Privacy Policy
Last updated: 28 October 2026
This Policy follows the Law of Georgia on Personal Data Protection. The Georgian version is the official one.
In short
- Your location is shared only with the members of your family group and with anyone you send a share link to.
- We don't sell data and there are no ads. Our team can't see your family's locations, addresses or chat messages.
- Location history is deleted after 35 days. You can delete your account and data from the app at any time.
- Children always see Heri on their phone and are told what is shared.
1. Who is responsible for your data
The data controller is [COMPANY_NAME], identification code [COMPANY_ID], address [COMPANY_ADDRESS]. Contact: support@heri.ge, [CONTACT_PHONE].
For questions about personal data, including our personal data protection officer, write to: support@heri.ge.
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis |
|---|---|---|
| Email, name, role (parent / child) | Account, sign-in, showing you to your group | Contract |
| If you sign in with Google or Facebook: your account ID there, email address and name (never your password, contacts or posts) | Signing you in to the same Heri account every time | Contract |
| Location (coordinates, accuracy, speed), battery level, charging state, step count | Family map, place and battery alerts, history, SOS | Contract; for children under 16, the parent's consent |
| Places, meeting points, alert settings | Arrival and leaving alerts, no-show alerts | Contract |
| Chat messages, stickers, photos, voice notes | Family chat | Contract |
| Device data: device ID, platform, push token, time zone | Delivering notifications, keeping you signed in | Contract |
| App usage per app, call log of blocked/allowed calls, unlock requests (Prime Plus, Android child only) | Parental controls set by the parent | Parent's consent (child under 16) / consent of the child 16+ |
| Sound from the child's microphone during a Live Listen session (Prime Plus) | Parent listens live for the child's safety | Parent's consent (child under 16) / consent of the child 16+ — see section 5 |
| Plan, payment status, amounts, bank order IDs (not your card number) | Billing, renewals, refunds, accounting | Contract; legal obligation (tax and accounting law) |
| Support conversations | Answering your questions and complaints | Contract; our legitimate interest in good support |
| Technical logs (IP address, time, errors) | Security, preventing abuse, fixing problems | Our legitimate interest |
| Website visits, only if you accept analytics: pages viewed, buttons pressed, browser, device type, approximate location (country, city) | Seeing which pages help people and improving the website | Your consent (you can withdraw it at any time) |
Most of this data is needed to provide Heri. Without location sharing, for example, the family map can't work. A child can switch off location, sound and screen-time sharing in Privacy. The parents are notified if they do. We don't make decisions about you based solely on automated processing that would have legal or similarly significant effects.
3. Children
- Heri is made for families, so it processes children's data. For a child under 16, the parent or legal guardian who invites the child gives consent on their behalf and confirms they are the parent or guardian. Children aged 16 or over consent themselves.
- We always act in the child's best interests. The child sees the Heri app and is told what is shared. They see a banner whenever Live Listen is on, and their parents are notified if they switch sharing off.
- A parent can withdraw consent at any time by removing the child from the group or deleting the child's account.
4. Who receives your data
Within Heri, your data is visible only to the members of your family groups, and to anyone you send a share-location link to, until it expires or you stop it. We use these service providers (processors) to run the Service. They may use the data only on our instructions:
| Provider | What it receives | Where |
|---|---|---|
| Our hosting provider | All Service data (our servers) | Oracle Cloud Infrastructure, Germany (Frankfurt) |
| JSC Bank of Georgia | Payment details you enter on the bank's page, order amounts | Georgia |
| Expo (650 Industries), Google Firebase Cloud Messaging, Apple Push Notification service | Notification text and device push token | USA |
| OpenStreetMap Foundation (Nominatim) | Coordinates, to turn them into street addresses (no names or accounts) | United Kingdom |
| Map tile providers (OpenFreeMap; Esri for satellite view; OpenStreetMap on share pages) | Your device's IP address and the map area being viewed | EU / USA / United Kingdom |
| AI support assistant (Google Gemini or Anthropic Claude) | Messages you write to Support and basic account facts (plan, devices) needed to answer | USA |
| Heri AI (Google Gemini or Anthropic Claude) | For family summaries and Ask Heri: first names, saved place names, area names, times of arrivals and trips, battery and screen-time totals, app names, and the parent's questions — never map coordinates. For voice-note transcripts: the voice message. For the app explainer: only an app's name and package id. Not sent while any adult in the family group has Heri AI switched off | USA |
| Google (Sign in with Google), Meta Platforms (Facebook Login): only if you choose to sign in with them | That you are signing in to Heri; they give us the account ID, email and name described in section 2 | USA / Ireland |
| Email delivery provider | Your email address and the email content (sign-in codes, receipts) | Brevo (Sendinblue SAS, France) |
| Google Analytics (Google Ireland Limited; Google LLC) | Website visit statistics, only with your consent (see the Cookie Policy). Never your Heri account, family or location data | USA |
We may also disclose data when Georgian law requires it, for example to a court or law-enforcement authority acting under the law.
