Privacy Policy for HanziHeart

This Privacy Policy explains how Gladiolus Limited, using HanziHeart as an app brand/trading name ("HanziHeart", "we", "us", or "our"), collects, uses, stores, and shares personal data when you use the HanziHeart app, website pages, and related services (together, the "Service").

HanziHeart is not a separate legal entity. For UK GDPR and Data Protection Act 2018 purposes and, where applicable, the EU GDPR, Gladiolus Limited is the data controller for the personal data described in this Policy, except where a third party acts as an independent controller for its own services, such as Apple, Google, or app stores.

Some features described in this Policy may not be available to all users, devices, platforms, subscription tiers, or countries.

1. What HanziHeart Does

HanziHeart helps users understand Chinese text. You paste or type a line, import a screenshot, capture a photo of text, or use the HanziHeart keyboard where available, and HanziHeart produces a "read" of the line — the literal meaning, the natural meaning, cultural context, the emotional read, tone, key words, and suggested replies. HanziHeart may also provide companion-style practice, saved words or reads, audio pronunciation, share cards, widgets or Lock Screen content, and related learning features.

2. Personal Data We Collect

Depending on how you use the Service, we may collect or process the following categories of personal data:

• Name and profile data: display name, avatar or companion choice, share-card name preferences, locale, goals, reading preferences, reminder settings, and other preferences you choose to set.
• Email address: email address and related authentication metadata used for account sign-in.
• Marketing preferences and consent: where the promotional-email preference is available, we record your choice, consent timestamps and changes to that preference. Marketing consent is optional, separate from accepting our Terms or acknowledging this Policy, never pre-selected, and never required to use the Service. These features may not yet be available in your version of HanziHeart. Where the preference is unavailable, we do not collect marketing consent or send you promotional email. Before using an opt-in to send promotional email, we will ensure that we hold evidence identifying your account, when and how you consented, where you made the choice, and the version and language of the consent wording shown to you. Withdrawals will also be recorded.
• User ID and account identifiers: app account IDs, subscription customer IDs, sign-in provider identifiers, and related account metadata.
• Device or app identifiers: device, session, SDK, or anonymous identifiers used for authentication, subscription management, security, reliability, or abuse prevention.
• Purchase history: subscription product and entitlement IDs; purchase, restore, trial, renewal, product-change, expiry, cancellation, billing-issue, refund, or refund-reversal events; transaction and original-transaction identifiers; price, purchased currency, storefront country, store environment; and related app-store or subscription-management metadata.
• Affiliate and friend-invite data: creator affiliate-code attribution; configured affiliate offer type; affiliate-recipient and friend-referral store offer reservations; friend-referral codes; inviter and invited-friend account identifiers; a public sender name and name-sharing consent timestamp where an inviter explicitly chooses to display their name; claim, qualification, payment, rejection, and reward status; claim, first-payment, and reward timestamps; applicable subscription product and store status; and app-store offer reference, reservation, redemption, expiry, refund, or revocation status. Friend-referral codes are generated independently and do not contain or derive from a user ID.
• Submitted text and learning content: We process the text you submit and the responses generated by HanziHeart. In the main app, completed reads are automatically recorded in practice history, including the original text and its translation, even if you do not save them to your phrasebook. This history is stored on your device and synced to your account when you are signed in. Reads and words saved to your phrasebook are stored separately. We also store companion conversations, reply choices, learning progress, streaks and share-card content to provide and sync these features. Companion history may include messages opened from notifications. Your personal onboarding read is also saved automatically to your phrasebook.
• Notification preferences: Your reminder settings, notification permission status, and changes to these preferences.
• Content reports: If you report a response, we receive the reported content, relevant conversation context, and any reason or explanation you provide so we can review the report.
• Keyboard extension data: where you enable the HanziHeart keyboard, the app may share a signed-in session with the keyboard locally so the keyboard can use the Service while you are signed in. The keyboard may process pasted text or screenshot text you choose to use and may insert selected replies into the current text field.
• Product interaction data: feature interactions, onboarding completion, companion selection, read counts, dictionary taps, saves, share events, camera or screenshot import events, keyboard events, notification or widget interactions, paywall and subscription events, anonymous install identifiers, and similar app usage information where enabled.
• Diagnostics and technical data: technical logs, crash and error reports, recent app-flow events used to diagnose errors, device and platform information, app version, and similar data needed for reliability, abuse prevention, and troubleshooting.

