Privacy Policy

1. Who is responsible

HeroComic AI is operated by Kiran M, a sole proprietor based in India, who is the data controller for the information described here. Contact: iterate.startup@gmail.com.

2. What is collected

• Your account — name, email address and profile picture, received from Google when you sign in. We never see or store your Google password.
• Photographs you upload — one or two facial images, used only to draw your comic.
• Comics you generate — the page images, the story written for them, and which template and layout you chose.
• Billing records — your plan, your credit balance and a ledger of credits granted and spent. Card details are handled entirely by our payment provider and never reach our servers.
• Basic technical data — the country your request came from, used to show prices in your currency, and anonymous, cookieless page analytics.

3. A photograph of a face is sensitive

A facial image can identify you, and in several jurisdictions counts as biometric or otherwise sensitive personal data. It is treated accordingly:

• It is stored in private storage. There is no public URL. Every view is a short-lived signed link issued only to the account that uploaded it.
• It is deleted automatically within 48 hours by a scheduled job, whether or not you ask.
• It is never used to train any model, ours or anyone else’s.
• It is not used for facial recognition, matching or identification of any kind. It is sent to an image model as a drawing reference and for nothing else.

4. How long things are kept

• Photographs — deleted within 48 hours of upload, or immediately if you remove them.
• Comics — deleted 7 days after they are made, or 24 hours after you download one, whichever comes first. Download anything you want to keep.
• Your account — kept until you ask us to close it.
• Billing records — retained after a comic is deleted, because we are required to keep a record of transactions. These say what was charged, not what was drawn.

5. Who your data is shared with

Only the services needed to run this product, each doing one job:

• Google (Gemini)— receives your photograph in order to draw each page. Sent through the paid API, which is not used to train Google’s models.
• Supabase — the database and sign-in.
• Cloudflare R2 — private file storage for photographs and pages.
• Vercel — hosting and anonymous analytics.
• Dodo Payments — takes payments as merchant of record. They receive your billing details; we do not.

Your data is never sold, rented, or shared for advertising. It is disclosed to anyone else only where the law requires it.

6. Your rights

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for your account and everything in it to be deleted. Email iterate.startup@gmail.com and we will act within 30 days.

If someone has uploaded a photograph of you without permission, email iterate.startup@gmail.com — that is handled faster, and is described on the Acceptable Use Policy.

7. Children

This service is not for anyone under 18, and photographs of people under 18 must not be uploaded, including your own. Accounts found to belong to a minor are closed and their data deleted.

8. Changes

If this policy changes materially, the date at the top changes with it. Continuing to use the service after that means accepting the revised version.