Tester App Privacy Policy

HeroTester programme | Version 1.0 | Effective date: 5 October 2026

1. Scope of this Policy

This Policy applies to the HeroSwipe app for testers and the HeroTester programme, including test or beta versions where they refer to this Policy. It covers account registration, profile completion, participation in tests, study matching, earning and redeeming points, notifications, communications with us, exercise of rights and account closure.

This Policy is not the complete privacy information for HeroSwipe business services, such as Hero A/B, Hero Content+ or other tools for business customers. Separate privacy information may apply to those services.

2. Data Controller and contact

The controller of the personal data described in this Policy is HEROSWIPE spółka z ograniczoną odpowiedzialnością, ul. Ignacego Mościckiego 1, 24-110 Puławy, Poland, KRS 0001184316, NIP 5214126072 ("HeroSwipe", "we", "us").

For privacy matters and requests concerning your rights, contact: [email protected]. For account deletion, you may use: [email protected].

If we appoint a Data Protection Officer or another dedicated contact point required by law, we will update this Policy and provide the relevant contact details.

3. Personal data we process

The scope of data depends on the features you use. Not all categories below are collected from every user.

Account and contact data

• email address, account identifier and data required for registration and login;
• name or profile name, if required or provided;
• country/region, language and information needed to determine programme availability and the applicable points programme;
• information related to account verification, security and handling of user requests.

Profile and demographic data

• answers to profile questions, including - depending on the form - age or age range, gender, location at country/region level and other demographic characteristics or preferences that you voluntarily provide;
• information used to match you with studies and interpret results within relevant consumer groups.

We process precise device geolocation only where a specific feature genuinely requires it, we request the appropriate permission and we explain the purpose before using it.

Test data and behavioural data

• choices between variants, answers to questions, opinions, comments, stated preferences or purchase intent;
• time and sequence of interactions, test completion status and other events needed to conduct a study, assess response quality and analyse behaviour in the test environment;
• derived information created from results, such as segments, quality indicators, behavioural features or aggregated statistics.

Points, rewards and referral programme

• points balance and the history of earning, expiry and redemption;
• selected reward, fulfilment status and data required to deliver it;
• if the referral feature is active - referral code or identifier and information confirming that the conditions for a referral bonus have been met.

We do not access your address book solely to operate an ordinary referral unless we separately inform you about such a feature and its legal basis.

Technical and security data

• IP address, device type, operating system, app version, device language, session and authentication identifiers, and information about errors, crashes and security events;
• access and activity logs necessary for operation of the app, abuse prevention and troubleshooting;
• if you enable push notifications - a token or equivalent identifier needed to deliver notifications through the relevant device notification system.

Correspondence and preferences

• content of messages sent to us, complaints, privacy requests, account-deletion requests and their status;
• notification settings, marketing consents and withdrawals, and evidence required to demonstrate compliance with law.

Special categories of data

As a standard part of the profile, we do not ask for special categories of personal data within the meaning of Article 9 GDPR, such as health data, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data, or information concerning sex life or sexual orientation. Do not provide such data in open-text fields unless a specific study expressly requests it and you first receive separate information about the purpose, legal basis and safeguards. If such data were required, we would use an appropriate legal basis under Article 9 GDPR, including explicit consent where required.

4. Where we obtain data from

• directly from you when you register, complete your profile, participate in tests, redeem rewards and contact us;
• automatically from the app and device while you use the services, to the extent necessary for operation, security, study quality and - where you give the required consent - optional analytics;
• from providers acting on our behalf, for example in connection with confirmation of message delivery, reward fulfilment, error handling or security;
• for referral programmes - from the referring or referred person, only to the extent needed to attribute the bonus.

5. Purposes and legal bases for processing

The GDPR requires each processing purpose to have an appropriate legal basis. The main purposes, uses and legal bases on which we rely are described below.

Purpose	How we use data	Legal basis
Registration and account management	Creating and maintaining the account, login, settings, provision of programme functions, service communications and account closure.	Article 6(1)(b) GDPR - performance of a contract
Participation in tests and study matching	Selecting tests based on profile and study criteria, recording responses, creating results and aggregated reports.	Article 6(1)(b) GDPR; additionally Article 6(1)(f) for quality analysis and research
Points and rewards	Awarding points, controlling thresholds, fulfilling redemptions, handling disputes and preventing duplicate awards.	Article 6(1)(b) GDPR; Article 6(1)(c) where required by law
Security and abuse prevention	Protecting accounts, detecting duplicate accounts, bots, manipulation, unreliable responses and security incidents.	Article 6(1)(f) GDPR - our legitimate interest in protecting the service, testers and customers
Development, training and improvement of AI/ML	Using responses, profile and behavioural data to develop, train, test, evaluate and improve HeroSwipe models, recommendations, study matching and analytics.	As a rule, Article 6(1)(f) GDPR - legitimate interest in developing and improving services, after assessing necessity and balancing interests; consent where required in a particular case
Notifications	Notifications about available tests, account changes, rewards and other service messages; marketing notifications only after obtaining required consent.	Article 6(1)(b) for service communications; Article 6(1)(a) for marketing
Optional app analytics	Measuring app use and feature effectiveness where we deploy tools not necessary for providing the service.	Article 6(1)(a) GDPR and required consent for access to/storage of information on terminal equipment
Rights, complaints and disputes	Verifying and handling requests, maintaining compliance records, establishing, exercising or defending legal claims.	Article 6(1)(c) GDPR and Article 6(1)(f) GDPR

