Hiro Privacy Policy

Last updated: 7 September 2026

This policy explains what personal information Hiro collects, how we use it, who we share it with, and the choices you have. It applies to the Hiro website, web app, mobile apps, API, connectors and related services (the “Service”). It’s part of our Terms of Service.

1. Who we are

Hiro LLC, 2601 S. Minnesota Ave Ste 105-308, Sioux Falls, SD 57105, USA.

Hiro is a platform where creators publish private podcasts, audiobooks and audio courses, sell access to them, and communicate with their listeners.

2. Two roles: controller and processor

We handle personal information in two different capacities, and your rights depend on which one applies.

Hiro as controller. For creator accounts, billing, our website, our own marketing and our own analytics, Hiro decides how and why data is used. This policy governs that data directly.

Hiro as processor. When a creator uses Hiro to collect and manage listener contacts, send messages, track listening, run sales pages or set up automations, the creator is the controller and Hiro processes data on the creator’s instructions under our Data Processing Agreement. If you’re a listener and want to access, correct or delete data a creator holds about you, contact the creator first. We’ll help creators respond to those requests.

3. Information we collect

From creators

• Account details: name, email, password, business name, profile information, time zone, language.
• Billing: we use Stripe to process our own subscription and product charges. We receive your card’s last four digits, brand, expiration date, billing address and transaction history. Full card numbers go to Stripe, not us.
• Content: audio, video, transcripts, cover art, show descriptions, sales page content, forms, email and message templates, and anything else you upload, import or generate.
• Connected services: credentials or tokens for services you connect, such as Stripe, PayPal, Twilio, Telnyx, WhatsApp Business, Gmail, Outlook, SMTP, Zapier, Pabbly, Go High Level, YouTube, custom domains, Facebook pixel and Google Analytics.
• Your own API keys: if you bring your own Anthropic or ElevenLabs key, we store it encrypted and use it only to make requests on your behalf.
• API and connector usage: requests made through the Public API and the Claude connector (MCP), including the data returned.
• Support: messages you send us and our replies.
• Usage: pages and features you use, actions you take, device and browser information, IP address, log data.

From listeners (processed for creators)

• Contact details: email, phone number, name and any other fields a creator collects through forms, keyword opt-ins, checkouts or imports.
• Purchases: what you bought, price, date, subscription status. Payment itself is processed by the creator’s Stripe or PayPal account; Hiro receives confirmation and limited transaction details, not full card numbers.
• Consent records: opt-in source, timestamp, IP, and GDPR consent choices.
• Listening data: episodes downloaded or streamed, how far you listened, the app or player you used, approximate location derived from IP address (city or region level), device type, timestamps.
• Messaging: SMS, WhatsApp, push and email messages sent to you and replies you send, delivery status, opens and clicks.
• Tags and categories: labels a creator applies to you.
• Mobile app: push notification token, device identifiers, app version, crash reports, and any preferences you set in the app.

Automatically, from everyone

• Cookies and similar technologies: on hiro.fm, in the web app and on creator sales pages hosted by Hiro. See Section 8.
• Log data: IP address, browser, operating system, referring URLs, pages viewed, timestamps.

4. How we use information

To run the Service: create and secure accounts, host and deliver shows, generate sales pages, process checkouts, deliver messages, run automations, provide analytics, sync connected services, and support the mobile app.

To power AI features: when you use the AI show builder, AI cover art, transcription, the AI assistant, Publisher or ElevenLabs voices, we send the relevant content to the AI provider to generate the result. We don’t use your content or listener data to train our own models. Our AI providers are contractually prohibited from training on your data. Anthropic and ElevenLabs retain inputs only as needed to provide the service and for abuse monitoring, per their commercial terms.

To bill you: charge subscriptions, add-ons, credits and overages, and handle refunds.

To communicate with you: service notices, security alerts, billing, product updates and, if you’ve opted in, marketing. You can unsubscribe from marketing anytime.

To improve Hiro: understand how features are used, fix bugs, develop new features. We use aggregated or de-identified data for this wherever possible.

To keep the Service safe: detect fraud, spam, abuse and security incidents; enforce our terms and messaging rules; comply with carrier and platform requirements.

To comply with law: respond to lawful requests, meet tax and accounting obligations, and protect our rights.

5. Legal bases (EEA, UK and Switzerland)

Where GDPR or UK GDPR applies, we rely on:

• Contract: to provide the Service you signed up for.
• Legitimate interests: security, fraud prevention, product improvement, and service communications. We balance these against your rights.
• Consent: marketing emails, non-essential cookies, and where otherwise required. You can withdraw consent at any time.
• Legal obligation: tax, accounting and lawful requests.

6. Who we share information with

We don’t sell personal information, and we don’t share it with third parties for their own marketing.

