Privacy Policy

This Privacy Policy explains how Herodocu ("we," "us," "our"), the operator of herodocu.com (the "Service"), collects, uses, stores, and shares information when you use the Service, in compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and any other law applicable to users outside India.

1. Who We Are

Herodocu is a sole proprietorship operating out of India. For any privacy-related query, you may contact us at support@herodocu.com.

2. Information We Collect

• Account information. When you create an account, we collect your email address and any authentication information associated with your login.
• Uploaded documents. If you use the PDF-upload extraction feature, we collect the financial statement document you upload, including any personal or business information it contains, and its file name.
• Ticker/company lookups. If you use the ticker-based lookup feature, we record the ticker symbols you look up against your account, and use them to fetch the relevant filing from the U.S. Securities and Exchange Commission's public EDGAR database.
• Payment information. If you subscribe to a paid plan, payment card details are collected and processed directly by our third-party payment processor. We do not receive, store, or have access to your full card number, CVV, or card expiry date — our payment processor is PCI-DSS certified and handles this data under its own security standards.
• Usage data. We collect information about how you use the Service, including the number of extractions performed, feature usage, and technical data such as IP address and device identifiers, used specifically to enforce free-tier usage limits and to detect and prevent abuse (for example, multiple free accounts created from the same device to bypass usage limits).

3. How We Use Your Information

We use the information above to:

• Provide the extraction service, including sending the text of uploaded documents to our AI processing provider to generate structured output. For ticker lookups, we read figures directly from the SEC's structured filing data where it is available, and send the text of the public filing to our AI processing provider only where it is not;
• Process payments and manage your subscription;
• Enforce free-tier usage limits and detect abuse of free features;
• Communicate with you about your account, including transactional emails;
• Improve the accuracy and reliability of the Service;
• Comply with legal and regulatory obligations, including those under Indian tax and payments law.

4. Who We Share Information With

We share information with the following categories of third parties, each acting as our data processor:

• AI processing providers: the text of documents you upload is sent to our AI processing providers to generate the structured output returned to you. For ticker lookups, the text of the public SEC filing is sent only when the SEC's structured data for that filing is unavailable. We do not send your name, email address, or payment information to these providers.
• Payment processor: payment and billing information necessary to process your subscription, including data required for compliance with the Reserve Bank of India's recurring-payment (e-mandate) framework.
• Cloud hosting providers: our application database and backend hosting infrastructure, used to process uploaded documents and to store account information, usage and billing records, and extraction logs.
• U.S. Securities and Exchange Commission (SEC EDGAR): when you search for a public company by ticker, we send a request to SEC EDGAR's public systems to retrieve the relevant filing. This request does not include your personal information, only the ticker searched.

We do not sell your personal information to third parties, and we do not share uploaded documents with any party other than those listed above for the purpose of providing the Service.

5. International Data Transfers

Because our AI processing and cloud hosting providers may process data outside India, your information — including uploaded documents — may be transferred to and processed in a jurisdiction other than your own.

6. Data Retention

• Uploaded documents are deleted from our processing server as soon as extraction finishes, whether it succeeds or fails.
• Generated Excel workbooks are kept on our processing server so that you can download them, and are deleted automatically within 25 hours of extraction. The extracted figures are also held in the processing server's temporary memory, which is not written to disk, and are deleted on the same schedule.
• Account and activity records are kept for as long as your account exists. These include your email address, usage and billing records, a log of your extractions (date, type, file name or ticker, page count, and processing usage, and for an uploaded PDF a SHA-256 digest of the file — a fingerprint that cannot be turned back into the document, used to recognise the same file for its free re-run), the statements extracted from ticker lookups — public SEC data, kept so you can view or download them again — and the IP address and device information we use to prevent abuse of free allowances. If you used our earlier document-analysis feature, the file name, your instructions, and the generated response are also kept.

When your account is deleted, we delete these records. A small number of records — your payment records, the history of subscription and payment events, a log of processing costs that includes document file names, and any enterprise inquiries you submitted — are kept with the link to your account removed, including where we may need them for tax and accounting purposes.

You can delete your account yourself at any time from the Billing & account page, or ask us to do it by contacting us at support@herodocu.com.

7. Your Rights

Under the DPDP Act, you have the right to access, correct, and request erasure of your personal data, and to withdraw consent for its processing, subject to applicable exceptions. To exercise these rights, contact us at support@herodocu.com.

If you are located outside India, you may have additional rights under the law of your own jurisdiction; this policy does not limit those rights.

8. Security

We use industry-standard measures, including encryption in transit, to protect the information we collect. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cookies and Similar Technologies

We use a small number of cookies and browser storage items. None is used for advertising, and nothing is shared with advertisers or used to follow you across other websites.

• Staying signed in. When you sign in, your session is kept in your browser's local storage so that you stay signed in between visits. Signing out removes it.
• Security. Our hosting provider's network sets a short-lived cookie to tell people from automated traffic and to block attacks.
• Preventing abuse of free allowances. On the PDF upload and Billing & account pages, your browser computes a device identifier from its characteristics, as described in Section 2, so that one device cannot claim the free allowance repeatedly.
• Page analytics. Our hosting provider counts visits to our pages using a cookie that expires after 30 minutes. It records the page you visited, the site that referred you, your browser type and language, and your approximate country, and we see only totals. Sign-in details are removed from page addresses before this runs.
• Payment and Google services. When you open the payment window, or choose to sign in with Google or export to Google Sheets, those services set their own cookies under their own policies. Nothing is loaded from them until you do.

We do not show a cookie banner because we set no advertising or cross-site tracking cookies. If that changes, we will ask for your consent first. You can block or delete cookies in your browser's settings; blocking the ones that keep you signed in will sign you out.

10. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from them.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via the Service or by email before they take effect.

12. Contact Us

For any questions about this Privacy Policy, contact us at support@herodocu.com.