3. Screenshots, Photos, Keyboard, and On-Device Reading

If you import a screenshot or capture a photo of text, HanziHeart recognises the Chinese text on your device. The screenshot or photo image itself is not uploaded to us or to the AI provider.

Only text extracted from the image — such as the Chinese line or supporting text needed to identify the relevant message — is sent to our service to generate the read, in the same way as a line you paste or type. We do not store the original image, and we do not receive your photo library contents.

HanziHeart may check clipboard text locally to suggest a vibe check for copied Chinese text. Clipboard text is not sent to our service unless you choose to use it for a read.

If you enable the HanziHeart keyboard, the keyboard may require Full Access so it can use network access, the shared app session, and screenshot import. The keyboard may request Photos access to load a screenshot you choose or the latest screenshot for text extraction. Screenshot recognition still runs on device, but extracted or pasted text is sent to the service when you ask for a vibe check.

The main app and keyboard each retain their latest result locally so you can return to it. A new successful result replaces the previous locally retained result in that feature. This does not remove entries already recorded in main-app practice history or saved to your phrasebook. The keyboard’s latest-result storage is separate from main-app practice history.

4. Data You Should Not Submit

HanziHeart is a language-reading tool, not a place for sensitive records. Please do not submit passwords, payment card numbers, government identifiers, health or medical information, confidential business information, or other people’s private messages, screenshots, or photos where you do not have a lawful basis or permission to do so. Relevant submitted text and conversation context are sent to an AI provider to generate reads or companion replies, as explained in Section 6.

5. How We Use Personal Data

• Providing the Service
  To create and authenticate accounts, generate reads and companion replies, explain words, process selected screenshot or camera text, support the keyboard, maintain practice history and phrasebook content, sync learning progress and preferences, manage subscriptions and promotional access, and enforce usage limits.
  Lawful basis: Contract.
• Reviewing content reports
  To investigate reported responses and misuse, address safety concerns, and improve content safeguards.
  Lawful basis: Legitimate interests in protecting users and operating a safe service.
• Personalising the Service
  To remember your preferences, companion choice, saved reads, saved words, share-card names, reminders, and widget or Lock Screen settings.
  Lawful basis: Contract and legitimate interests.
• Maintaining and improving the Service
  To monitor reliability, debug issues, and improve features where product analytics are enabled.
  Lawful basis: Legitimate interests.
• Keeping the Service secure
  To prevent abuse, fraud, unauthorised access, and misuse of AI or service systems.
  Lawful basis: Legitimate interests.
• Processing subscriptions
  To maintain purchase, restore, entitlement, trial, renewal, cancellation, billing-issue, and subscription state.
  Lawful basis: Contract.
• Operating affiliate attribution and friend referrals
  To attribute creator introductions and related production subscription revenue, validate invite eligibility, link an inviter and invited friend by account identifier, reserve and track discounted or free store offers and account-level access rewards, confirm the friend’s first qualifying paid monthly or annual Pro payment, apply programme limits, replace expired unredeemed codes where available, reconcile product changes and refunds, and prevent fraud or duplicate claims.
  Lawful basis: Contract and legitimate interests in operating and protecting the programme.
• Sending service messages
  To send transactional or service-related messages necessary to operate the Service, such as password resets, receipts and subscription notices, security alerts, support replies, and important legal or policy updates.
  Lawful basis: Contract where necessary to provide the Service; legal obligation where a notice is legally required; or legitimate interests in securing the Service and communicating necessary operational information, as appropriate to the message.
• Sending marketing email
  To send promotional email — such as product news, feature announcements, offers, or invitations — only where you have actively opted in, and to record and manage that consent.
  Lawful basis: Consent under Article 6(1)(a) of the UK GDPR and the EU GDPR. Withdrawal stops future promotional email and does not affect service messages.
• Honouring marketing choices
  To retain limited consent evidence and suppression records where necessary to demonstrate compliance and prevent unwanted marketing.
  Lawful basis: Legal obligation where required to comply with data protection law, and legitimate interests in demonstrating compliance and preventing unwanted communications where appropriate. These records are not used to continue marketing after withdrawal.
• Complying with legal obligations
  To respond to lawful requests, enforce terms, and keep required records.
  Lawful basis: Legal obligation and legitimate interests.

