Privacy Policy

This policy explains how HiroPost handles personal data when you use the HiroPost storefront and buy from us. We are the controller of that data. Payments run on Whop and support conversations take place in our Whop support chat; Whop processes that data under its own privacy policy. We describe below exactly what passes through Whop and our other providers.

We keep data collection to what an order needs:

• Order details: the products, quantities, totals, order reference and timestamps.
• Contact details: the email address you enter at checkout, used for the order confirmation and your private order link.
• Account details: your email, the name you give us, a hashed password if you set one, sign-in times and password-link requests.
• Payment confirmation from Whop: the payment reference, the amount Whop confirmed, and the Whop user id, name and email address attached to the payment. We never receive full card numbers or wallet credentials.
• Support conversations: messages you exchange with us in our Whop support chat, including any screenshots you send.
• Delivered codes: the codes assigned to your order, stored encrypted so we can show them to you again and resolve problems.
• Reviews: the star rating, text and display name you choose to publish, linked to your order.
• Technical data: the IP address and browser identifier of the device that placed the order and of the device that first revealed each code, stored with the order record, plus standard web server logs (IP address, browser type, pages requested) kept for security and troubleshooting.

Your cart (product ids and quantities) is stored in your browser’s local storage so it survives a page refresh. Order previews created at checkout are stored in session storage and disappear when the tab is closed. This data stays on your device and is not sent to us until you place an order.

We use Google Analytics for Firebase to understand how the storefront is used: pages viewed, device and browser type, and approximate location derived from your IP address. It sets its own cookies and identifiers, and Google processes this data as our service provider. We do not use it for advertising. You can prevent it with your browser’s tracking-protection settings or a content blocker; the storefront works normally without it.

Whop’s measurement script (the “Whop Pixel”) also runs on the storefront so that Whop, our payment processor, can connect a purchase to the visit that led to it and report on how the store performs. It records page views and funnel steps — product views, searches, cart and checkout activity, support-chat clicks and account set-up — together with a browser identifier and device characteristics. When you start a checkout or set up your account it also receives the email address you entered, which Whop receives anyway when it processes your payment. A content blocker stops it without affecting the store.

Your private order link is not stored by the website; it lives only in the address bar while you view the page and in your confirmation email.

We rely on the following legal bases: performing our contract with you (taking, delivering and supporting your order); our legitimate interests in preventing fraud, defending disputes and improving the storefront, balanced against your rights; legal obligations such as accounting and tax rules; and, where the law requires it for analytics, your consent.

We use the data above to:

• process and deliver your order, send the order confirmation and your private order link;
• tell you about the status of your order (delivery, holds, refunds) — these messages are part of the service, not marketing;
• provide support and resolve delivery problems;
• detect and prevent fraud, abuse and payment disputes;
• keep accounting and tax records as required by law;
• publish the reviews you choose to post.

We do not sell personal data. We share it only with:

• Whop, which processes payments and hosts our Whop support chat;
• suppliers of the digital products, only where resolving a faulty code genuinely requires it and only the minimum needed;
• Google (Firebase Hosting and Google Analytics for Firebase), which hosts the storefront and measures its usage;
• Resend, which sends our order emails;
• Railway, which hosts our order system and database;
• authorities or courts when we are legally required to.

Whop, Google, Resend and Railway are based in the United States, so your data is transferred there. Where your country’s law requires it, these transfers rely on the providers’ standard contractual clauses or an equivalent recognised safeguard.

Order records, including the codes delivered, are kept for seven years to meet accounting rules and to defend against payment disputes. Accounts are kept while you have orders; you can ask us to delete your account, in which case we keep only the order records the law requires. Reviews stay published until you ask us to remove them or the product is withdrawn, after which the text is deleted and only anonymous statistics remain. Server and webhook logs are deleted after 30 days. The IP address and browser identifier stored with an order are part of that order record. Email delivery records are kept by our email provider for the period in its own policy.

Depending on where you live you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, and to receive a copy in a portable format. You may also complain to your local data protection authority.

To exercise these rights, contact us in our Whop support chat or by replying to an order email. We may ask you to confirm your identity first.

The storefront is served over HTTPS and holds no payment credentials. Codes are stored encrypted on our server and are shown only on the private order page reached through your order link.

The storefront is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has placed an order, contact us and we will delete the data.

We may update this policy as the storefront evolves. The date at the top shows when it was last changed.