Subprocessors and service providers. We share data with providers who help us run the Service, under contracts that limit how they can use it. Current categories and providers:

We’ll keep an updated list and notify creators of additions as required by the DPA.

Creators. If you’re a listener, the creator whose show you access receives your contact details, purchase information, listening data and message history as described above.

Third parties you add. If a creator installs a Facebook pixel, Google Analytics or another tracker on their sales page, that company receives data directly from your browser under its own privacy policy. Hiro’s GDPR consent tool lets creators gate those trackers behind consent.

Podcast apps. If you install a private feed in Apple Podcasts, Spotify or another app, that app receives your listening activity under its own policy.

Legal and safety. We may disclose information to comply with law, enforce our terms, protect users, or respond to lawful requests.

Business transfers. If Hiro is acquired or merges, your information may transfer as part of that deal. We’ll notify you before your data becomes subject to a different privacy policy.

7. International transfers

Hiro is based in the United States and our providers may process data in the US and other countries. Where we transfer personal data from the EEA, UK or Switzerland, we rely on Standard Contractual Clauses, the UK Addendum, or another lawful mechanism, and we apply appropriate safeguards.

8. Cookies and tracking

We use:

• Essential cookies: login sessions, security, load balancing. These can’t be turned off.
• Preference cookies: language, theme, dismissed notices.
• Analytics cookies: how visitors use hiro.fm and the web app. We only set these with your consent where the law requires it.
• Marketing cookies: on hiro.fm only, to measure our own ad campaigns. Consent-based where required.

Creator sales pages hosted by Hiro may include additional cookies and pixels set by the creator. Those are the creator’s responsibility and are governed by the creator’s disclosures.

You can manage cookies through the consent banner where shown, your browser settings, and the opt-outs offered by Google and Meta. We honor Global Privacy Control signals for the pages we control.

9. How long we keep information

• Creator account data: for as long as your account is active, then [30] days so you can export or reactivate, then deleted.
• Content and listener data: same as the account, unless you delete it sooner. Deleting a contact removes it from active systems within [30] days.
• Billing and tax records: 7 years or as required by law.
• Messaging logs: [12] months for delivery and compliance, then deleted or de-identified.
• Listening and download logs: [24] months in identifiable form, then aggregated.
• AI inputs and outputs: stored in your account as content; not retained separately by us beyond what’s in your account. Provider retention is described in Section 4.
• Backups: purged on a rolling [35]-day cycle.
• Support conversations: [3] years.

We may keep data longer where required for legal claims or compliance.

10. Security

We use encryption in transit and at rest, access controls, logging, and regular review of our providers. Your API keys and connected-service credentials are stored encrypted. No system is perfectly secure; if we learn of a breach affecting your personal data, we’ll notify you and any regulators as required by law.

11. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Export your information in a portable format.
• Object to or restrict certain processing.
• Withdraw consent.
• Opt out of marketing.
• Not be discriminated against for exercising these rights.

How to exercise them. Creators can update most information in account settings and can export shows, contacts and analytics from the dashboard. For anything else, or to delete your account, email [email protected]. We’ll verify your identity and respond within 30 days (or the period your local law requires).

Listeners. If your data is held on behalf of a creator, contact the creator. If you can’t reach them, email us and we’ll pass the request along or act where we’re able.

California residents. You have the rights above under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We don’t sell personal information and don’t share it for cross-context behavioral advertising, except that creator-installed pixels on sales pages may constitute “sharing” by the creator. We don’t use or disclose sensitive personal information for purposes that would give you the right to limit its use. You can appoint an authorized agent to make requests for you.

Other US states. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have similar rights. If we deny a request, you can appeal by replying to our decision email.

EEA, UK and Switzerland. You can lodge a complaint with your local supervisory authority. Our contact for data protection matters is [email protected]. [If required, name an EU/UK representative.]

12. Children

Hiro isn’t directed at children under 13, and we don’t knowingly collect their personal information. Creators whose audience includes minors must comply with COPPA and other laws that apply to that audience and must not collect personal information from children under 13 through Hiro without verifiable parental consent. If you believe we’ve collected data from a child under 13, email [email protected] and we’ll delete it.

13. Mobile app

The Hiro player app collects the data described in Section 3 plus what the app store provides to us (aggregate download and crash statistics). Push notifications can be turned off in your device settings. The app doesn’t collect precise location.

14. Do Not Track

We honor Global Privacy Control signals on pages we control. We don’t currently respond to legacy Do Not Track headers because there’s no accepted standard for them.

15. Changes to this policy

We’ll post changes here and update the date at the top. If a change materially affects how we use your data, we’ll email creators and post a notice in the app before it takes effect.

16. Contact

Hiro LLC 2601 S. Minnesota Ave Ste 105-308 Sioux Falls, SD 57105, USA