Privacy Policy

Introduction

Vitasphere, LLC (DBA HeroMe) ("we," "us," or "our") is committed to protecting the privacy of children and their families. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our AI-powered storytelling platform. HeroMe is a service for parents — only parents create accounts, provide information, and interact with the platform. Children do not have accounts or provide information directly to HeroMe.

We comply with the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), and other applicable privacy laws. We take special care to protect children's personal information.

Information We Collect

Information Provided by Parents/Guardians

• Account Information: Email address, password (encrypted), and optional phone number
• Child Profile Information: Child's first name, age/date of birth, pronouns, behavioral challenges, home setting description, and reading level
• Story Preferences: Comfort objects, interests, and story personalization goals
• Onboarding Data: Chat transcripts from the onboarding conversation (retained for 90 days, then deleted)
• Feedback: Ratings and comments on generated stories

Information We Do NOT Collect from Children

• We do not collect information directly from children
• We do not allow children to create accounts
• We do not collect photos, videos, or audio recordings of children
• We do not collect precise geolocation data
• We do not use persistent identifiers to track children across websites

Automatically Collected Information

• Usage Data: Pages visited, features used, and reading progress
• Device Information: Browser type, operating system, and device type (for compatibility)
• Cookies: Essential cookies for authentication and preferences (see Cookie Policy)

How We Use Information

We use collected information to:

• Generate personalized stories tailored to each child's interests and situation
• Provide parent guidance and general informational content
• Improve our AI-powered story generation
• Send notifications about new chapters (with consent)
• Respond to support requests
• Ensure platform security and prevent abuse

We never use children's information for advertising or marketing purposes.

AI Processing

Story text is generated using Google Gemini (paid API). Before any child data is sent for processing, the child's name is replaced with a placeholder ("pseudonymized") so Google never receives the child's real name. Google receives only the child's age range, challenge category, and story context. Google does not use paid API data to train its models.

Story illustrations are generated using Replicate. Only visual scene descriptions and age-range hints are sent — no names or personal information.

We obtain separate consent for AI processing of your child's information, as required by the 2025 COPPA amendments. See our Children's Privacy Policy for full details.

Information Sharing

We do not sell, rent, or trade personal information. We may share information only in these limited circumstances:

• Service Providers: Cloud hosting (Vercel, Supabase), AI text generation (Google Gemini — child names are pseudonymized before processing), AI image generation (Replicate — no personal information included in prompts), and payment processing (Stripe — parent data only, no children's information). All providers operate under data processing agreements.
• Legal Requirements: When required by law or to protect safety
• Business Transfers: In the event of a merger or acquisition (with notice)

Data Security

We implement robust security measures:

• All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Passwords hashed using industry-standard algorithms
• Regular security audits and penetration testing
• Access controls limiting employee access to personal data
• Automatic session timeouts

Data Retention

• Active accounts: Data retained while account is active
• Closed accounts: Data deleted within 30 days (consent records retained 3 years for legal compliance)
• Generated stories: Retained for the duration of the subscription
• Onboarding chat transcripts: Deleted 90 days after profile creation
• Inactive accounts: Deleted after 12 months of inactivity (with 30-day notice)

For detailed retention periods and business justifications, see our Children's Privacy Policy.

Parental Rights

Parents and guardians have the right to:

• Access: Review all personal information we hold about their child
• Correction: Request corrections to inaccurate information
• Deletion: Request deletion of their child's information
• Review: You may review your child's personal information through your HeroMe dashboard (Settings > Child Profiles) or by contacting privacy@herome.ai. We will respond to review requests within 48 hours.
• Withdraw Consent: Revoke consent at any time

To exercise these rights, contact us at privacy@herome.ai or use the "Close Account" feature in Settings.

International Data Transfers

Our services are hosted in the United States. If you access our services from outside the US, your information may be transferred to and processed in the US. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses for EU residents.

Not Medical or Therapeutic Services

The information we collect is used solely for story personalization and service improvement. Collection of information about a child's challenges or behavioral patterns does not constitute a clinical assessment, diagnosis, or therapeutic relationship. HeroMe is not a healthcare provider, and no data collected through the Service is used for medical or clinical purposes. For concerns about your child's health or development, consult a qualified professional.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email and/or a prominent notice on our platform. Continued use after changes constitutes acceptance.

Contact Us

For privacy-related questions or concerns: