Privacy Policy

Last updated: August 13, 2026

Effective Date: August 2, 2026
Last Updated: August 2, 2026

This Privacy Policy explains how Nastvix Inc., a Delaware corporation operating the HeroMi service (“HeroMi,” “Nastvix,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when you use the HeroMi website, web application, future mobile applications, and related services collectively referred to as the “Service.”

HeroMi is intended for adult parents and legal guardians. Children do not create HeroMi accounts or independently submit information through the Service.

Additional information about specific types of data is available in our:

  • Child Privacy Notice;

  • Consumer Health Data Privacy Policy, where applicable; and

  • Cookie Notice.

1. Personal Information We Collect

We collect personal information that you provide, information generated through your use of HeroMi, and limited information received from service providers.

1.1 Account Information

When you create or manage an account, we may collect:

  • your email address;

  • authentication credentials managed through Supabase Auth;

  • your name and email address if you register using Google OAuth;

  • account preferences and settings; and

  • records relating to account creation, authentication, and security.

Google provides us only with the name and email address associated with the Google account used to register or sign in.

1.2 Child Profile Information

When you create a child profile, we collect information you provide as the child’s parent or legal guardian, including:

  • the child’s name;

  • the child’s full date of birth; and

  • the focus goal selected for the child.

The child does not provide this information directly.

Additional information about how we handle child profile information is provided in our Child Privacy Notice.

1.3 Parenting, Activity, and Personalization Information

To provide personalized recommendations and track progress, we may collect and maintain:

  • situations selected by the parent;

  • behaviors reported by the parent;

  • mood check-ins recorded by the parent;

  • triggers associated with reported situations;

  • completed and saved practices;

  • skill levels and skill-development information;

  • recommendation history;

  • whether a recommendation was marked helpful or not helpful;

  • the child’s current focus goal; and

  • dates and times associated with these activities.

This information is entered or selected by the adult account holder. Children do not independently submit it through HeroMi.

1.4 Payment and Subscription Information

Payments are processed by Stripe.

HeroMi does not receive or store:

  • complete payment-card numbers;

  • card security codes;

  • complete bank-account information; or

  • other full payment credentials entered through Stripe.

We may receive limited transaction and subscription information from Stripe, including:

  • payment status;

  • Stripe customer and subscription identifiers;

  • selected subscription plan;

  • amount and currency;

  • billing and renewal dates;

  • trial status; and

  • transaction or invoice identifiers.

Stripe processes payment information under its own privacy policy and service terms.

1.5 Device, Usage, and Technical Information

When you access HeroMi, we and our service providers may automatically collect limited technical and usage information, including:

  • IP address;

  • browser type and version;

  • device type and operating system;

  • approximate location derived from an IP address;

  • pages and features used;

  • session information;

  • referring page;

  • dates and times of access;

  • interactions with the Service;

  • authentication and security events; and

  • cookie or similar technology identifiers.

We use Google Analytics to understand general website traffic and product usage. We do not use Google Analytics for advertising personalization or cross-context behavioral advertising.

Additional information is provided in our Cookie Notice.

1.6 Communications

If you contact us, we may collect:

  • your name and email address;

  • the content of your request;

  • account information needed to respond;

  • records of our correspondence; and

  • information you voluntarily provide in connection with the request.

2. Sources of Personal Information

We collect personal information from:

  • you, when you create an account, create or manage a child profile, use the Service, or contact us;

  • your activity within HeroMi;

  • Google, when you use Google OAuth;

  • Stripe, in connection with payments and subscriptions;

  • Google Analytics, in connection with website and product analytics; and

  • our hosting, authentication, security, and infrastructure providers.

3. How We Use Personal Information

We use personal information to:

  • create, authenticate, and maintain accounts;

  • create and manage child profiles;

  • provide HeroMi practices, recommendations, and features;

  • personalize recommendations based on age, focus goals, reported situations, moods, triggers, completed practices, and skill progress;

  • track progress over time;

  • remember completed, saved, or previously shown practices;

  • process subscriptions and confirm payment status;

  • provide receipts, trial notices, renewal notices, and other subscription communications;

  • send account, security, and service-related messages;

  • respond to support and privacy requests;

  • understand how the Service is used;

  • improve the functionality, reliability, and usability of HeroMi;

  • detect, prevent, and investigate fraud, misuse, security incidents, and technical problems;

  • enforce our Terms of Use and other agreements;

  • comply with legal obligations; and

  • establish, exercise, or defend legal claims.

We may also use aggregated or de-identified information for internal analytics, service improvement, and product planning, provided that the information cannot reasonably be used to identify a user or child.

