Privacy notice

Website, app, API, AI assistants and try-on widget · last updated 30 October 2026

This notice explains which personal data Herofab processes when you use the herofab.app website, the Herofab app, the API and the try-on widget, why, for how long and with whom. Herofab does not sell personal data, does not use your photos to train AI models and does not use advertising trackers.

Who is responsible

Controller
Herofab
Privacy contact
privacy@herofab.app
Support
support@herofab.app

This notice is also the information notice under Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

Website and early access

Early-access list. Your email address, the time you joined and the version of the consent text you agreed to. We do not store your IP address, device or location with it. We use it to email you when early access opens and, occasionally, about the launch. The legal basis is your consent (GDPR Art. 6(1)(a)), given with the checkbox next to the form. The list is stored in a Cloudflare D1 database and kept until early access opens and you have been told, or until you ask us to remove you, whichever comes first.

Free image tools. The product photo checker, image size checker, marketplace resizer, HEIC to JPG converter, white background checker and AI image label checker process your files inside your browser. Your images are not sent to us and are not stored.

Site statistics. We count page views on the website with Cloudflare Web Analytics to see which pages are useful. It sets no cookies, uses no local storage and does not build a profile of you. The legal basis is our legitimate interest in running and improving the site (GDPR Art. 6(1)(f)).

Your account

Your email address, when your account was created and when you signed in, the workspace you belong to and your role in it, the team members you invite, and your language and time zone preference. We use this to sign you in with one-time links or with Google, to run your workspace and to answer your support requests. The legal basis is the contract with you (GDPR Art. 6(1)(b)). We keep it while your account exists.

Continue with Google. If you choose Continue with Google, Google confirms your email address to us. We receive only that address and whether Google has verified it; we do not receive your name, profile picture or contacts. Google processes your sign-in as an independent controller under its own privacy policy.

Where you found us. When you create an account from a link on this website, we record the page you signed up from and, if another site sent you to that page, that site's domain name (for example, google.com), together with any campaign label in the link. We do not record the full address you came from or your search terms, and nothing is stored in your browser for this. We use it to see which pages and channels bring people to Herofab. The legal basis is our legitimate interest in understanding how people find the service (GDPR Art. 6(1)(f)). It is kept with the record of when your workspace was created.

Product usage

Herofab records a fixed list of actions in the app to see which features help and where people get stuck: signing up and finishing the first setup, starting the first job and each delivered job (the tool and the credits used), downloads (single image or ZIP, the format and the number of files), starting a checkout and each completed purchase (the product, the amount and the currency), clicks on share buttons and on upgrade prompts, opening and saving job cards, and which version of a feature your workspace is shown when two versions are compared. Each entry is linked to your account and workspace. Without a signed-in account, an entry carries only a random identifier that is held in the page’s memory and not stored in your browser, or an identifier derived from the sign-in link you requested. The entries contain no images, image addresses, file names, written instructions, email addresses or IP addresses. They are stored only in Herofab’s own database: no analytics cookies, no third-party analytics tools and no sharing with any other company. Entries are deleted automatically after 13 months, or earlier when your account is deleted, and they are included in a copy of your data. The legal basis is our legitimate interest in improving the service (GDPR Art. 6(1)(f)); you can object at any time by writing to the privacy contact.

Photos you upload and images you create

The photos you upload, the images Herofab generates for you, the settings of each job, the products, presets and models you save in your library, and any rating or feedback you give on a result. We use them to produce and show your results: each photo is sent to the image-generation provider that runs the tool you chose, and automated checks test whether a photo is suitable for the tool and whether a result meets the quality and content rules before it is delivered. If a check refuses a job, its credits are returned and you can ask support to look at it.

Every generated image carries IPTC metadata that marks it as AI-generated. If your photos show people, you must have their permission to use them. Herofab does not create face templates or other biometric identifiers. The legal basis is the contract with you (GDPR Art. 6(1)(b)). Photos and results stay in your account until you delete them or your account is deleted. An image you delete in the gallery first moves to the trash, where it can be restored for 30 days; it is then erased automatically, or at once when you empty the trash or delete it permanently.

