Privacy Policy

Effective 5/19/2026
Last Updated: 6/7/2026

This Privacy Policy describes the policies of Heron, LLC (“Heron,” “we,” “us,” or “our”) as they apply to the following services (collectively, the “Service”):

art and other websites owned or operated by Heron that link to this Privacy Policy (the “Site”);
all mobile applications that link to this Privacy Policy (the “Heron Apps”); and
all services made available by Heron through the Site and Heron Apps, including email communications sent outside the Site or Apps.

This Privacy Policy explains what personal data we collect, how we use and share it, and the choices you have regarding our data practices. We use technical, organizational, and physical safeguards designed to protect your personal data. However, no internet or information technology system is entirely secure, and we cannot guarantee the security of your personal data.

Please read this Privacy Policy before using the Service or submitting any personal data to Heron. If you have questions, contact us at support@heron.art.

1. INFORMATION WE COLLECT

When you contact us or interact with the Service, we collect information about you, including information that constitutes “personal data” or a similarly defined term under applicable laws (“Personal Data”), as described below.

1.1 Personal Data You Provide to Us

We collect Personal Data when you sign up for or use the Service. The specific data collected may vary based on how you use the Service, but may include:

Account Data. When you create an account, we collect information required to do so, such as your name and email address.
Payment Data. If you purchase a subscription, our third-party payment processors (Stripe or PayPal) collect and process payment and billing information, such as your billing zip code, payment card details, and authentication credentials, directly on our behalf. We do not collect or store your payment card information. Please review Stripe’s and PayPal’s privacy policies for information about how they protect payment data.
Social Media Data. If you interact with our pages on social media platforms (“Social Media Pages”), those platforms may provide us with aggregate analytics data about how our pages are used. We may also collect Personal Data you share or make available through our Social Media Pages.
User Content. Content you create and share through the Service, such as artwork, photographs, images, painting location information, event listings, community posts, reviews, and comments, along with associated metadata (including how, when, where, and by whom content was created or edited, and any tags or location information you add).
Event Listing Data. If you post an event through the Service, we collect the details you provide, such as event name, date, time, location, and organizer information. This information is subject to the event listing terms in our Terms of Use.
Additional Information. To customize your experience or enable certain features, you may optionally provide additional information such as your profile picture, location (city or region), and favorite painting activities or styles.
Sensitive Personal Data. If you enable location services on your mobile device or browser, you consent to our collection of your precise geolocation, which may be considered sensitive personal information under applicable law. You can withdraw this consent at any time by disabling location services on your device. You may also choose to share other sensitive information through content you post on the Service; by doing so, you consent to our collection of that information. We do not process sensitive Personal Data for purposes other than providing the Service.

1.2 Personal Data Generated by Your Use of the Service

When you visit, use, or interact with the Service, we may automatically generate or collect the following information:

Log Data. Information your browser or device automatically sends when you access the Site or Apps, including your IP address, browser type and settings, date and time of your request, and how you interacted with the Service.
Cookies Data. We use cookies and similar technologies to operate and administer the Service and gather usage information. Please see our Cookie Policy for more information about the technologies used and data collected. [Note: Cookie Policy to be published separately.]
Device Data. Information about the device you use to access the Service, including device model, operating system, and browser. We may also collect device data to estimate session duration and other activity metrics.
Usage and Activity Data. Information about how you use the Service, such as the types of content you view or engage with, features you use, actions you take, and the time, frequency, and duration of your sessions.
Geolocation Data. If you have enabled location services, we may collect geolocation information based on your IP address, city, state, zip code, country, or GPS coordinates. We use geolocation data to suggest nearby painting locations, events, and other relevant content. We do not process geolocation data without your permission.
We may combine data we collect to draw inferences about your preferences and interests, such as painting styles you may enjoy or locations and events that may be relevant to you, in order to personalize the Service.

1.3 Personal Data We Receive from Third Parties

If you choose to log in to the Service using a third-party account (such as Facebook, Google, or Apple), we may receive information from that service, such as your account name, profile photo, and other information you have made available based on your settings with that third party. You can stop sharing that information by removing our access through the third-party platform’s settings. We may also receive Personal Data from service providers, marketing partners, and event co-sponsors.