4. AI-Assisted Personalization

HeroMi uses automated systems and Google Gemini to generate certain personalized responses.

Our internal systems may use information associated with the child profile, previous activity, completed practices, focus goals, and skill progress to determine what content may be relevant.

When information is submitted to Google Gemini, we limit it to the information reasonably necessary to generate the response. This may include:

  • a generalized age or age group;

  • selected triggers;

  • mood information, when recorded by the parent; and

  • de-identified skill-level information.

We do not send the following information to Gemini as part of a personalization request:

  • the child’s name;

  • the child’s full date of birth;

  • the parent’s email address;

  • account credentials; or

  • payment information.

We use Gemini through a paid Google Cloud project. Under Google’s terms for paid Gemini API services, Google states that prompts and responses are not used to improve Google’s products.

HeroMi personnel do not routinely review the information submitted for automated personalization. Access is restricted and may occur only when reasonably necessary for security, technical operations, legal compliance, or investigation of misuse.

5. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

5.1 Service Providers

We use service providers to operate HeroMi, including:

  • Supabase for PostgreSQL database hosting, authentication, backend functions, and cloud storage;

  • Cloudflare for frontend hosting, content delivery, availability, and security;

  • Google for Google OAuth, Gemini API services, and Google Analytics;

  • Brevo for service-related and marketing email delivery; and

  • Stripe for payment and subscription processing.

These providers receive only the information reasonably necessary to perform services for us and process information subject to applicable contractual and legal obligations.

5.2 Legal, Safety, and Compliance Disclosures

We may disclose information when reasonably necessary to:

  • comply with applicable law, regulation, legal process, or governmental request;

  • protect the rights, property, or safety of HeroMi, our users, children, or others;

  • detect or prevent fraud, abuse, security incidents, or unlawful activity;

  • enforce our agreements; or

  • establish, exercise, or defend legal claims.

5.3 Corporate Transactions

Information may be disclosed as part of a proposed or completed merger, acquisition, financing, reorganization, sale of assets, insolvency proceeding, or similar corporate transaction.

Where required, we will provide notice or take other legally required measures before personal information becomes subject to materially different privacy practices.

5.4 With Your Direction or Consent

We may disclose information when you direct us to do so or provide valid consent.

6. No Sale or Targeted Advertising

Nastvix Inc. does not:

  • sell personal information;

  • sell information relating to children;

  • share personal information for cross-context behavioral advertising;

  • use child profile information for advertising;

  • use personal information to create third-party advertising audiences; or

  • permit third-party advertising networks to track users through HeroMi.

We do not use Meta Pixel, TikTok Pixel, Google Ads remarketing, or similar advertising-tracking technologies.

If these practices change, we will update this Privacy Policy, provide legally required notice, and offer any choices required by applicable law before beginning the new processing.

7. Email Communications

We may use Brevo to send:

  • account verification messages;

  • password-reset messages;

  • security notices;

  • payment receipts;

  • trial and subscription notices;

  • service updates;

  • parenting tips;

  • product updates; and

  • promotional communications.

You may unsubscribe from marketing communications by using the unsubscribe link included in the message.

Unsubscribing from marketing emails will not prevent us from sending communications reasonably necessary to administer your account, provide the Service, process a subscription, protect account security, or comply with legal obligations.

We send marketing communications where permitted by law and obtain consent where applicable law requires it. U.S. recipients must be given an effective method to opt out, and opt-out requests must be honored within the legally required period.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining historical progress, complying with legal obligations, resolving disputes, and enforcing agreements.

Active Accounts and Child Profiles

While an account and child profile remain active, we may retain:

  • account information;

  • child profile information;

  • moods, triggers, and reported situations;

  • completed and saved practices;

  • skill-development information;

  • recommendation history; and

  • related activity records.

Maintaining this history allows HeroMi to track progress, avoid unnecessary repetition, and personalize future recommendations.

Archived Child Profiles

When you archive a child profile, it will no longer be used for active personalization.

The child profile and information associated with it are scheduled for deletion within 30 days after archival, unless you restore the profile before the deletion is completed or retention is required by law.

Account Deletion

You may delete your HeroMi account through your account settings.

Deleting the account initiates deletion of:

  • the parent account;

  • associated child profiles;

  • parenting and activity history;

  • saved practices;

  • mood and trigger history;

  • skill-progress data; and

  • recommendation history.

Some limited information may be retained when reasonably necessary to:

  • comply with tax, accounting, payment, or other legal obligations;

  • complete or document a transaction;

  • detect or prevent fraud or abuse;

  • resolve disputes;

  • enforce our agreements; or

  • protect legal rights.

Residual copies may remain temporarily in secured backups until those backups are overwritten or deleted through the ordinary backup lifecycle.

