hermoso
LoginSign up
Legal

Privacy Policy

Last updated: 2026 · Effective at launch

This Privacy Policy explains how Hermoso ("Hermoso", "we", "us") collects, uses, and protects information when you use our website and the Hermoso application (the "Service"). We've tried to write it like humans, not lawyers.

1. Information we collect

  • Account information — your name, email address, and authentication details when you create an account or sign up.
  • Brand & creative inputs — the brand details, product images, prompts, reference ads, and other content you provide so the Service can generate creative for you.
  • Generated content — the images, videos, copy, and projects you create with the Service.
  • Billing information — handled by our payment processor (Stripe). We receive limited details such as plan, status, and the last four digits of your card; we never store full card numbers.
  • Usage & device data — log data, approximate location, browser/device type, and how you interact with the Service, collected to operate and improve it.
  • Cookies & similar technologies — see "Cookies" below.

2. How we use your information

  • To provide, operate, and improve the Service — including generating creative from your inputs.
  • To personalize the Service to your brand and remember your preferences and past work.
  • To process payments, manage subscriptions and credits, and prevent abuse or fraud.
  • To communicate with you about your account, updates, and (with your consent) product news.
  • To comply with legal obligations and enforce our Terms.

3. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we process your personal data on these bases: to perform our contract with you (to provide the Service); our legitimate interests in operating, securing, and improving the Service and preventing abuse; your consent where we ask for it (such as optional analytics or marketing); and to comply with legal obligations. You may withdraw consent at any time.

4. Your inputs and AI generation

To generate creative, your prompts and assets may be sent to trusted third-party AI model providers that power the Service. We share only what's needed to fulfill your request, and we do not sell your inputs. We do not use your private brand assets to train third-party foundation models without your consent. You retain rights to your inputs and, subject to our Terms, to the content you generate.

5. How we share information

We do not sell your personal information. We share it only with:

  • Service providers — payment processing (Stripe), cloud hosting, AI model providers, analytics, and email delivery, each bound by contract to handle data on our behalf.
  • Ad-library data — our research features query publicly available advertising libraries (e.g., Meta, Google, LinkedIn, TikTok). We don't share your private data with them to do so.
  • Legal & safety — when required by law or to protect rights, safety, and the integrity of the Service.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, with notice where required.

6. Google user data and Limited Use

Hermoso's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

You can connect Google accounts to Hermoso so it can publish and measure work on channels you already own. This covers data obtained through the Google Workspace APIs (Google Drive, Google Sheets and Google Docs) and through the Google Ads, YouTube Data and YouTube Analytics APIs. For all of it:

  • we use the data only to provide or improve the user-facing features you connected the account for, and those features are prominent in the Service;
  • we do not transfer or sell the data to third parties, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition;
  • we do not use the data for serving advertisements, including retargeting or personalized advertising;
  • we do not allow humans to read the data unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data is aggregated and de-identified;
  • we do not use raw or derived Google Workspace data to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models. Hermoso uses third-party AI models to generate advertising creative, and any Google user data involved is used solely to return output to you within your own session — it is never used to train those models, we do not retain it for training, and we contractually direct our AI providers not to train on it.

We request the narrowest Google permissions our features need. For Google Drive, Sheets and Docs we request only drive.file, a per-file permission that lets the Service see and edit only the files it creates on your behalf — never the rest of your Drive. You can review or revoke Hermoso's access at any time at myaccount.google.com/permissions, or disconnect any Google account inside the app under Workspace ▸ Connectors.

7. Cookies, analytics & session recording

We use essential cookies to keep you signed in and the Service working. Beyond those, our website and our app load a small, named set of third-party tools:

  • Google Analytics 4 — aggregate traffic and usage measurement.
  • Google Ads — conversion measurement and remarketing for the ads we run on Google.
  • Meta pixel — conversion measurement and remarketing for the ads we run on Facebook and Instagram.
  • Mixpanel — product analytics, and session recording inside the Hermoso app: Mixpanel records what happens on your screen in the app — the pages you open, your clicks, your typing and your scrolling — and replays it back to us so we can see where the product is slow, confusing or broken. We do not record our marketing website.
  • Intercom — the messenger you talk to our support team through.
  • ChatGPT Ads, from OpenAI — conversion measurement for the ads we run on ChatGPT. It runs in the app only.

Where opt-in consent is required by law — in the EEA, the UK and Switzerland — nothing above tracks you until you accept on our cookie banner: Google's tags are blocked from setting cookies or identifying you, Mixpanel is switched off and records nothing, and the Meta and ChatGPT Ads pixels are not loaded at all. Everywhere else we assume consent, so these load when you arrive. Intercom is the one exception: on our website it waits for the same consent, and in the app it loads once you are signed in, so that support is there when you need it.

You can decline, or change your mind at any time, through "Cookie settings" in our website footer or under Settings in the app. Declining opts you out of Mixpanel and session recording, revokes the advertising pixels, and shuts the support messenger down. You can also control cookies through your browser. If your browser sends a Global Privacy Control signal, we treat it as an opt-out wherever you are — in every country, not only where the law requires it — unless you afterwards explicitly accept. We do not act on the older "Do Not Track" browser header.

While these tools are active and you are signed in, we give the Google and Meta tags your email address so that a signup or a purchase can be matched back to the ad it came from.

8. Data retention

We keep your information for as long as your account is active or as needed to provide the Service, then for a reasonable period to comply with legal obligations, resolve disputes, and enforce agreements. You can request deletion at any time, after which we delete or de-identify your data except where retention is legally required.

9. Security

We use industry-standard measures — encryption in transit, access controls, and reputable infrastructure providers — to protect your data. No system is perfectly secure, but we work hard to keep yours safe.

10. Your rights

Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, delete, port, or restrict the use of your personal information, and to object to certain processing. To exercise any of these, email [email protected]. We won't discriminate against you for exercising your rights, and you may have the right to lodge a complaint with your local data-protection authority.

11. California privacy (CCPA/CPRA)

In the past 12 months we may have collected these categories of personal information: identifiers (name, email), commercial information (plan and purchase history), internet or network activity (usage and device data), approximate geolocation, and visual content you upload or generate. We collect it for the business purposes described above. We do not "sell" or "share" your personal information as those terms are defined by the CCPA/CPRA, and we do not knowingly sell or share the data of minors. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit. California residents may exercise their rights to know, delete, correct, and opt out, and may use an authorized agent.

12. International transfers

We may process and store information in countries other than your own. Where required, we use appropriate safeguards (such as the Standard Contractual Clauses) for international transfers.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will delete it.

14. Changes & language

We may update this policy from time to time. We'll post the new version here and update the "Last updated" date; material changes will be communicated where appropriate. This policy is written in English; any translation is provided for convenience only, and the English version controls.

15. Contact

Questions about privacy? Email us at [email protected].