Quality review and testing. To find and fix problems in the tools, the Herofab team may look at a small sample of jobs: the photos, the job settings and the results. For accounts created on or after 29 October 2026, these samples may also be used to test the tools: a sampled photo can be run again through the image-generation providers listed under Service providers to compare settings and versions, and the team may use Claude, an AI assistant provided by Anthropic, to examine sampled photos and results. Test results are kept inside Herofab's systems, are never delivered to anyone else and are deleted within 90 days. Sampled photos and results are not used to train AI models, are not published and are not used in marketing. Jobs of accounts created before 29 October 2026 are never used in tests, and only jobs created on or after 23 October 2026 are reviewed, unless you ask us to look at an earlier one. You can ask us at any time to leave your jobs out of reviews and tests by writing to the privacy contact. The legal basis is our legitimate interest in keeping the results reliable (GDPR Art. 6(1)(f)).

Try with your photo (before signing up)

When you use “Try with your photo” in the Herofab app, we receive the photo you choose, the tool you pick and your email address. We use them only to email you a sign-in link and to open that photo in your account when you sign in with that email address. No image is generated before you sign in.

The photo is kept for up to 24 hours on our server and in our object storage (Cloudflare R2). If you sign in with the same email address within that time (with the emailed link, a new sign-in link or Google), it can become an upload in your account: in the browser you sent it from it opens automatically; otherwise you choose whether to open it or delete it. A photo that is not opened is deleted. To recognise the browser that sent the photo, we set a cookie (hf_trial) that holds only a value derived from the sign-in link and expires after 24 hours. The legal basis is your consent (GDPR Art. 6(1)(a)), given with the checkbox on the form; you can withdraw it by writing to the privacy contact.

The upload box on a Herofab tool page works the same way without asking for an email address: we receive the photo and the tool page it was sent from, keep the photo for up to 24 hours and set a cookie (hf_park) in that browser that holds only a random value and expires after 24 hours. When you sign in from that browser within that time, the photo becomes an upload in your account; if the account is new, the image of that tool page is started right away with the free credits. If you ask for a sign-in link instead, the link is connected to the same photo as described above. The legal basis is your consent, given with the checkbox on the upload box.

Public share links

Sharing is off for every image. If you turn on a share link for a result, anyone with the link can see that result, and the original photo next to it only if you choose so. Share pages are not listed in search engines. If an image shows a face, Herofab asks you to confirm that you have the right to publish it before the link goes live; a face is detected on our own server and no face template is stored. You can turn a link off at any time; the old address then stops working for good. Results of a free trial account are shown with the Herofab watermark. Links are deleted with your account. The legal basis is the contract with you (GDPR Art. 6(1)(b)).

Payments

Payments are processed by Polar (polar.sh), the merchant of record, which handles your card or other payment details, taxes and receipts as an independent controller under its own privacy policy. Herofab never sees your full payment details. We receive the order and subscription details needed to add your credits (what was bought, when, its status and the email address used), and we keep a ledger of every credit movement. The legal bases are the contract with you (GDPR Art. 6(1)(b)) and our legal obligations (Art. 6(1)(c)); payment and accounting records are kept for as long as tax and accounting law requires, also after your account is deleted, without your uploads or results.

Emails

Service emails. Herofab sends sign-in links, team invitations, notices about your webhooks, an email when the first image in your workspace is ready and has not been opened within 10 minutes, a confirmation after your first purchase and an email when a subscription payment does not go through. These emails are part of the service, are sent only when needed and contain no promotional content. The image-ready email can be turned off on the email settings page of your account or with the link in that email. The legal basis is the contract with you (GDPR Art. 6(1)(b)).

Product updates and tips. Emails with suggestions for your product category, a reminder when watermarked images are waiting, a note when your credits run low and new ways to use the tools are sent only if you turn on “Product updates and tips” on the email settings page. The setting is off by default. Each time it changes, Herofab records the time, where the change was made (the settings page, the unsubscribe link in an email or the unsubscribe button of your email app) and the version of the text you agreed to, as a record of your consent. Every such email has a one-click unsubscribe link, and you can withdraw your consent at any time. The legal basis is your consent (GDPR Art. 6(1)(a)). Herofab does not send marketing emails to account holders without their consent.