You can withdraw promotional-email consent at any time through your marketing preference in Profile where available, the unsubscribe link in every promotional email, or by contacting us using the details in Section 20. Withdrawal is free and does not affect your access to HanziHeart or your subscription. We stop promotional email covered by your withdrawal immediately or as soon as possible. Messages already dispatched may still arrive. Necessary service messages are unaffected, and withdrawal does not affect the lawfulness of processing carried out before it.

Where promotional email is introduced, delivery providers may process delivery records, such as successful deliveries, bounces and unsubscribe requests. We will not track individual email opens or link clicks for marketing analysis. Processing an unsubscribe request is separate from analysing engagement with promotional links.

Your promotional-email preference does not authorise promotional push notifications. Enabling notifications for companion messages or learning reminders does not itself constitute consent to promotional pushes. If we introduce promotional push notifications, we will request a separate, optional in-app opt-in and provide an in-app way to withdraw it. Neither accepting our Terms nor granting operating-system notification permission substitutes for that choice.

HanziHeart does not use personal data for third-party advertising or cross-app advertising tracking.

Except where an inviter explicitly chooses and consents to display a public sender name on an invite page, we do not expose an inviter’s or invited friend’s email address, private account name, subscription details, or other personal account information to the other participant. A participant may see the consented public sender name, aggregate invite progress, claim or reward status, and their own codes, but not the other participant’s private account information.

Where we create aggregated or anonymised information that no longer identifies you, we may use it to understand usage trends, improve reliability, and develop the Service.

6. AI Processing

When you request a read or an AI-generated companion reply, we send the relevant text through our service to a third-party AI provider. This may include text extracted from an image, recent conversation messages, and selected learning preferences, such as your companion, difficulty, topic and language. The provider uses this information to generate the response, which may include translations, emotional reads, explanations, practice messages and suggested replies.

The AI provider may process the submitted text, the generated output, and technical metadata under its own terms and privacy practices. Depending on the provider used, this processing may take place outside your country of residence, including in the United States, United Kingdom, European Economic Area, People’s Republic of China, or other provider locations. Some AI providers may use submitted inputs or outputs to improve their services unless restricted by their terms or settings.

Where optional search enrichment is enabled, the submitted text may also be used to build a search query for current slang, meme, or cultural context. We do not send your account contact details or payment information to the AI provider as part of a normal read or companion-reply request. AI outputs may be inaccurate, incomplete, or unsuitable for your needs, and HanziHeart is not a professional translation, legal, medical, or relationship-advice service.

7. What We Do Not Do

We do not currently:

• sell personal data;
• use personal data for cross-app advertising tracking or targeted advertising;
• upload your imported screenshots or captured photos to us or the AI provider;
• use the text you submit to train HanziHeart-owned AI models;
• intentionally send raw submitted Chinese text, OCR text, reply text, screenshots, or photos to product analytics or crash-reporting tools;
• send your account contact details or payment information to the AI provider as part of a normal read or companion-reply request; or
• collect your contacts, precise location, full photo library contents, or microphone recordings for normal app use.

If any of these practices change, we will update this Policy and provide any required notices, consents, or opt-out mechanisms under applicable law.

8. Sharing of Personal Data

We may share personal data with service providers that process data on our behalf, and with professional advisers, regulators, law enforcement, or authorities where legally required. We do not sell your personal data and do not use it for cross-app advertising tracking.

Where a provider acts as our processor, we aim to use provider data processing terms or equivalent contractual terms covering processing instructions, confidentiality, security, assistance with user rights, retention, deletion, and breach support. Some app store, platform, billing, and sign-in providers may also act as independent controllers for their own services.

9. International Transfers

We are based in the United Kingdom. Some providers we use may process personal data outside your country of residence, including in the United Kingdom, European Economic Area, United States, People’s Republic of China, Canada, Asia Pacific countries and regions where HanziHeart is made available, or other countries where they operate. The recipient-category table above identifies material provider categories that may involve overseas processing.

Privacy and data protection laws in those countries may differ from the laws in your country of residence. By using HanziHeart, you understand that personal data may be processed in those locations, subject to this Policy, applicable law, and any safeguards required for the relevant transfer.

