Overview and scope
This Policy explains how EGO HERO LLC (“EGO HERO,” “we,” or “us”) handles personal information on the public egohero.com website and features made available directly through it: browser-based converters, the AI Background Remover, the design-system catalog, authentication, and the contact form (the “Service”).
Browsing an informational page hosted on egohero.com, including the OmniSubs marketing page, is covered here. Processing inside separately branded extensions, applications, and services — including OmniSubs, ViralHero, SiteList, and FixVibe — is not; the applicable product notice governs that use. Internal operator, employment, vendor, and accounting systems are also outside this public-site notice.
1. Controller / business
- EGO HERO LLC
- 5830 E 2nd St, Ste 7000 #31990, Casper, WY 82609 US
- Email: hello@egohero.com
EGO HERO LLC is responsible for the processing described here and is the controller or business where applicable law uses those terms. Contact the address above for a privacy request or a question about the applicable representative or transfer safeguard in your location.
2. Data we process
2.1 Browser-local converters
Except for the AI Background Remover, converter inputs are read and processed in your browser using browser APIs, JavaScript, and WebAssembly. EGO HERO does not receive the contents of those files. Input and output may remain in browser memory or temporary object URLs until you leave or reload the page. Runtime-library providers receive ordinary asset-request metadata, but not the file you selected.
2.2 AI Background Remover uploads
When you click “Remove background,” we receive the uploaded PNG, JPEG, or WebP image and its source filename. Our server validates its type, size, pixel dimensions, and selected model, then creates a random job ID. Temporary job data includes the source and result images, dimensions, model, status, progress, timestamps, and any generic processing error.
We derive a pseudonymous hash from the requesting IP address to enforce hourly limits and help restrict retrieval to a request presenting the same network-address identifier and unguessable job ID. People behind one shared network can present the same identifier, and an address change can prevent retrieval. The hash and rate-limit timestamps stay in server memory for about one hour. The raw IP may also appear in normal web-server logs described below.
Inference runs on EGO HERO’s isolated server; no external AI-model provider receives these images. We do not use uploads or results for model training or advertising and do not routinely review them. Operators may access service storage only when reasonably necessary for security, troubleshooting, legal compliance, or incident response.
2.3 Accounts and catalog access
If you sign in, Supabase Auth processes your email address, user UUID, authentication provider, sign-in timestamps, session and device metadata, and any basic profile attributes supplied by Google OAuth. We use Google OAuth or an email magic link, so EGO HERO does not receive a password.
EGO HERO’s own access database separately stores the UUID, email, access state (pending, approved, or rejected), reviewer identifier, and create/update/grant timestamps needed to gate the catalog. Your Supabase session is stored in browser storage until sign-out, expiry, or revocation.
2.4 Contact form
The contact form accepts your name, email, message, and a hidden spam-detection field. The contact service relays the name, email, and message through Mailgun to our mailbox and does not maintain an application database.
2.5 Language and automated translation
When a non-English page is displayed, untranslated visible interface text may be sent to Google Translate together with the requested language and ordinary network metadata such as IP address and user agent. EGO HERO marks form values, account email addresses, filenames, sheet/table names, output names, and admin data as non-translatable so the translator is not intended to receive them. Input files are never sent to Google Translate.
Translated legal pages and other translations are automated and may be inaccurate. The English legal text is the source version, subject to rights that cannot be limited under applicable law.
2.6 Consent, browser storage, and analytics
Our Cookies Policy lists the current storage technologies. They include the consent record, an authentication session when signed in, and a short-lived return path for authentication. OCR language packs and documents are not placed in persistent Tesseract storage; the site asks the browser to remove the legacy cache used by earlier releases.
If you consent to Analytics, Google Analytics 4 receives page URL/title, pseudonymous browser and session identifiers, device/browser information, interaction and diagnostic events, and coarse location derived from an IP address. Google states that raw IP addresses are discarded after use rather than logged in Analytics. Our tag disables Google Signals and ad-personalisation signals, and Consent Mode keeps ad storage, ad user data, and ad personalisation denied. We do not initialize Analytics on the authentication callback route and do not send account emails, filenames, or file contents to Analytics.
