our EU-hosted database. Disconnecting deletes the tokens and stops future reads, and deleting your account removes the imported data.

You can disconnect in Heralded or revoke access at myaccount.google.com/permissions. Heralded's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Some providers, including our advertising partners, process data outside the European Economic Area. Where required, we rely on adequacy decisions or Standard Contractual Clauses.

We keep personal data only as long as we need it:

- Account, scan and report data while your account is active. Deleting your account deletes it, apart from backups that expire and records the law requires us to keep.
- Marketing contacts until you unsubscribe, or 24 months after you last engaged with our emails.
- Support messages for up to 36 months.
- Analytics data for up to 24 months.
- Security logs for up to 30 days, unless an investigation needs them longer.
- Invoices and accounting records for 10 years, as Romanian law requires.

You can ask us to access, correct, delete or export your personal data, or to restrict or object to how we use it. You can withdraw consent at any time. Email privacy@heralded.ai and we will reply within one month. We may ask you to confirm your identity first.

You can also complain to a data protection authority. Ours is Romania's ANSPDCP, and you can also contact the authority where you live or work.

We protect your data with encryption in transit and at rest, limited access and multi-factor authentication. If a breach puts you at risk, we will notify you and the authorities as the law requires.

We update this policy when our practices or the law change. The date at the top shows the latest version.