Where you request a read or companion reply, the relevant text and conversation context are sent to an AI provider, which may process it outside the UK depending on its infrastructure. Depending on the provider used, AI processing may include the People’s Republic of China or other provider locations. Where applicable privacy law requires safeguards for international transfers, we use appropriate measures such as adequacy decisions, approved contractual terms, data processing agreements, or other lawful transfer mechanisms.

10. Business Transfers

If Gladiolus Limited or HanziHeart is involved in a merger, acquisition, financing, reorganisation, insolvency process, sale of assets, assignment, change of control, or similar transaction, personal data may be transferred to the acquiring or successor entity as part of that transaction.

The successor entity will continue to process personal data in accordance with this Policy, applicable law, and any required notices, consents, and opt-out rights. If we materially change how personal data is used, shared, sold, licensed, or processed after a transfer, we will provide notice and obtain consent or apply required mechanisms under applicable law.

11. Retention

12. Your Rights and Account Deletion

Subject to applicable law, you may have the right to request access to your personal data, correction of inaccurate data, deletion of your personal data, restriction of processing, to object to processing based on legitimate interests, to withdraw consent where processing relies on consent, to opt out of certain sale, sharing, targeted advertising, direct marketing, or profiling practices where applicable, and to request portability of certain data.

You can request account deletion or exercise privacy rights by contacting hanziheart-privacy@gladiolus.dev. You can also read the account deletion section on HanziHeart Support for the deletion request process.

We may request information reasonably necessary to verify your identity. We handle requests without undue delay. Where UK data protection law applies, we normally provide a substantive response within one calendar month of receiving your request, subject to legally permitted identity-verification requirements and extensions. If an extension applies, we will explain the reason and revised deadline within the required period. Other applicable local deadlines remain unaffected. If we cannot comply with a request in full, we will explain the reason and applicable complaint rights.

You can delete your account through the app or contact us to request deletion. Account deletion removes your account, profile, practice and companion history, saved content and preferences from our active systems. We also delete associated identifiable product analytics and arrange deletion of relevant records held by our service providers. Provider processing may complete separately from deletion of your app account; this does not remove our obligation to handle your request within applicable legal deadlines.

We retain limited records where necessary to demonstrate that a deletion request was completed or meet legal obligations. These may include protected identifiers and completion dates. Such records remain subject to access restrictions and retention limits. We may also retain statistics that no longer identify you. App stores may retain purchase records under their own legal obligations and privacy policies.

Deleting your account or uninstalling the app does not cancel an app-store subscription. You must manage cancellation through the store where you subscribed.

13. Regional Privacy Rights

This Policy is intended to apply globally. The sections above explain the main facts about HanziHeart’s collection, use, sharing, AI processing, retention, security, and international transfers.

United Kingdom

If UK data protection law applies, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent where processing relies on consent, and request portability of certain personal data. You may complain to the UK Information Commissioner’s Office.

European Union and EEA

If the EU GDPR or other EU data protection law applies to your use of HanziHeart, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent where processing relies on consent, data portability, and to lodge a complaint with your local EU data protection supervisory authority.

We have appointed an EU representative under Article 27 GDPR — FGND Core GmbH, Hauptstrasse 151, 10827 Berlin, Germany, hanziheart@core-privacy.eu — for GDPR-related privacy matters and requests from EU supervisory authorities and individuals in the EU.

Switzerland

Where Swiss data protection law applies, you may request information about the processing of your personal data and exercise applicable rights to correction, deletion or restriction of disclosure. You may contact the Federal Data Protection and Information Commissioner concerning data protection matters.

United States

If United States federal or state privacy law applies, including where applicable California privacy law, you may have rights to know or access personal information, request deletion, request correction, obtain information about categories of data collected, sources, purposes, and disclosures, opt out of sale or sharing of personal information or targeted advertising, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights. HanziHeart does not currently sell personal data, share personal data for cross-context behavioural advertising, or use personal data for third-party targeted advertising.

Canada

If Canadian privacy law applies, you may have rights to access personal information we hold about you, request correction, withdraw consent subject to legal or contractual restrictions, and challenge our compliance. We collect, use, and disclose personal information for the purposes described in this Policy and aim to limit collection, use, disclosure, and retention to what is reasonable for those purposes.

