Legal
Privacy policy
What we collect when you analyse an image, who else processes it, how long we keep it, and how to make us delete it.
Last updated 7 September 2026
Who is responsible for your data
HEROSTATUS LTD (“we”), trading as ONEH3RO, is the data controller for the personal data described on this page. We are established in England and Wales, and our registered office is 66 Paul Street, London, England, EC2A 4NA, United Kingdom. Company number 17431895. Our data-protection register number is ZC236275.
For anything on this page, including a request to see or delete your data, write to info@oneh3ro.com.
What we collect and why
We collect the minimum needed to run an account, take a payment and produce a report. There is no advertising network on this site, no third-party analytics or tracking pixels, and we do not sell or share personal data for marketing.
| What | Why | How long |
|---|---|---|
| Email address | Identifies the account, sends the sign-in link and the receipt | Until the account is deleted |
| Credit balance and purchase history | Runs the credit model and provides proof of purchase | Until the account is deleted, then as long as tax law requires records of the sale |
| Uploaded original image | Lets you re-download the file you submitted | Deleted automatically after 28 days |
| Downscaled preview image | The copy the report renders and the only copy the model saw | For the life of the report |
| The report itself | It is the thing you paid for | Until you delete it or the account |
| Custom render request files (image, logo, brand guidelines, optional report) | Sent to the team so they can produce the render you requested | Until the account is deleted |
| Server and request logs | Security, abuse prevention and debugging | As retained by the hosting provider |
Your images
Two copies of every analysed image are stored: the original file you uploaded, and a downscaled preview. The preview is what the report displays and is the only copy the model ever receives. The original exists so you can download your own file again.
Originals are deleted automatically 28 days after analysis by a scheduled job. The report and its preview image stay in your account until you delete them. We do not use your images to train any model, and we do not publish them — the sample report on this site uses our own artwork, shown with permission of the brand it was made for.
Automated processing and AI
Reports are produced by an AI model with no human reviewing the output before you see it. We say so on every report and in the footer of every page, and how the AI works sets out which model, what it receives, and where it should not be relied on.
We do not make automated decisions about you. The model scores an image you chose to upload and suggests changes to it. It does not assess you, rank you against other customers, decide whether you may hold an account, set what you are charged, or produce any other decision with a legal or similarly significant effect. Nothing on this site profiles you, and no output is used to make a judgement about you as a person.
The score is advice about artwork, not a finding of fact. Every report can be disregarded, and you keep the file you uploaded either way. If an analysis is plainly wrong, tell us and we will look at it and put the credits back.
Lawful bases
Running your account, producing the reports you buy and taking payment are processed on the basis of performance of a contract. Keeping records of a sale for tax purposes is a legal obligation. Security logging and abuse prevention rest on our legitimate interests in keeping the service available and unabused. Where we ever rely on consent, you can withdraw it at any time.
Who else processes it
We use a small number of sub-processors. Each one receives only what its job requires, under a contract that restricts them to acting on our instructions.
| Processor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Email address, account record, reports, uploaded images | Configured project region |
| Vercel | Website hosting and delivery | Request logs, IP address, approximate location | Global edge network |
| Resend | Delivers the internal notice sent to us when a customer requests a custom render | The requesting customer's email address and the render-request details quoted in the message | United States |
| Paddle | Payment processing for credit purchases. Acts as merchant of record: Paddle is the seller of record and handles sales tax/VAT collection | Email, payment card details, billing country, transaction records | United Kingdom (Paddle.com Market Ltd) and United States |
| Anthropic | The model that produces the analysis | The downscaled copy of the image being analysed | United States |
Card details are entered inside Paddle's own checkout and never reach our servers. Paddle is the merchant of record for what you buy — it is the seller shown on your receipt and card statement, and it is responsible for calculating and remitting any sales tax or VAT. We store only a Paddle customer reference and the record of what was bought.
Transfers outside the UK and EEA
Some processors are based in, or route traffic through, the United States. Those transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with the providers' own certifications where they hold them.
Cookies
We set cookies for one purpose: keeping you signed in. They are strictly necessary for the service to work, which is why there is no consent banner asking you to accept them. Paddle sets its own cookies during checkout for fraud prevention, governed by Paddle's privacy policy.
There are no advertising, profiling or cross-site tracking cookies on this site.
Your rights
You have the right to access a copy of your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. You can also withdraw consent where we relied on it, and complain to a supervisory authority — in the UK, the Information Commissioner's Office.
Email info@oneh3ro.com and we will respond within one month. Deleting your account removes your reports, your stored images and your account record; we keep only what tax law requires us to keep about a completed sale.
Children
This is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.
Changes
If we change how we handle personal data we will update this page and the date at the top. Material changes affecting existing accounts will be sent by email.