Privacy Policy

This Privacy Policy explains how Masego Inc ("Masego", "we") collects, uses, and protects personal information when you use HERA at hera.masegoinc.com. HERA's data products are aggregate public statistics; this policy concerns the limited personal information of our website visitors, leads, and subscribers.

1. Information we collect

• Account & subscription data: email address, and — for organizations — company name and tenant identifier.
• Lead / contact form data: name, email, and company you submit when requesting a sample, a call, or support.
• Payment data: processed by Stripe. We do not store full card numbers; we receive limited transaction and subscription metadata.
• Usage & technical data: IP address, user agent, request logs, and error diagnostics used to operate and secure the Service.
• Cookies: see our Cookie Notice.

2. How and why we use it (lawful bases)

• To provide the Service (accounts, entitlements, downloads, support) — performance of a contract.
• To process payments and manage subscriptions — contract.
• To secure and improve the Service (rate limiting, abuse prevention, diagnostics) — legitimate interests.
• To respond to leads and inquiries you initiate — legitimate interests / your request.
• To send transactional email (receipts, API keys, service notices) — contract. We do not send marketing email without consent.

3. Sharing & subprocessors

We share personal information only with service providers who process it on our behalf under contract, including: Stripe (payments), Railway (hosting), Cloudflare R2 (object storage), Resend (transactional email), and Sentry (error monitoring). We do not sell personal information, and we do not share it for cross-context behavioral advertising.

4. International transfers

We operate in the United States; your information may be processed there and by the subprocessors above. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

5. Retention

We keep account and billing records for as long as your account is active and as required for tax, accounting, and legal obligations. Security and audit logs are retained per our retention schedule. Lead data is kept only as long as needed to respond and follow up.

6. Your rights

EEA / UK (GDPR)

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. You may also lodge a complaint with your supervisory authority.

California (CCPA/CPRA)

This section is our notice at collection. You have the right to know what personal information we collect and how we use it, to request access and deletion, and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under the CPRA, and we do not discriminate against you for exercising your rights.

How to exercise your rights

Submit a data-subject request to privacy@masegoinc.com, or through our request intake at POST /api/v1/privacy/dsar. We verify identity before acting and respond within the timeframes required by applicable law (generally 30 days).

7. Security

We protect information with transport encryption (HTTPS/HSTS), API-key authentication, tenant isolation, audit logging, and access controls. Our security program is audit-ready; no method of transmission or storage is perfectly secure.

8. Children

The Service is not directed to children under 16 and we do not knowingly collect their personal information.

9. Changes & contact

We may update this policy; the "Last updated" date reflects the current version. Privacy questions and requests: privacy@masegoinc.com.