2.7 Server and security logs
Hosting and application infrastructure may log IP address, user agent, method, request path, response status, timestamp, timing, container/service name, and error details. Some authentication or administrative warnings may include an account email or other operational identifier. We use logs for delivery, debugging, security, abuse prevention, and legal compliance, not advertising.
2.8 Public-source design-system catalog
EGO HERO operators may direct our crawler to publicly accessible websites to create catalog entries. We collect source URLs, public page titles and descriptions, headings, visible component text, style and interaction information, and screenshots. Public pages can incidentally include names, faces, biographies, or contact details already published at the source.
Extracted public material and screenshots may be sent through Kie.ai to the selected Gemini- or Claude-family model to generate a design-system description and demonstration. Generated files, screenshots, source/provenance records, provider/model metadata, and operational errors are stored in EGO HERO’s catalog database and file storage. This workflow does not receive account, contact-form, converter, or Background Remover files.
A site owner or affected person may request correction, attribution review, or removal by emailing hello@egohero.com with the source URL and reason.
2.9 What this Service does not do
- It does not include a payment form or ask public-site users for payment-card information.
- It does not use ad networks, session recording, heatmaps, or social-media tracking pixels.
- We do not buy personal information from data brokers.
- We do not sell personal information or share it for cross-context behavioural advertising.
- We do not use converter or Background Remover files to train AI models.
3. Purposes and legal bases
Where EU/UK law applies, we rely on the legal bases identified below. The exact basis can depend on your relationship with us and local law.
- Deliver requested features: local conversion, temporary background removal, authentication, access checks, downloads, and display of a requested non-English page. Basis: contract or steps at your request; where no contract applies, our legitimate interest in providing the Service.
- Respond to communications: receive, route, and answer contact messages and rights requests. Basis: steps at your request and legitimate interests.
- Protect the Service: validate uploads, rate-limit, authenticate, log, troubleshoot, prevent abuse, and establish or defend claims. Basis: legitimate interests and, where relevant, legal obligation.
- Measure use: run Google Analytics only after your opt-in. Basis: consent, which you may withdraw at any time.
- Create the public catalog: research public sites and generate reference material. Basis: our legitimate interest in publishing a useful design reference, balanced against the limited and public nature of the source data and the available objection/takedown process.
- Meet legal duties: respond to lawful requests and comply with applicable law. Basis: legal obligation or legitimate interests.
Account sign-in, contact details, a Background Remover image, and a language selection are voluntary, but we cannot provide the corresponding requested feature without the necessary information. Analytics is optional and refusing it does not limit the tools.
4. Recipients
Depending on the feature you use, information may go to:
- Hostinger — server hosting and related infrastructure for the site, API, temporary background processing, access database, and catalog.
- Supabase — authentication, sessions, magic-link delivery infrastructure, and account metadata.
- Google — OAuth if selected; Analytics only with consent; Translate when a translated page is displayed; webfonts/static assets requested by the browser; and Gmail mailbox delivery/storage for contact messages.
- Mailgun (Sinch) — delivery and event handling for contact-form email.
- Kie.ai and the selected upstream model provider — Gemini- or Claude-family processing of public-source catalog material only.
- unpkg and jsDelivr — static JavaScript, worker, language, and WebAssembly assets used by certain browser-local tools. They receive request metadata, not selected files.
- Demo asset providers — sandboxed catalog demonstrations can request third-party fonts or example images. Providers observed in the current published catalog include Google Fonts, Picsum, Unsplash, Wikimedia, and Pravatar; generation rules also permit Bunny Fonts for a future demo. A requested provider receives ordinary request metadata under its own notice.
Some providers act on our instructions; others, such as identity, analytics, translation, and content-hosting providers, may determine aspects of their own processing. We may also disclose information to professional advisers, authorities where lawfully required, or a successor in a merger, financing, restructuring, or sale, subject to appropriate protections.
5. International transfers
EGO HERO is established in the United States, and providers may process information in the United States and other countries. Where a restricted international transfer requires a safeguard, we assess and seek to rely on an applicable mechanism, which can include an adequacy decision, a valid data-privacy framework, Standard Contractual Clauses, or the UK Addendum. The mechanism depends on the provider, destination, and data flow. Email hello@egohero.com for the current information available to us about a particular transfer.