Brazil

Where Brazil’s General Data Protection Law applies, you may have rights to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data, portability where applicable, information about sharing, and withdrawal of consent. You may also request deletion of data processed with consent, subject to lawful exceptions, and information about the consequences of withholding consent. You may petition the Brazilian data protection authority, ANPD. We process children’s and adolescents’ data subject to applicable protections and their best interests.

Asia Pacific Countries and Regions

If privacy law in an Asia Pacific country or region where HanziHeart is available applies to your use of the Service, you may have local rights to be informed about processing, request access to or correction of personal data, request deletion or erasure where available, withdraw consent, object to or restrict certain processing, request portability where available, and contact us or a local privacy regulator with complaints. This may include privacy laws in places such as Australia, New Zealand, Singapore, Malaysia, Thailand, the Philippines, Indonesia, Japan, Korea, Hong Kong, Taiwan, and other Asia Pacific countries or regions where HanziHeart is available.

Other Countries and Regions

HanziHeart is also available in countries across Latin America and the Caribbean, Africa, the Middle East, and Europe outside the EU and EEA. Depending on applicable law, you may have rights to access or correct your personal data, request deletion, withdraw consent, object to certain processing, or complain to the relevant supervisory authority. The availability and scope of these rights vary by jurisdiction. You can contact us using the details below to exercise applicable rights.

We describe the purposes of processing, categories of data, disclosures, security, retention, overseas processing, and service-provider accountability in this Policy. We will handle privacy requests, notices, and complaints in accordance with applicable local law where it applies.

14. Children

HanziHeart is generally intended for people aged 13 or older, with a minimum age of 12 in Vietnam, the Republic of Korea and Brazil. HanziHeart is generally rated 13+ on the Apple App Store, with regional ratings of 12+ in Vietnam and the Republic of Korea, and A12 in Brazil. Users see the rating applicable to their country or region. These content ratings do not determine whether a person can independently consent to data processing or enter into an agreement. Any higher minimum age required by applicable law or the relevant app store applies.

If you meet the applicable minimum age but are under the age of legal adulthood in your country or region, a parent or legal guardian must review this Policy and be responsible for your use of the Service. Where applicable law requires parental or guardian consent or authorisation for your use of the Service or processing of your personal data, that requirement must also be met. We do not knowingly collect personal data from anyone below the applicable minimum age or knowingly use children’s personal data for marketing, advertising profiling, or cross-app tracking. If you believe someone below the applicable minimum age has provided personal data to HanziHeart, contact us using the details below so we can investigate and delete it where required.

15. Security and Breach Response

We use reasonable technical and organisational measures intended to protect personal data, including encryption in transit and controls restricting access to stored information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach, we will assess the likely risk, keep an internal record, work with relevant providers, and notify relevant regulators, authorities, app stores, and affected users where required by applicable law.

16. App Store and Platform Privacy Disclosures

Our app store and platform privacy disclosures (for example, on the Apple App Store and Google Play) describe the data we collect and how we use it and should be read together with this Policy. They may identify data types such as name, email address, user ID, device ID, purchase history, product interaction, and other user content where applicable, linked to your identity where associated with an account, subscription customer, or device/session identifier.

17. Cookies and Tracking Technologies

Our website pages may use essential cookies and similar technologies for security, session management, and basic analytics. We do not use cookies for cross-site behavioural advertising. See our Cookies Policy for more detail.

Most browsers let you refuse or delete cookies. Some browser settings may affect website functionality. We do not currently respond to browser "Do Not Track" signals, but we honour the choices and opt-out rights described in this Policy where applicable.

18. Third-Party Links and Services

The Service may link to third-party websites, app stores, support pages, payment flows, authentication providers, or other services. Those third parties are responsible for their own privacy practices. This Policy applies to HanziHeart’s collection and use of personal data, not to personal data you provide directly to third-party services.

19. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last updated" date above. Where required by law, we will take additional steps to notify you.

20. Contact

If you have privacy questions or want to exercise your rights, contact us using the details below.

Gladiolus Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England
ICO registration reference: ZC112773
Privacy: hanziheart-privacy@gladiolus.dev

EU representative (Article 27 GDPR)

FGND Core GmbH
Hauptstrasse 151, 10827 Berlin, Germany
Email: hanziheart@core-privacy.eu

This contact is for GDPR-related privacy matters and requests from EU supervisory authorities and individuals in the EU.

Support: hanziheart-support@gladiolus.dev