Where we rely on legitimate interests, we assess the purpose, necessity of processing and the impact on your rights and freedoms. For AI/ML model development, we limit the data to what is needed for the relevant purpose and use pseudonymisation, aggregation or anonymisation where possible and appropriate.

6. Profiling, study matching and AI model development

Study matching may involve automated comparison of your profile data, demographic data, previous activity and the requirements of a particular study. This may constitute profiling within the meaning of the GDPR, but it is not intended to make decisions about you that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

We may also create quality indicators or risk signals to detect abuse. Restriction or closure of an account because of serious or repeated breaches is governed by the Terms; in the cases described there, you may request human review.

To develop and improve HeroSwipe, we may use test data, profile data and behavioural data to train, test, evaluate and improve artificial-intelligence and machine-learning models, recommendation systems, study-matching mechanisms and analytics tools. Where possible, we separate direct account identifiers from datasets used for model work and use pseudonymised, aggregated or anonymised data.

If data used for a model remains personal data in a given case, the GDPR continues to apply. The mere fact that data is used to train a model does not automatically make it anonymous. Where processing is based on our legitimate interests, you have the right to object. If your objection is effective, we will stop further use of the data for that purpose unless we demonstrate compelling legitimate grounds or the data is needed for legal claims.

When an account is deleted, we erase or anonymise data linked to the account in accordance with Section 10. Aggregated statistics, anonymous datasets or model parameters created earlier that no longer constitute personal data may continue to be used. If a particular model still contains personal data, the relevant GDPR rights continue to apply.

7. Who we disclose data to

Access to data is limited to persons and entities that need it for a specified purpose. Depending on the feature used, recipients may include:

• authorised HeroSwipe employees and contractors;
• providers of hosting, cloud services, databases, file storage, authentication, security and backups;
• email providers, support-ticket providers and technical push-notification infrastructure providers;
• error-monitoring, analytics and measurement providers - for optional tools, only after the relevant consent requirements have been met;
• reward and voucher fulfilment providers, such as Tremendous, where used for a particular reward; before confirming redemption, we show the relevant provider and reward conditions;
• AI/ML infrastructure or tool providers where they participate in processing data for the development or operation of HeroSwipe models, under appropriate contracts and instructions;
• legal advisers, accountants, auditors, insurers, public authorities and courts where disclosure is required or justified by law.

HeroSwipe business customers receive aggregated test results, statistics and appropriate demographic insights. We do not disclose direct tester identifiers such as an email address or login credentials to them. If, exceptionally, a specific project required a different scope of disclosure, we would inform you before you participate in that study and identify the relevant legal basis.

Processors act under data-processing agreements and our instructions. Where a provider acts as an independent controller, it is responsible for its own processing and the relevant information is provided in connection with that service.

8. Transfers outside the EEA

HeroSwipe is established in Poland, but some providers or their sub-processors may process data outside the European Economic Area (EEA), including through remote access to systems.

Where data is transferred to a third country, we use a mechanism compliant with Chapter V GDPR, such as a European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with supplementary measures where required. You can obtain information about safeguards relating to your data by contacting us at [email protected].

9. App technologies, device storage and marketing

The app may use information stored on your device or store information on your device for login, security, preserving settings and providing functions expressly requested by you. To the extent necessary to provide the service, the exceptions available under laws governing terminal equipment apply.

If we deploy optional analytics, advertising, measurement or other technologies that are not necessary for the app to function and that store information on, or access information from, your device, we will activate them only after obtaining the required consent. In Poland, the relevant rules arise, among other things, from Article 399 of the Electronic Communications Law.

Notifications about available tests and information necessary to operate your account are service communications. Direct marketing, promotions or other commercial information sent electronically require a separate legal basis and - where required - prior consent. Marketing consent is not a condition of participation in the HeroTester programme.

10. How long we keep data

We keep data only for as long as necessary for the relevant purpose and then delete or irreversibly anonymise it, unless law permits or requires us to retain specific information for longer.