Stripe and other service providers may independently retain information as required by law or under their own retention obligations.

9. Your Choices and Controls

Through HeroMi account settings, you may:

  • update your email or account settings where available;

  • update the child’s name;

  • update the child’s date of birth;

  • change the child’s focus goal;

  • archive a child profile;

  • delete your account and associated HeroMi data; and

  • manage certain communication preferences.

You may also contact us at support@heromi.app to request assistance with:

  • accessing personal information;

  • correcting inaccurate information;

  • deleting information;

  • obtaining a copy of information;

  • withdrawing a consent where processing is based on consent; or

  • asking a question about our privacy practices.

We may need to verify your identity before completing a request. Verification may require confirmation through the email address associated with the account or other information reasonably necessary to protect the account and child data.

10. U.S. State Privacy Rights

Depending on your state of residence and whether the applicable law applies to Nastvix Inc., you may have the right to:

  • confirm whether we process your personal information;

  • access personal information;

  • correct inaccuracies;

  • delete personal information;

  • obtain a portable copy of certain information;

  • opt out of the sale of personal information;

  • opt out of targeted advertising;

  • opt out of certain profiling;

  • limit certain uses of sensitive information; and

  • appeal a decision concerning a privacy request.

We do not currently sell personal information, share it for cross-context behavioral advertising, or use it for third-party targeted advertising.

You may submit a request by emailing support@heromi.app or by using available account controls.

Where applicable, an authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and may verify the request directly with you.

We will not unlawfully discriminate against you for exercising a privacy right.

11. Children’s Information

HeroMi accounts are available only to adults who are at least 18 years old.

Children do not:

  • create HeroMi accounts;

  • independently operate parent accounts;

  • directly provide information through HeroMi; or

  • independently interact with HeroMi’s personalized-response system.

Information about a child is provided and managed by the child’s parent or legal guardian.

A child may view HeroMi content or participate in a parent-led practice under adult supervision.

Please review our Child Privacy Notice for additional information about child profiles, parental controls, access, correction, archival, and deletion.

12. Consumer Health Data

Some information selected by a parent, such as information about moods, behaviors, triggers, emotional development, or behavioral practices, may be treated as consumer health data under certain state laws.

Where applicable, our collection and use of such information are also described in our Consumer Health Data Privacy Policy.

We do not sell consumer health data or use it for third-party advertising.

13. Cookies, Analytics, and Browser Signals

HeroMi uses cookies and similar technologies for:

  • authentication;

  • account security;

  • remembering preferences;

  • maintaining sessions;

  • measuring website usage; and

  • understanding product performance.

Google Analytics measures use of HeroMi across sessions. It is not configured for cross-context behavioral advertising.

Additional information about the technologies used and available controls is provided in our Cookie Notice.

Some browsers provide a “Do Not Track” setting. Because there is no universally accepted technical standard for ordinary Do Not Track signals, HeroMi does not currently respond to them as a separate request.

HeroMi does not currently engage in activities requiring an opt-out from sale or targeted advertising. Where applicable law requires recognition of a legally valid browser-based preference signal, we will process that signal as required.

14. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including:

  • encryption in transit;

  • authentication controls;

  • role-based access restrictions;

  • logging and monitoring;

  • secured backups;

  • access limitations for service providers; and

  • contractual data-protection requirements.

No system or method of electronic transmission or storage can be guaranteed to be completely secure. You are responsible for protecting your login credentials and notifying us if you believe your account has been compromised.

15. Data Location and International Access

HeroMi is intended primarily for users in the United States.

Our Supabase project and primary application data are hosted in the United States. Other service providers may process information in the United States and in other locations where they or their subprocessors operate.

If you access HeroMi from outside the United States, your information may be transferred to and processed in the United States, where privacy laws may differ from those in your location.

Where legally required, we will use appropriate safeguards for international transfers.

16. Third-Party Links and Services

HeroMi may contain links to third-party websites or services.

This Privacy Policy does not govern the independent privacy practices of third parties. We encourage you to review their privacy notices before providing information to them.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

  • HeroMi features;

  • information practices;

  • service providers;

  • legal requirements; or

  • operational needs.

The updated policy will display a revised “Last Updated” date.

If a change materially affects how we use personal information, we will provide reasonable notice through the Service, by email, or through another appropriate method before the change takes effect.

Where required by law, we will request consent before applying a materially different use to information previously collected.

18. Contact Us

Questions, concerns, and privacy requests may be submitted to:

Nastvix Inc.
HeroMi
Registered office: 8 The Green, STE A
Dover, Delaware 19901
United States

Email: support@heromi.app