Send log. For the image-ready email, the first-purchase confirmation and product update emails, Herofab keeps a log of which email was sent to which account and when, so that no email is sent twice and no more than one such email is sent a day. The log holds no email address and no email content. It is kept until your account is deleted and is included in a copy of your data.

All emails are sent through Resend, Inc.

Security and abuse prevention

The legal basis is our legitimate interest in keeping the service secure and preventing abuse (GDPR Art. 6(1)(f)).

API and webhooks

API keys are stored only as a hash, so they cannot be read back. We keep the webhook addresses you register and a record of each delivery attempt to show you what was sent and to retry failed deliveries. They are kept until you delete them or your account is deleted.

AI assistants

Herofab offers a read-only MCP server (app.herofab.app/mcp) and a matching interface for custom GPTs (app.herofab.app/api/agent/) that answer questions about marketplace image rules. They need no account or key and receive only the fields an assistant sends: a platform name and, for a check, an image's width, height, format and file size and a description of its background and product fill. The image itself is never sent. Apart from the platform name, the values sent are not stored: each call writes one anonymous log line with the tool name, the platform, the result and the response time, which contains no IP address and no personal data. Rate limits count requests per keyed hash of the network address, held in memory only. The server logs described under Security and abuse prevention apply to these requests as to any other. The conversation with the assistant is processed by the assistant's provider under its own privacy terms; Herofab receives only the fields listed above. A separate MCP server for API customers (app.herofab.app/mcp/studio) works only with your Herofab API key and is handled like any other API call (see API and webhooks), including the photos it fetches and the images it creates, and its log line also holds the first eight characters of the key's ID. The legal basis is our legitimate interest in providing and protecting the service (GDPR Art. 6(1)(f)).

Try-on widget (shoppers)

A merchant can add the Herofab try-on widget to its online store. When a shopper uses it, the merchant is the controller and Herofab processes the data on the merchant's behalf. The shopper confirms that they are at least 18 and agrees before choosing a photo. The photo is resized and its metadata, such as location, is removed in the browser before upload. The photo and the try-on result are kept for 1 hour and then deleted; the shopper can delete them sooner. The merchant sees only usage counts, never the photos. Bot protection uses Cloudflare Turnstile, and rate limits use keyed hashes of the network address.

Cookies

The app sets only the cookies it needs: a session cookie that keeps you signed in, short-lived cookies used while you sign in, and cookies that remember your language and time zone. There are no advertising or analytics cookies in the app. The website sets no cookies; it only remembers, in your browser's local storage, if you close the language suggestion.

Service providers

Cloudflare, Inc.
Website hosting, early-access list (D1), object storage for photos and results (R2), site statistics, bot protection, email routing
Hetzner Online GmbH
Server and database of the app
fal.ai
Image generation
Google (Gemini API)
Image generation, automated photo and result checks, and suggestions that improve the description you write in the studio
Kie.ai
Image generation, automated photo and result checks, and suggestions that improve the description you write in the studio
Anthropic, PBC
AI assistant (Claude) used by the Herofab team to examine sampled jobs of accounts created on or after 29 October 2026 in quality review and testing
Resend, Inc.
Service emails and, with your consent, product update emails
Polar
Payments, as merchant of record and independent controller
Google (Sign in with Google)
Confirming your email address if you choose Continue with Google, as independent controller

Apart from Polar and Google's sign-in service, these providers act as our processors and may use the data only to provide their service to Herofab.

Transfers outside your country

Some providers process data outside the European Economic Area and Türkiye, in particular in the United States. Such transfers rely on an adequacy decision or on the standard contractual clauses offered by each provider.

Your rights

You can ask for a copy of your data, have it corrected or erased, restrict or object to processing, and withdraw consent at any time. In the app, the account page lets the workspace owner request a copy of the workspace's data or its deletion; requests are completed within 30 days. You can also write to the privacy contact. Deletion removes your account, uploads, results and team access; the payment records and hashes described above remain. You can complain to your data protection authority; in Türkiye this is the Personal Data Protection Authority (KVKK).

Herofab is not intended for people under 18. If this notice changes in a way that affects you, account holders are told by email before the change takes effect.