Data type	Retention period or criterion
Account and profile data	For the duration of the agreement and account activity. After a valid account-closure request, the account is deactivated for 7 days (168 hours), after which data is deleted or anonymised without undue delay, except for data covered by a separate retention basis.
Responses and test data	For the period needed to conduct the study, settle points, perform analyses and operate the account. After permanent account deletion, we delete or anonymise data linked to the tester unless there is another valid legal basis for retention.
Data used in AI/ML development	Personal data in active model-development datasets is kept only as long as necessary for model development and evaluation and as permitted by the applicable legal basis. After account deletion or a successful objection, we remove it from active datasets or anonymise it where required by law. Anonymised data, aggregated statistics and model parameters that are not personal data may be kept for longer.
Points and reward fulfilment	For the period needed to maintain the balance, fulfil rewards and resolve disputes; records required by tax, accounting or other legal obligations are kept for the period required by applicable law.
Routine technical and security logs	As a rule, for up to 30 days after the event. Data relating to a specific incident, abuse case or dispute may be separated and retained longer to the extent needed to investigate or resolve it.
Backups	Deleted data may remain in restricted disaster-recovery backups until overwritten or securely expired, for no longer than 90 days after deletion from live systems, unless a specific record must be retained on a separate legal basis.
Marketing consents and objections	Active consent - until withdrawal or discontinuation of the relevant channel. We may retain a minimal record of an objection or consent withdrawal for longer so that unwanted communications are not resumed and to demonstrate compliance.
Requests, complaints and compliance evidence	For the duration of the matter and then, to a minimum extent, for the applicable limitation period for claims or another period required by law; longer if proceedings or a dispute are ongoing.

If restoring a backup causes data that was previously subject to a deletion request or objection to reappear, we reapply the relevant deletion or restriction instructions before returning the data to ordinary use.

11. Account deletion

You may request account deletion in the app or by emailing [email protected], preferably from the address linked to your account. You do not need to give a reason. If we have reasonable doubts about the identity of the account owner, we may request additional information necessary for verification.

After accepting the request and completing any necessary verification, we deactivate the account. The recovery period lasts 7 days (168 hours) from deactivation. We confirm the exact permanent-deletion deadline and time zone by email. During that period, you may cancel the request by writing to the same address. A valid cancellation received before the deadline stops permanent deletion.

After 7 days, the account is permanently deleted and cannot be reactivated. Personal data linked to it is erased or anonymised, except for data we must or may lawfully retain. Account deletion does not itself waive an existing claim concerning points, a reward or a refund.

The 7-day period is an account-recovery feature, not a deadline for exercising GDPR rights. You may request erasure of personal data independently of this procedure. Where the GDPR conditions are met, we act without undue delay; earlier erasure may make account recovery impossible.

12. Your rights

Subject to the conditions and limits set out in the GDPR, you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate data and complete incomplete data;
• erase data in the cases provided by law;
• restrict processing;
• data portability where processing is automated and based on consent or a contract;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• object to processing based on Article 6(1)(f) GDPR, including use of data for AI/ML model development;
• object unconditionally to direct marketing, including related profiling.

You may send a request to [email protected] or [email protected]. We respond without undue delay, as a rule within one month after receiving the request. For complex requests or where we receive many requests, the period may be extended by a further two months; we will inform you within the first month and explain the reason.

If we have reasonable doubts about your identity, we may ask only for additional information necessary to confirm it. Do not send us passwords, authentication codes or full payment-card details.

13. Complaint to a supervisory authority

You have the right to lodge a complaint with the competent data-protection authority, in particular in the EEA country of your habitual residence, place of work or place of the alleged infringement.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO), Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland. Current information on how to lodge a complaint is available on the official UODO website.

14. Data security

We use technical and organisational measures appropriate to the risk, including access controls, authentication, transmission safeguards, monitoring of security events, privilege restrictions and controlled retention. Where appropriate, we separate direct identifiers from research data or datasets used for analytics and model work. We assess providers for security and enter into required data-processing agreements.

No internet-based system can guarantee complete absence of risk. If a personal-data breach occurs, we apply our GDPR obligations, including risk assessment, incident documentation and - where required - notification of the supervisory authority and affected individuals.

15. Persons under 18

The HeroTester programme is intended for persons aged 18 or over. We do not intend knowingly to create accounts or maintain tester profiles for younger persons. If we learn that an account was created in breach of this requirement, we will take appropriate steps, including restricting or deleting the account and data to the extent required by law.

16. Changes to this Policy

We may update this Policy when the app, our processing activities, providers or legal requirements change. The current version states its effective date. We will notify you of material changes in an appropriate way, for example in the app or by email, and where new processing requires consent, we will request it before that processing begins.

Product development, including new types of AI models, new categories of data or new data sources, may require additional information or an updated legal basis. We do not treat continued use of the app by itself as consent to new processing where law requires explicit consent.

17. Contact

Privacy questions: [email protected].

Account deletion and cancellation of a deletion request: [email protected].

Postal address: HEROSWIPE sp. z o.o., ul. Ignacego Mościckiego 1, 24-110 Puławy, Poland.

HEROSWIPE sp. z o.o. · KRS 0001184316 · NIP 5214126072