Privacy Policy

This Privacy Policy applies to Hedras.Co, operated by Ekali LLC, a Delaware limited liability company. Ekali LLC is responsible for the processing described in this Policy where applicable privacy law treats it as a controller or business.

The service is offered internationally. We do not infer citizenship from location. Local law may provide additional rights or impose different obligations.

• The site and model files still require ordinary network requests.
• Optional Firebase Analytics is disabled until you allow analytics.
• Google AdSense and its certified consent platform manage applicable advertising choices.
• Browser storage keeps drafts, consent choices, rollout assignment, PWA preferences, and cached application or model files.

When your device requests the site, model files, advertisements, or third-party services, the relevant provider may receive ordinary network and technical information such as IP address, approximate location derived from IP, browser and device information, requested URLs and assets, timestamps, language, referrer, consent signals, and security or diagnostic information.

If you contact us, we process the email address, message, attachments, and related correspondence you choose to provide. If optional analytics is enabled, Firebase Analytics may process page and feature interactions, session statistics, device and browser information, approximate location, identifiers, and diagnostic events.

Draft text and voice choices may be stored in local storage. Selected media, inference inputs, intermediate data, and generated output remain on your device during processing. Generated Blob URLs stop working when the session is refreshed or closed, so download wanted files before leaving.

The browser may download and cache application assets, runtime files, and public model files. Cache entries remain until they expire, storage pressure removes them, a service-worker update replaces them, or you clear site data.

We process information to deliver public assets and requested functionality, keep the service secure, prevent abuse and advertising fraud, diagnose reliability issues, measure product usage when permitted, improve the experience, answer support requests, comply with law, and operate the advertising-supported service.

Where applicable, our legal bases include performance of the service you request, legitimate interests in security, fraud prevention, reliability, and product improvement, consent for optional analytics and applicable advertising technologies, and compliance with legal obligations.

Public site assets are served from Railway infrastructure configured in the Netherlands and may pass through content-delivery or security infrastructure. Ekali LLC is established in the United States. Google, Hugging Face, Railway, and their subprocessors may process ordinary network or service information in countries where they operate.

Hugging Face receives ordinary network request data when your browser downloads public model files. Hedras.Co does not include your selected media or prompts in those model-download requests.

Third-party vendors, including Google, may use cookies and similar technologies to deliver, limit, personalize, secure, and measure advertisements. Depending on your region and choices, this may include information about visits to Hedras.Co and other sites, IP address, device identifiers, consent signals, and ad interactions.

You can review Google Ads Settings and how Google uses information from partner sites. Google determines whether an eligible advertisement is available for each placement; an enabled placement does not guarantee that an ad will be served.

Firebase Analytics is optional and its SDK loads only after you select Allow analytics. We use it for audience measurement, product analytics, performance monitoring, and operational diagnostics. We do not send uploaded image bytes, scripts, prompts, intermediate model data, or generated files to analytics.

Learn more about Google Analytics data collection and privacy and security in Firebase.

The Cookie Policy identifies the browser storage and third-party technologies used by Hedras.Co. Optional analytics remains disabled until you allow it. In regions where required, Google's certified consent management platform presents advertising choices and communicates applicable consent or opt-out signals to Google.

You may Privacy and cookie settings at any time. You can also manage site data in your browser and ad personalization in Google Ads Settings.

We disclose information only as reasonably needed to operate the service, including to infrastructure, model distribution, analytics, diagnostics, advertising, consent management, security, and support providers; to comply with law or legal process; to protect rights and safety; or in connection with a financing, reorganization, merger, sale, or transfer of the service.

Local drafts and preferences remain until they expire, you reset the relevant feature, or you clear site data. Generated Blob URLs exist only in the active browser session. Provider data is retained according to configured provider settings and for as long as reasonably needed for the purposes described in this Policy, legal compliance, dispute resolution, and security.

We use HTTPS, restrictive browser security headers, consent controls, data minimization, and local processing. No internet service, provider, transmission, or client device can guarantee absolute security.

Because Ekali LLC and its providers operate internationally, information may be transferred outside the country where it was collected. Where applicable law requires it, the relevant party relies on recognized transfer mechanisms or safeguards, which may include adequacy decisions and standard contractual clauses.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal information; object to certain processing; withdraw consent; opt out of targeted advertising or certain disclosures; and complain to a regulator. Some rights are subject to verification, legal exceptions, and jurisdiction-specific limitations.

We do not sell personal information for money. Advertising activity may be treated as a sale, sharing, or targeted advertising under some US state laws. Use Privacy and cookie settings where available or contact hello@hedras.co to submit a request. Withdrawing consent does not affect processing that was lawful before withdrawal.

If the GDPR, UK GDPR, or a comparable European law applies, you may have rights to be informed; access, correct, erase, restrict, or port personal data; object to processing; withdraw consent; and avoid certain solely automated decisions. You may also complain to the supervisory authority where you live, work, or believe an infringement occurred.

These rights are subject to the conditions and exceptions in applicable law. See the European Data Protection Board overview and the UK Information Commissioner’s guidance for regulator guidance.

Users in India, Pakistan, Indonesia, Malaysia, and other Asia-Pacific jurisdictions may exercise the rights available under the law that applies to them. These may include access or information, correction, erasure, withdrawal of consent, grievance handling, objections to direct marketing, and complaints to a competent authority.

Relevant official materials include India’s Digital Personal Data Protection Act, 2023, Indonesia’s Law No. 27 of 2022 on Personal Data Protection, and guidance from the Personal Data Protection Commissioner of Malaysia. Rights and procedures vary by country and may change as implementing rules take effect.

Residents of California and other states with comprehensive privacy laws may, where the law applies, have rights to know, access, correct, or delete personal information; receive a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; and receive equal service for exercising privacy rights.

We may need to verify a request and may deny or limit it where an exception applies. Authorized agents may be required to show authority. See the California Attorney General’s CCPA information for an official explanation of California rights.

Browsers may send Do Not Track signals, but no uniform industry response is required in every jurisdiction. Hedras.Co therefore does not treat a generic Do Not Track signal as a universal privacy request.

Global Privacy Control is a legally recognized opt-out signal in certain US states. For users in applicable states, Google receives GPC signals directly and applies restricted data processing to eligible AdSense requests. You can also use Privacy and cookie settings to open available Google consent or US state opt-out controls. See Google’s restricted data processing guidance and the California Attorney General’s GPC guidance.

Hedras.Co is not directed to children and the Terms require users to be at least 18 or the age of legal majority where they live, whichever is higher. If you believe a child has provided personal information through a support message, contact us so we can review the request.

We may update this Policy as the service, hosting, providers, advertising, analytics, or applicable law changes. The current effective date appears at the top of this page.

For privacy questions, grievances, or rights requests, contact hello@hedras.co. We may request information reasonably necessary to verify a rights request and respond under applicable law.