Transfers outside Georgia. The United Kingdom and EU countries are recognised as giving adequate protection. The USA is not on that list. For transfers to the USA we rely on the grounds in Article 37 of the Law on Personal Data Protection: an agreement with adequate safeguards (with the supervisory authority's permission where required), or your consent after we have told you about the risks. You don't have to use the AI support assistant: you can ask for a person at any time. Heri AI is optional too: any adult can switch it off (AI tab → Privacy); routines, unusual-activity alerts and suggestions are then still worked out on our own servers, and summaries arrive as a plain list.
5. Live Listen — rules for audio monitoring
- Purpose: to let a parent check that their child is safe when the child doesn't answer.
- Scope: only sound picked up by the child's phone microphone, only during a session started by a parent on the Prime Plus plan, and only while Heri is running on the child's Android phone.
- Duration: a session lasts until the parent or child stops it, at most 60 minutes a month per plan.
- Warning: the child is shown a “listening” banner and a notification with a Stop button from the start of every session. Switching off “Share sound around” ends a session immediately.
- Storage: audio is streamed live to the listening parent and is not recorded or stored on our servers. We keep only who listened, when and for how long, for 90 days, to count minutes and resolve disputes.
- Access: only the parent who started the session hears the audio.
6. How long we keep data
| Data | Kept for |
|---|---|
| Location points and activity feed | 35 days (history is shown for 30 days) |
| Notifications | 60 days |
| App usage, call log, unlock requests (parental controls) | 35 days |
| Live Listen session records (no audio) | 90 days |
| Share-location links, meeting points | Until they expire, then deleted within a day |
| Chat messages and media | Until the author deletes their account or the group is deleted |
| Account, places, settings | Until you delete your account |
| Payment records | For the period required by Georgian tax and accounting law |
| Heri AI: learned routines, alerts and suggestions | Routines are rebuilt daily from the last 28 days; alerts and suggestions 60 days |
| Heri AI: family summaries and Ask Heri conversations | Summaries 35 days; conversations 90 days or until you clear them |
| Website analytics (Google Analytics) | 14 months, then deleted automatically by Google |
| Support conversations and technical logs | As long as needed to handle your request and keep the Service secure, then deleted |
When you delete your account (Menu → My account → Delete account), we delete your account, location history, places you created and your chat messages, and forget the Google or Facebook account you signed in with. We also ask the bank to delete your saved card. Groups you own pass to another member. If you can't open the app, write to Support or support@heri.ge from your account's email address and we will delete it for you. To also remove Heri's access on the provider's side: Google Account → Security → Your connections to third-party apps; Facebook → Settings → Apps and websites.
7. Your rights
Under the Law of Georgia on Personal Data Protection you have the right to:
- be told which of your data we process, why, and on what basis, and to get a copy (access);
- have inaccurate or incomplete data corrected;
- have your data deleted or destroyed;
- have processing blocked (restricted);
- receive your data in a structured, machine-readable format (portability);
- not be subject to decisions based solely on automated processing;
- withdraw your consent at any time, as easily as you gave it. This doesn't affect processing before the withdrawal;
- complain to the supervisory authority or a court.
To use your rights, write to support@heri.ge or use Support in the app. Many requests can also be done directly in the app. We answer within 10 working days; in justified cases we may extend this once by 10 working days and will tell you why. Requests to block processing are handled within 3 working days. Using your rights is free.
Supervisory authority: the State Audit Office of Georgia, which oversees personal data protection — sao.ge, sao@sao.ge, +995 32 243 81 81.
8. Security
We protect data with these measures:
- encrypted connections (HTTPS) between the apps, the website and our servers;
- sign-in tokens that are stored only in hashed form;
- signed, expiring links for chat media;
- staff access limited to what's needed for support. Staff cannot see locations or messages.
If a data breach is likely to harm you, we notify the supervisory authority within 72 hours. If the risk to you is high, we also tell you without undue delay.
9. Marketing
We don't send marketing messages without your consent. Service messages, such as sign-in codes, receipts and important changes to the Service, are not marketing and are always sent. If you do agree to marketing, you can stop it at any time. We stop within 7 working days.
10. Changes
If we change this Policy in a way that affects you, we will tell you in the app or by email before the change applies. The date at the top shows the latest version.