2. PRIVACY SETTINGS AND DEFAULTS

When you create a Heron account, your profile and the content you add are set to “Public” by default. This means other users and visitors may be able to view your profile, artwork, and activity. You can change these defaults at any time in your Account Settings.

We encourage you to review your privacy settings before posting content, particularly artwork or location data you wish to keep private. Once content is public, it may be seen, copied, or shared by others, and Heron cannot control how third parties use content they have already accessed.

3. HOW WE USE PERSONAL DATA

We use your Personal Data for the purposes described below. If we need to use your Personal Data for a new or unrelated purpose, we will update this Privacy Policy to explain that use.

Where required by applicable law (including in the EEA and UK), we rely on one or more of the following legal bases to process your Personal Data:

Contractual Necessity — processing required to deliver the Service or perform our contractual obligations to you.
Legitimate Interests — processing necessary for our legitimate business interests, where those interests are not overridden by your rights.
Compliance with Law — processing required to meet our legal or regulatory obligations.
Consent — processing carried out with your specific consent.

The table below sets out the specific purposes for which we use your Personal Data and the legal bases we rely on:

Purpose	Categories of Personal Data	Legal Basis
Account creation	• Account Data	• Contractual Necessity
Service delivery	• Account Data • Social Media Data • User Content • Event Listing Data • Additional Information • Sensitive Personal Data • Data from Third Parties	• Contractual Necessity • Legitimate Interests — ensuring the security and proper operation of our Service and systems
Event listings	• Account Data • Event Listing Data • Geolocation Data	• Contractual Necessity • Legitimate Interests — facilitating the plein air painting community and connecting users with events
Live Share / Lifeline Functionality	• Account Data • Geolocation Data • Additional Information	• Consent
Payment processing	• Account Data • Payment Data	• Contractual Necessity
Customer support	• Any and all data types as relevant	• Contractual Necessity • Legitimate Interests — providing a good Service experience, including responsive support
Service improvement	• Any and all data types as relevant	• Legitimate Interests — analyzing Service use to improve it over time and grow our business • Consent — with respect to optional cookies used for this purpose
Fraud prevention and security	• Account Data • Payment Data • User Content • Log Data • Cookies Data • Device Data • Usage and Activity Data	• Legitimate Interests — protecting the integrity of our Service by detecting, preventing, and mitigating fraud, data breaches, and security threats
Legal compliance	• Any and all data types as relevant	• Compliance with Law • Legitimate Interests — participating in and supporting legal processes; protecting our rights, property, and safety
Interest-based advertising	• Cookies Data • Device Data • Usage and Activity Data • Geolocation Data	• Consent

3.1 Email Marketing

Where you have provided consent, we may contact you with promotional information about our products and services. You may opt out of marketing emails at any time by clicking “Unsubscribe” in any marketing communication or by contacting us at support@heron.art. If you opt out, you will no longer receive marketing emails but may continue to receive Service-related and transactional communications.

3.2 Marketing Use of Your Content and Profile

As described in our Terms of Use (Section 3.4), by uploading content to Heron, you grant us the right to use your name, username, profile, and submitted content in promotional and marketing materials, including on our website, apps, social media, and in press materials. If you do not wish your content or identity to be used for marketing purposes, you may opt out at any time by contacting us at support@heron.art. Opting out of marketing use does not affect our right to use your content to operate and deliver the Service.

4. HOW WE SHARE AND DISCLOSE PERSONAL DATA

We may share your Personal Data with third parties in the following circumstances:

Other companies in our corporate group may help us deliver the Service.
Vendors and Service Providers. We share Personal Data with third-party service providers that assist us with hosting, cloud services, email communications, data analytics, customer relationship management, security, and marketing. These providers access and process Personal Data only as directed by us and in accordance with our agreements with them.
Payment Processors. Users who purchase a subscription provide payment data directly to our payment processors (Stripe or PayPal) as part of the checkout process.
Other Users. Your profile, User Content, and event listings may be visible to other users of the Service, depending on your privacy settings. Content you make public may be seen, copied, or shared by others, including being indexed by search engines. We are not responsible for how others use publicly available Personal Data.
Business Transfers. If Heron is involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your Personal Data may be shared with counterparties during due diligence and transferred to a successor entity as part of that transaction.
Legal Requirements. We may disclose Personal Data to law enforcement, government authorities, or private parties when required by law or in good faith belief that disclosure is necessary to: (a) comply with legal or regulatory obligations; (b) protect and defend our rights or property; (c) prevent fraud; (d) protect the safety of users or the public; or (e) protect against legal liability.
Advertising Partners. We may share certain data with third-party advertising companies for interest-based advertising purposes, as described in Section 3 above and subject to your consent where required.

5. YOUR PRIVACY CHOICES AND RIGHTS

5.1 General Rights

Depending on where you reside and applicable law, you may have certain rights to access, correct, restrict, object to, or obtain a copy of your Personal Data, or to withdraw consent for our processing of it. To exercise any of these rights, contact us at support@heron.art.

5.2 U.S. Privacy Rights

The disclosures in this section apply to the extent Heron processes your Personal Data subject to U.S. state consumer privacy laws, such as the California Consumer Privacy Act (“CPA”) and similar state laws.

Categories of Personal Data Collected (last 12 months):

Identifiers such as name, email address, and contact information
Commercial information such as transaction and subscription history
Device, usage, and internet or network activity information
Online identifiers such as Log Data, Cookies Data, and Usage and Activity Data
Geolocation data
Visual information you choose to share, including artwork and photographs
Sensitive Personal Data such as precise geolocation, as voluntarily disclosed by you
Inferences about your preferences and interests derived from data we collect

Categories of Personal Data Disclosed for Business Purposes (last 12 months): We have disclosed all of the categories listed above to the categories of third parties described in Section 4 of this Privacy Policy.

Your U.S. Privacy Rights may include:

Right to Know. The categories of Personal Data collected, the purposes for collection, the sources from which it was collected, whether it has been disclosed and to whom.
Right to Access. The specific pieces of Personal Data we have collected about you.
Right to Correct. Inaccurate Personal Data we hold about you.
Right to Delete. Your Personal Data, subject to certain exceptions.
Right to Be Free from Discrimination. We will not discriminate against you for exercising your privacy rights.
Right to Opt-Out of Targeted Advertising. You may opt out of certain processing of your Personal Data for targeted advertising purposes using a GPC signal (see Section 5.4), by clicking “Manage Cookies” at the bottom of our homepage, or by contacting support@heron.art.
Right to Opt-Out of Profiling. You may opt out of automated profiling that produces legal or similarly significant effects. Note that we do not currently engage in profiling that produces such effects.

To make a U.S. privacy rights request, contact us at support@heron.art. We will verify your identity via email authentication before processing your request. Under some state laws, an authorized agent may submit a request on your behalf with appropriate documentation (such as a power of attorney or written authorization).

5.3 EEA and UK Privacy Rights

If you are located in the European Economic Area or the United Kingdom, you have the following rights under applicable data protection law:

Right of Access. You may ask us to confirm whether we are processing your Personal Data and request a copy of it.
Right to Rectification. If your Personal Data is inaccurate or incomplete, you may ask us to correct or complete it.
Right to Erasure. You may ask us to delete your Personal Data, such as where you withdraw consent or where we no longer have a lawful basis to retain it.
Right to Restrict Processing. You may ask us to restrict processing of your Personal Data in certain circumstances.
Right to Data Portability. You may request a copy of your Personal Data in a structured, machine-readable format.
Right to Object. You may ask us to stop processing your Personal Data where we rely on Legitimate Interests as our legal basis, unless we can demonstrate compelling grounds that override your rights. You may also object to processing for direct marketing at any time.
Right to Withdraw Consent. Where we process your Personal Data based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
Right to Lodge a Complaint. You may report concerns about our privacy practices to your local data protection authority.

We aim to respond to all legitimate requests within one month. Complex or multiple requests may take longer; we will notify you if this is the case. We do not typically charge a fee to exercise your rights, but may do so if a request is clearly unfounded, repetitive, or excessive.

