Privacy Policy
Last updated: 5 July 2026
The short version: your photo is used to create your superhero artwork and print your order — nothing else. We don't sell your data, we don't use your photos to advertise to you, and we don't train AI models on them. You can delete your artwork at any time from your account.
1. Who is responsible for your data
Hero Merch (heromerch.co.uk) is a trading style of Smarter Sites Ltd (company no. 14570248), registered in England and Wales, which is the "data controller" for the personal data described here. Questions or requests: [email protected].
2. What we collect and why
| Data | Why we use it | Legal basis (UK GDPR) |
|---|---|---|
| The photo you upload | To generate your superhero artwork and run our automated quality check. Face framing is detected on your own device before upload; the photo is sent to our AI provider (Google) solely to create your artwork. | Performance of a contract |
| Your generated artwork | Stored in your account so you can preview, order and reorder it. | Performance of a contract |
| Account details (email, name if given, hashed password) | To operate your account, apply the daily generation allowance, and email you about your orders. Passwords are stored only as secure hashes. | Performance of a contract |
| Order & delivery details (items, delivery name, address, phone) | Collected at checkout by Stripe and shared with our UK print partner (Printful) to make and deliver your order. | Performance of a contract |
| Payment details | Handled entirely by Stripe. We never see or store your card number. | Performance of a contract |
| A friend's email address (if you use refer-a-friend) | Only to grant your bonus generation and prevent abuse of the scheme. We don't email your friend or add them to any list. | Legitimate interests |
| Your email (if you join our offers list) | To send you occasional offers and news about Hero Merch. Every email includes an unsubscribe option, or just email us and we'll remove you straight away. | Consent |
| Basic technical logs (IP address, request data) | Security, rate-limiting and abuse prevention. | Legitimate interests |
3. Photos of children
Accounts must be held by adults. If you upload a photo of a child, you confirm you're their parent/guardian or have the parent or guardian's permission. Photos of children are treated exactly as above — used only to create the artwork and never for anything else.
4. Who processes data for us
- Cloudflare — hosts the website and stores your account data and artwork securely.
- Google (Gemini API) — receives your photo and generates the artwork. Google's API terms for paid services state customer data is not used to train their models.
- Stripe — takes payment and collects your delivery address at checkout.
- Printful (UK facility) — receives your artwork and delivery details to print and dispatch your order.
Some of these providers process data outside the UK; where they do, transfers are protected by recognised safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.
5. How long we keep things
- Uploaded photos are processed to create your artwork and are not kept as part of a permanent gallery; your generated artwork stays in your account until you delete it or ask us to.
- Order records are kept for 6 years, as required for UK tax and accounting.
- Accounts — you can ask us to delete your account and everything in it at any time by emailing us.
6. Cookies
We use one essential cookie, hm_session, which keeps you signed in for up to 30 days. Your basket is stored in your own browser (localStorage), not on our servers.
We also use Google Analytics to understand how the site is used (pages visited, which steps of the hero-builder people reach) so we can improve it. This sets Google's _ga cookies. The data is statistical, IP addresses are anonymised, and we don't use it to identify you personally or for advertising. You can block these cookies in your browser settings without affecting how the site works.
7. Your rights
Under UK GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to processing, or provide a portable copy. Email [email protected] and we'll respond within one month. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
8. Changes
If we change this policy we'll update this page and the date at the top. Significant changes will be flagged on the site.