Privacy Policy

1. Who We Are

Hearlo is developed and operated by Asteroid S.L., a company incorporated and registered in Spain.

Asteroid S.L. is the data controller for personal data collected through the Hearlo application. This privacy policy is governed by the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Spain's Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).

Our operational partner, ASTECH S.A.S. (Argentina), may provide development and support services under the direction of Asteroid S.L. and is bound by a Data Processing Agreement.

2. What Data We Collect

2.1 If You Do Not Register (No Account)

You can use Hearlo's full accessibility features — transcription, text-to-speech, translation, pictograms — without creating an account and without providing any personal data. We designed it this way on purpose.

For unregistered users, we do not collect any personally identifiable information. We may collect anonymised, device-level analytics (such as feature usage counts or crash reports) that cannot be linked to any individual.

2.2 If You Choose to Register (Optional)

If you decide to create an account for a more personalised experience, we collect:

3. How We Use Your Data

We use your personal data only to:

• Provide and personalise the Hearlo accessibility service based on your preferences.
• Maintain, improve, and secure the application.
• Send device-level push notifications about service updates (these are per-device and not linked to your email or personal identity).
• Generate aggregated, anonymised usage statistics for our enterprise clients (see Section 6).

4. What We Do NOT Do

5. Legal Basis for Processing

Under GDPR, every processing activity requires a lawful basis. Here is ours:

6. Enterprise Clients (Hearlo for Business)

Organisations such as airlines, public institutions, and businesses use Hearlo for Business to offer accessibility services to their customers and staff. These enterprise clients can access a dashboard showing:

• How many people used Hearlo through their service
• Which features were most used
• General location and language data

This data is always aggregated and anonymised. Enterprise clients never see your name, email, conversations, or any individual-level data. They cannot identify you.

7. Who We Share Data With

We share personal data only in the following limited circumstances:

• Service providers (sub-processors): We use third-party providers for infrastructure, hosting, and technical services. All are bound by Data Processing Agreements requiring equivalent data protection standards (GDPR Art. 28).
• ASTECH S.A.S. (Argentina): Our operational partner provides development services under Asteroid S.L.'s instructions and a formal DPA. Argentina benefits from an EU adequacy decision (Decision 2003/490/EC).
• Legal obligations: We may disclose data if required by law, regulation, or court order.

We maintain a list of sub-processors, available upon request at privacy@asteroidtechs.com.

8. International Data Transfers

Asteroid S.L. is based in Madrid, Spain, within the European Economic Area (EEA). When data is transferred outside the EEA, we ensure appropriate safeguards:

• Argentina: The European Commission has recognised Argentina as providing adequate data protection (Decision 2003/490/EC).
• United Kingdom: Covered by the European Commission's adequacy decision for the UK (Decision 2021/1772).
• Other countries: Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical measures.

All international transfers are protected by encryption in transit and at rest.

9. How Long We Keep Your Data

When you delete your account, all associated personal data is permanently deleted within the 30-day grace period. In accordance with LOPDGDD Article 32, certain data may be blocked (rather than deleted) during periods where legal retention obligations apply.

10. Security

We implement technical and organisational measures to protect your data, including:

• Encryption at rest and in transit (TLS 1.2+ / AES-256).
• Role-based access control and the principle of least privilege.
• Immutable backups (WORM protection) to prevent tampering or accidental deletion.
• Regular security audits and vulnerability assessments.
• Incident response procedures and disaster recovery plans.

While no system is 100% secure, we take every reasonable precaution to protect your information.

11. Your Rights

Under GDPR and LOPDGDD, you have the following rights:

To exercise any of these rights, contact us at privacy@asteroidtechs.com. We will respond within one month as required by GDPR.

You also have the right to lodge a complaint with a supervisory authority:

• Spain: Agencia Española de Protección de Datos (AEPD) — www.aepd.es
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• Other EU countries: Your local data protection authority.

12. Children and Minors

Hearlo is an accessibility tool that may benefit users of all ages, including minors with disabilities. In accordance with LOPDGDD Article 7, the age of digital consent in Spain is 14 years.

Since Hearlo works fully without an account, minors can use the app without providing any personal data. If a user under 14 wishes to register, we require verified parental or guardian consent before proceeding.

If we become aware that we have collected personal data from a child under 14 without appropriate consent, we will delete that data promptly.

13. Cookies and Device Analytics

The Hearlo mobile application does not use cookies. We may collect anonymised, device-level analytics through third-party services (such as crash reporting tools) that help us improve the app. These services may use device identifiers but we do not use them to identify you personally.

For details on third-party service providers, see our sub-processor list available upon request.

14. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where changes are material, notify you through the app or by other appropriate means.

We encourage you to review this policy periodically.