PRIVACY POLICY

This Privacy Notice for Heron AI, Inc. ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://heron-ai.com, or any website of ours that links to this Privacy Notice
• Download or use Heron AI, our design assistant that runs inside your design software, and our related web dashboard
• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, please contact us at hello@heron-ai.com.

SUMMARY OF KEY POINTS

This summary provides key points from our Privacy Notice. You can find more detail on any topic using the table of contents.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use.
• What about my project and model data? When you use Heron inside your design software, it accesses the parts of your model and project you choose to share, so it can answer your questions and carry out the changes you approve. We treat this as confidential and process it only to provide the Services.
• Do we process sensitive personal information? We do not process sensitive personal information.
• Do we collect information from third parties? We do not collect information from third parties.
• How do we process your information? To provide, improve, and administer our Services, communicate with you, keep the Services secure, and comply with law. We process your information only when we have a valid legal reason.
• With whom do we share information? In specific situations and with specific third parties, including the AI providers that power Heron's features.
• How do we keep your information safe? Through organisational and technical measures. No system is ever completely secure, so we cannot guarantee your information against every threat.
• What are your rights? Depending on where you live, you may have certain rights over your personal information.
• How do you exercise your rights? The easiest way is to contact us. We will act on any request in line with applicable data protection laws.

WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register for the Services, express interest in our products, take part in activities on the Services, or otherwise contact us. Depending on how you interact with us, this may include your name and email address.

Project and model data

When you use Heron inside your design software, Heron accesses the parts of your model and project that you choose to share with it, so it can answer your questions and carry out the changes you approve. This may include geometry, model elements, parameters, drawings, and project metadata. We treat this data as confidential and process it only to provide the Services and as described in this notice.

Payment data

If you make a purchase, we may collect the data needed to process it, such as your payment card details. This is handled and stored by our payment processor, not by us.

Sensitive information

We do not process sensitive information.

Social media login data

We may let you register using an existing social media account. If you choose to do this, we will collect the profile information described in "How do we handle your social logins?" below.

Information automatically collected

In Short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you use our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. It also includes diagnostic and performance data from the Heron plugin and dashboard, such as error reports and crash logs. This information is mainly used to keep the Services secure and working, and for our internal analytics and reporting.

HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• To provide the Services. We process the model and project data you share so Heron can answer your questions, suggest changes, and carry out the edits you approve.
• To create and manage your account and keep it in working order.
• To respond to your enquiries and provide support.
• To send you administrative information, such as changes to our terms and policies.
• To manage your orders, payments, and subscriptions.
• To send you marketing and promotional messages, in line with your preferences. You can opt out at any time.
• To understand how the Services are used so we can improve them.
• To keep the Services secure and to prevent fraud and abuse.
• To comply with our legal obligations.

WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in the situations described below and with the following parties.

• AI Service Providers. To power Heron's features, we share your inputs and outputs, including the parts of your model and project you choose to share, with the providers described in "Do we offer artificial intelligence-based products?" below.
• Service providers. We share information with vendors that help us run the Services, such as hosting, payment processing, analytics, and error tracking, under written contract and only as needed.
• Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business.
• Legal reasons. We may share your information where we are required to by law, or to protect our rights and the safety of others.

DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and similar tracking technologies to collect and store your information.

We use cookies and similar technologies on our website and dashboard for security, to remember your preferences, and for analytics. For details and your choices, please see our Cookie Policy.

DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?

In Short: Yes. Heron is powered by artificial intelligence, machine learning, and similar technologies.

Heron's core features are powered by AI. We provide these through third-party AI service providers ("AI Service Providers"), which may include Anthropic, OpenAI, and Google Cloud AI.

To generate answers and suggestions, and to carry out the changes you approve, your inputs, including the parts of your model and project you choose to share, and the outputs are shared with and processed by these AI Service Providers. We enter into agreements with these providers to protect your data and, where the provider offers it, to prevent your data being used to train their models except as needed to provide the Services.

You must not use Heron's AI features in any way that breaks the terms or policies of any AI Service Provider.

HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you register or log in using a social media account, we may receive certain information about you.

Our Services may let you register and log in using a third-party social media account. If you do, we will receive certain profile information from your provider, which often includes your name, email address, and profile picture. We will use it only for the purposes described in this notice. We do not control, and are not responsible for, other uses of your information by your social media provider, so we recommend you review their privacy notice.

HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as needed for the purposes in this notice, unless a longer period is required by law.

We keep your personal information only for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law. Model and project data is retained only as long as needed to provide the Services to you, or as you direct. When we no longer have a business need to process your information, we will delete or anonymise it, or, where that is not possible, securely store it and isolate it from further processing until deletion is possible.

HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through organisational and technical security measures.

We have put in place appropriate and reasonable technical and organisational security measures designed to protect the information we process. However, no method of transmission over the internet or electronic storage is ever completely secure, so we cannot promise or guarantee that unauthorised third parties will never be able to defeat our security. You should only access the Services within a secure environment.

DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly collect, solicit data from, or market to children under 18, nor do we knowingly sell such personal information. By using the Services, you confirm that you are at least 18, or that you are the parent or guardian of a minor and consent to their use of the Services. If we learn that we have collected personal information from a user under 18, we will deactivate the account and take reasonable steps to delete the data. If you believe we may have collected such data, please contact us at hello@heron-ai.com.

WHAT ARE YOUR PRIVACY RIGHTS?

In Short: You may review, change, or terminate your account at any time, depending on where you live.

Withdrawing your consent: where we rely on your consent to process your information, you have the right to withdraw it at any time by contacting us. This will not affect the lawfulness of any processing before the withdrawal.

Opting out of marketing: you can unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting us. We may still send you service-related messages that are necessary for your account.

Account information: to review, change, or terminate your account, please contact us. On your request, we will deactivate or delete your account and information from our active databases, though we may keep some information to prevent fraud, resolve disputes, or comply with law. If you have questions about your privacy rights, email us at hello@heron-ai.com.

CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track ("DNT") feature you can activate to signal your privacy preference. There is no finalised uniform standard for recognising and responding to DNT signals, so we do not currently respond to them. If a standard is adopted that we must follow, we will update this notice.

DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of certain US states, you may have specific rights over your personal information.

Depending on your state, you may have the right to know whether we are processing your personal data, to access it, to correct inaccuracies, to request deletion, to obtain a copy, and to opt out of certain processing such as targeted advertising, the sale of personal data, or profiling with legal or similarly significant effects. You also have the right not to be discriminated against for exercising these rights.

We collect identifiers such as your name and email address, and internet and usage activity such as how you use the Services, as described in "What information do we collect?" above. We do not sell your personal information, and we do not sell or share your model or project data. We have not sold or shared personal information for a business or commercial purpose in the preceding twelve months.

How to exercise your rights: contact us at hello@heron-ai.com. We will verify your identity before acting on your request. If we decline your request, you may appeal by emailing us at the same address.

DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be shown by an updated "Last updated" date at the top. If we make material changes, we may notify you by posting a notice or by sending you a direct message. We encourage you to review this notice regularly.

HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at hello@heron-ai.com or contact us by post at:

Heron AI, Inc.

2100 Market Street, Suite 400

San Francisco, CA 94114

United States

HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the laws of your country or US state, you may have the right to request access to the personal information we collect, details about how we process it, corrections, or deletion. You may also have the right to withdraw your consent to our processing. To make a request, please contact us at hello@heron-ai.com.