1. Data controller
- Identity: ECOMMERCE BUSINESS INTELLIGENCE, S.L. (NIF B01635143)
- Address: Campus Universitario de Espinardo, 7, Edif. CEEIM, 30100 Espinardo (Murcia), Spain
- Privacy contact: privacidad@herotasks.app
2. What data we process and whose
2.1 Adults (parents and guardians)
- Account data: email address, password (stored irreversibly hashed), name, family role (for example “Dad” or “Mom”), emoji avatar and language.
- Family data: family name, subscription plan and members.
- Usage data: tasks, rewards, missions, task groups and approvals you create or resolve, with their dates.
- Technical data: device identifier for push notifications, server access and error logs, and an anonymous identifier generated by our subscription provider.
2.2 Minors (kids)
Kids do not create an account or provide data themselves. An adult in the family creates each profile in the parents app and decides which data to include:
- Name or nickname, emoji avatar, language and, optionally, a 4-digit PIN.
- Activity generated while using the kids app: ticked tasks, days submitted for review, points earned and spent, requested rewards and aquarium fish.
We do not ask minors for date of birth, photograph, location or contact details. The kids app opens with the adult’s account, so there are no credentials belonging to the minor. We recommend using a nickname rather than the full name.
2.3 Data we do not process
We do not access the device’s contacts, camera, microphone, photos or location. We do not use third-party analytics tools or advertising networks.
3. Purposes and legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Create and manage your account and family, and provide the Service (tasks, approvals, rewards, aquarium, missions). | Performance of a contract (Art. 6(1)(b)). |
| Manage your kids’ profiles and their activity within the app. | Performance of the contract with the responsible adult (Art. 6(1)(b)) and consent of the holder of parental authority or guardianship regarding the minor (Art. 6(1)(a) GDPR and Art. 7 LOPDGDD). |
| Send transactional emails: sign-up confirmation, password recovery and invitations to other adults in the family. | Performance of a contract (Art. 6(1)(b)). |
| Send push notifications about your family’s activity, if you enable them. | Consent (Art. 6(1)(a)), revocable at any time from the app or device settings. |
| Manage the Premium subscription and check the active plan. | Performance of a contract (Art. 6(1)(b)) and compliance with legal, tax and accounting obligations (Art. 6(1)(c)). |
| Keep the Service secure, prevent abuse and fix errors. | Legitimate interest (Art. 6(1)(f)) in maintaining a secure and operational service. |
| Handle your support requests and the exercise of your rights. | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)). |
We do not make automated decisions with legal effects or build profiles. The calculation of points and plan limits is a feature of the Service, not profiling.
4. Processing of minors’ data
HeroTasks is designed for families to organise children’s chores. Therefore:
- Only an adult can create an account. When creating a kid’s profile, the adult declares that they hold parental authority or guardianship over the minor and consents to the processing described in this policy, in accordance with Article 7 of the LOPDGDD.
- The adult can edit or delete their kids’ profiles at any time from the “Family” tab of the parents app. Deleting a profile erases its tasks, points, rewards and fish.
- We do not show advertising to minors, do not collect advertising identifiers and do not track their behaviour for commercial purposes.
- We do not ask minors for more data than the adult chooses to enter in their profile.
5. Recipients and processors
We do not disclose data to third parties for their own purposes. To provide the Service we use the following providers, which act as processors under contract in accordance with Article 28 GDPR:
| Provider | Service | Data |
|---|---|---|
| Supabase, Inc. | Database, authentication, storage and transactional email delivery | All account, family, profile and activity data |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery | Device identifier for notifications |
| RevenueCat, Inc. | In-app subscription management | Anonymous user identifier and subscription status |
| Vercel, Inc. | Hosting of the website and the authentication site | Technical connection data (IP address, browser) |
| Apple Inc. and Google LLC | App distribution and subscription billing | Payment data is processed exclusively by the store; we do not access it |
We may also disclose data to public authorities where a legal obligation exists.
6. International transfers
Some of the providers listed are established in the United States or may process data outside the European Economic Area. In those cases, transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, and on the standard contractual clauses approved by the European Commission with appropriate additional measures in the other cases. You can request more information at privacidad@herotasks.app.
7. Retention periods
- Account and family data: while the account is active. When it is deleted, the profiles, tasks, rewards, history and associated tokens are erased immediately.
- Unconfirmed sign-ups: accounts that do not confirm their email are deleted automatically after 72 hours.
- Subscription billing data: the period required by tax and commercial law (generally six years).
- Technical and security logs: a maximum of twelve months.
- Backups: overwritten in short cycles; deleted data disappears from them within a maximum of thirty days.
8. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw the consent given without affecting the lawfulness of prior processing. Adults may also exercise them on behalf of the minors in their family.
- From the apps: editing your profile and your kids’ profiles, turning off notifications or deleting profiles is done directly in the parents app.
- To delete the whole account see the Delete account page.
- For any other request write to privacidad@herotasks.app stating the right you are exercising and the email you registered with. We may ask you to prove your identity. We will reply within one month at most.
If you believe we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain) or with the supervisory authority of your country of residence.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted communications (TLS), passwords stored using irreversible derivation functions, isolation of each family’s data through access rules enforced on the server, access control to the admin panel and periodic security reviews. No system is infallible; if we detect a breach that poses a risk to your rights, we will notify you as required by law.
10. Push notifications and reminders
Push notifications require your permission on the device and can be turned off at any time from the app or system settings. When you sign out, your device identifier is removed from our servers. The daily reminders in the kids app are scheduled locally on the device and do not send data to any server.
11. Changes to this policy
We may update this policy to adapt it to legal or Service changes. The current version will always be available on this page, with its update date. If the change is significant we will let you know by email or within the app.
12. Contact
For any privacy matter: ECOMMERCE BUSINESS INTELLIGENCE, S.L., Campus Universitario de Espinardo, 7, Edif. CEEIM, 30100 Espinardo (Murcia), Spain. Email: privacidad@herotasks.app.