To exercise your EEA or UK rights, contact us at support@heron.art or click “Make a Privacy Request” in the Service.

5.4 Global Privacy Controls and Do Not Track

Our Site honors Global Privacy Control (“GPC”) opt-out signals. If your browser transmits a GPC signal, we will opt that browser out of cookies on our website that result in a “sale” or “sharing” of your Personal Data. To use a GPC-enabled browser, visit globalprivacycontrol.org. You will need to enable GPC separately for each browser or extension you use.

Our Site does not currently respond to “Do Not Track” (“DNT”) signals. For more information about DNT, visit allaboutdnt.com.

6. CHILDREN’S PRIVACY

Heron’s Service is designed for adults and is not directed to children. The following age thresholds apply:

Account creation requires you to be at least 18 years of age, or the age of majority in your jurisdiction, consistent with our Terms of Use.
In the EEA and UK, we do not knowingly collect Personal Data from individuals under 16 without verifiable parental or guardian consent, as required by applicable law (including the GDPR and UK GDPR).
We do not knowingly collect Personal Data from children under 13 in the United States and do not have actual knowledge that we sell or share the Personal Data of children under 13, consistent with the Children’s Online Privacy Protection Act (COPPA).

If you believe a child under the applicable age threshold has provided us with Personal Data without required consent, please contact us at support@heron.art. We will take steps to delete that information as required by applicable law.

7. DATA RETENTION

We retain your Personal Data for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including to comply with legal, tax, accounting, or other obligations.

To determine the appropriate retention period, we consider: the amount, nature, and sensitivity of the Personal Data; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process it and whether those purposes can be achieved by other means; and applicable legal requirements.

If you delete your account, we will remove your profile and publicly posted content from view within a reasonable period. We may retain copies of your data for up to 90 days for backup and operational continuity purposes, and for longer periods where required by law or to resolve disputes or enforce our agreements. Artwork and other User Content you have posted will no longer be publicly accessible after account deletion, subject to content that has already been shared or cached by third parties.

How to Request Deletion. For full details of your rights to request deletion of your account and Personal Data, the data categories that will be deleted, what we are required to retain and why, and the timelines that apply, please see our User Data Deletion Policy at heron.art/delete-account. That policy also covers your rights under the GDPR right to erasure (Article 17), CCPA, and Apple App Store and Google Play deletion requirements.

8. INTERNATIONAL DATA TRANSFERS

Heron is based in the United States. If you access the Service from outside the United States, your Personal Data will be transferred to and processed in the United States, which may have data protection laws that are less stringent than those in your country of residence. We also work with vendors and service providers that may be located in other countries.

When we transfer Personal Data internationally, we endeavor to implement appropriate safeguards to protect it. If you would like more information about those safeguards, contact us at support@heron.art.

9. LINKS TO OTHER WEBSITES

The Site and Heron Apps may contain links to or advertisements for third-party websites, products, or services not operated or controlled by Heron, including Social Media Sites. Information you share with those third parties is governed by their own privacy policies, not this Privacy Policy. We do not endorse or review linked sites, and we encourage you to review the privacy practices of any third-party site you visit.

10. SECURITY

We use technical, organizational, and physical safeguards designed to protect your Personal Data from unauthorized access, use, disclosure, alteration, or destruction. However, no security system is impenetrable, and we cannot guarantee the complete security of your Personal Data. If you believe your account has been compromised, please contact us immediately at support@heron.art.

11. CHANGES TO THIS PRIVACY POLICY

We may revise this Privacy Policy from time to time. When we make material changes, we will update the “Last Revised” date at the top of this page and, where appropriate, notify you through the Service or by email. Your continued use of the Service after any change constitutes your acknowledgment of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

12. CONTACT US

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Heron, LLC

11 Wellington St., Bristol, TN 37620

Email: support@heron.art

For EEA and UK privacy rights requests: support@heron.art

For U.S. privacy rights requests: support@heron.art

For DMCA / copyright concerns: support@heron.art (subject line: DMCA)

For data deletion and account deletion requests: heron.art/delete-account or support@heron.art (subject line: Data Deletion Request)

Effective 5/19/2026Last Updated: 6/7/2026