1. Who we are and what this covers
#9th Avenue ("we", "us"), a sole proprietorship run by its founder in Texas, USA, not yet incorporated, based in Port Arthur, Texas, USA, operates Hemero. This policy explains how we handle personal data in two different roles:
- As controller for data about our customers and their team members — people who sign up, sign in, buy credits or contact us. Most of this policy is about that data.
- As processor for the contact lists our customers upload or collect through their sign-up forms, and the emails they send. Our customer decides why and how that data is used; we process it on their instructions under the Data Processing Addendum. See section 3.
2. Data we collect about customers
#- Account data — name, email address, password (stored only as a salted hash), organization names, roles and invitations, and two-factor authentication settings if you enable them.
- Billing data — the credit packages you buy, amounts, invoices and payment status. Card details are entered on Stripe's pages and processed by Stripe; we never see or store full card numbers.
- Sending configuration — sending domains, sender names and addresses, reply-to addresses and DNS verification status.
- Usage and device data — IP address, browser user agent, pages and actions in the app, and timestamps, recorded in server logs and an audit log of security-relevant actions.
- Consent records — which version of the Terms, Privacy Policy and Acceptable Use Policy you accepted, when, and from which IP address and browser, so we can show that you agreed.
- Assistant conversations — if you use the in-app AI assistant, the messages you write, its replies and the page context it reads to answer (for example the email you are editing).
- Support communications — what you send us by email and our replies.
- Anti-abuse signals — Cloudflare Turnstile checks on sign-up, sign-in and password reset to tell people from bots.
3. Data about our customers' contacts
#When a customer uses Hemero, we store and process their contacts' data for them: email addresses, names and other attributes the customer chooses, list and segment membership, subscription status and consent details, and delivery and engagement events (sent, delivered, opened, clicked, bounced, complained, unsubscribed). Opens and clicks are measured by our delivery infrastructure with a small tracking image and redirected links.
If you received an email sent through Hemero, the sender is responsible for your data. Use the unsubscribe link in any email to stop receiving messages from that sender — it takes effect immediately — and contact the sender to access or delete your data. If you cannot reach the sender, write to [email protected] and we will forward your request or help.
4. Why we use data and our legal bases
#| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your account, send campaigns, process payments | Performance of our contract with you |
| Keep the service secure, prevent spam, fraud and abuse, enforce our policies | Legitimate interests (protecting users, recipients and our sending reputation) |
| Answer support requests and send service and security notices | Contract; legitimate interests |
| Improve and fix the service using aggregated usage and error data | Legitimate interests |
| Keep invoices, tax records and consent records | Legal obligation; legitimate interests (proof of agreement) |
| Product news and marketing emails to customers | Consent or, where allowed, legitimate interests — you can unsubscribe at any time |
7. International transfers
#Our providers may process data outside your country, including in the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or the provider's certification under the EU–US Data Privacy Framework, with additional safeguards where needed.
8. How long we keep data
#| Data | Retention |
|---|---|
| Account and organization data | While the account is open, then deleted within 30 days of closure |
| Customers' contact data and campaign content | Until the customer deletes it, or 30 days after the account is closed |
| Suppression entries (unsubscribes, bounces, complaints) | As long as needed to keep honouring them, even after a contact is deleted |
| Assistant conversations | Until you delete the conversation or the account is closed |
| Invoices and payment records | As long as tax and accounting law requires |
| Consent records | For the life of the account and the applicable limitation period afterwards |
| Server and security logs | Up to 12 months |
9. Security
#We protect data with encryption in transit (TLS), hashed passwords, optional two-factor authentication, role-based access inside organizations, signed links and webhooks, and restricted, logged administrative access. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
10. Your rights
#Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (without affecting earlier processing). California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights; we do not sell or share personal information as those terms are defined there.
To exercise a right, email [email protected] from the address on your account. We answer within one month (or the period your law sets) and may need to verify your identity. You can also complain to your local data protection authority.
Contacts of our customers
Send requests to the organization that emailed you; see section 3.
11. Children
#Hemero is a business tool and is not intended for anyone under 18. We do not knowingly collect children's data.
12. Changes
#We will update this policy when our practices change and show the date at the top. For material changes we notify account owners by email or in the app before they take effect.
13. Contact
#9th Avenue, Port Arthur, Texas, USA. Email: [email protected].