6. Retention
- Browser-local converter data: held in browser memory or temporary object URLs until conversion completes, you leave/reload, or the browser releases it. Your own downloaded files remain under your control.
- Background Remover: source and result files are scheduled for deletion about 30 minutes after a job ends; the cleanup interval can add roughly one minute. A service restart attempts to delete outstanding job folders on startup, so files may disappear sooner. Failed deletions are retried during later cleanup passes. We may preserve limited logs or metadata, but not image files unless a specific legal duty or binding request requires otherwise. The IP-derived rate-limit hash normally expires from memory after about one hour.
- Authentication and access records: kept while needed to authenticate you and administer catalog access. There is no public self-service deletion flow; email us to request deletion. We may retain a minimal record where required for security, dispute resolution, or law.
- Contact messages: the contact application does not keep a database copy. Mailgun may temporarily retain message and event data for delivery, security, and troubleshooting under the account’s provider settings. The delivered copy is stored in a Google-hosted Gmail mailbox and manually administered until the communication or related record is no longer reasonably needed, subject to legal obligations. You may ask us to delete a message sooner.
- Translation: EGO HERO does not add runtime Google Translate requests to an account record. Non-user-specific translations can remain in build/cache files or browser memory; Google controls its own request-log retention under its terms.
- Logs: production container logs are size-rotated (generally up to three files of about 50 MB per container), so the time represented varies with traffic. Security or incident evidence may be retained longer where necessary.
- Analytics: user- and event-level GA4 data is kept for no more than the property’s configured period, up to 14 months. Standard aggregate reports may remain longer. Withdrawing consent stops future collection and clears our first-party GA cookies on a best-effort basis; it does not automatically erase historical aggregate reports.
- Catalog: public-source records, job history, and generated materials are kept while a catalog entry, provenance, correction, dispute, or operational record remains useful. Takedown removes public files on a best-effort basis but can retain internal source, catalog, job, and provenance records needed to document the action or resolve a dispute.
7. Your rights
Subject to applicable law, you may ask us to:
- provide access to personal information we hold about you;
- correct inaccurate or incomplete information;
- delete information or restrict its use;
- provide eligible information in a portable format;
- honour an objection to processing based on legitimate interests;
- withdraw consent for future processing; or
- review an applicable refusal or appeal.
Email hello@egohero.com with the subject “Privacy request.” Tell us the account email, source URL, or interaction needed to locate the data, but do not send sensitive identity documents unless requested. We may verify your identity and authority. We respond within the period required by applicable law and will explain any permitted refusal or extension.
8. EU/UK specifics
If GDPR or UK GDPR applies, you can complain to the supervisory authority where you live, work, or believe a violation occurred. Contacting us first is welcome but not required. You can also object to legitimate-interest processing, including public-source catalog processing; we will stop unless we demonstrate compelling lawful grounds or need the information for legal claims.
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you.
9. US state privacy rights
Residents of states with comprehensive privacy laws may have access, correction, deletion, portability, opt-out, appeal, and authorised-agent rights, subject to each law’s scope, thresholds, and exceptions. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics.
Where your browser sends Global Privacy Control, the Service also keeps Analytics and Marketing categories off while that signal is present. This additional preference applies even though we do not sell or share personal information. We will not discriminate against you for exercising an applicable privacy right.
10. Children
The Service is not directed to children under 13, and we do not knowingly collect their personal information. If local law requires parental authorisation for an older minor to use an account or submit personal information, the minor must have that authorisation. Contact hello@egohero.com if you believe a child submitted information improperly.
11. Security
Measures include HTTPS, access controls, isolated databases, authentication checks, upload type/size/pixel limits, same-origin upload controls, rate limiting, short-lived background-job storage, and restricted service containers. No system is completely secure. We will give legally required breach notices if an incident creates that duty.
12. Changes
We may update this notice as the Service or law changes. We will revise the date above and, for material changes, provide additional notice where reasonably practicable. A new notice applies from its effective date; it does not retroactively create a new legal basis for earlier processing. Material browser-storage changes also trigger a new consent choice.
13. Contact
Privacy questions, rights requests, or catalog correction/takedown requests: hello@egohero.com. Postal address: EGO HERO LLC, 5830 E 2nd St, Ste 7000 #31990, Casper, WY 82609 US.