Last updated 19 September 2026

Privacy notice

Plain language, because you will actually read it. This notice covers the people who use MyHero and the people whose details arrive through their forms.

In one paragraphMyHero stores the leads you collect, uses AI to summarise and score them and to draft your reply, and emails them to you. We do not sell personal information, we do not run advertising, and we do not use your leads to train AI models. You can export or delete everything at any time. The realtor or company whose form a person fills in is responsible for that person's information under BC and Canadian privacy law; MyHero processes it for them as a service provider.

1. Who we are

MyHero is operated by Thumpy Marketing, Vancouver, British Columbia ("MyHero", "we"). Questions, access requests and complaints go to hello@myherohq.com. Our privacy officer answers from that address.

2. Two kinds of people this notice covers

Account holders: the realtor, sales team or developer who signs in to MyHero.
Leads: people who fill in an account holder's form, message their portal, or are otherwise added to their MyHero account.

If you are a lead, the account holder is the organization responsible for your information under the Personal Information Protection Act (British Columbia) and the Personal Information Protection and Electronic Documents Act (Canada). MyHero processes it on their instructions. You can contact them directly, or write to us and we will pass the request on and help fulfil it.

3. What we collect

From account holders: your name and email; the identifier your sign-in provider gives us (Google or Apple) or a one-time code sent to your email; the business details you add (brokerage, area, phone, how you like to write); your plan; and the leads and settings in your account.

From leads: whatever the form collects, typically name, email, phone and a message; the consent line exactly as it was shown, recorded word for word; the page the form was on; the time; and the network address it was sent from, which we keep to stop abuse.

Generated by the service: the AI summary, score, segment and drafted reply for each lead; and technical logs (requests, errors, timings) that we keep for 90 days.

We do not collect payment card details ourselves; paid plans are invoiced or billed through a payment provider that handles card data under its own notice.

4. Why we use it

To run the service: store leads, show them in your app, send you sign-in codes and lead notifications.
To enrich leads: the details a lead submits are sent to our AI provider to produce the summary, score and draft you see. Nothing else is sent, and the provider does not use it to train models.
To protect the service: rate limits, abuse detection, security investigations.
To improve the service, using aggregated numbers that do not identify anyone.
To meet legal obligations, and to enforce our terms.

We do not sell personal information, share it with advertisers, or use it for our own marketing to leads.

5. Who else touches it

We use a small number of service providers, each bound by contract to protect the data and to use it only to provide their service to us:

Cloudflare: hosting, storage and delivery of the app and the API.
Anthropic: the AI that produces summaries, scores and drafts. Lead details are sent for processing and are not used to train its models.
Brevo: sending sign-in codes and lead notification emails.
Google and Apple: sign-in, when you choose them. They share your email, name and a stable identifier with us and nothing about your leads.

Hosted plans connect services you hold in your own name (for example Twilio for texting, DocuSeal for e-signature, Stripe for identity verification). Those run under your accounts and their notices.

Where data is stored. Our providers store and process data in Canada, the United States and other countries where they operate. Information outside Canada may be accessible to the authorities of those countries under their laws. Where the law requires it, the account holder is responsible for telling leads about this, and this notice serves as our notice to you.

6. If you hold an account, this part is yours

You are responsible for collecting leads lawfully: a real reason, a consent line people can understand, and honouring anyone who asks you to stop. MyHero records the consent line word for word so you can show it later.
Canada's anti-spam law (CASL) applies to messages you send. MyHero uses AI to write replies and follow-up emails. A reply goes out only when you send it. The exception is a follow-up sequence you switch on: it sends on the schedule you set, only to people who agreed to hear from you, and you can pause it at any time.
When a lead asks to see or delete their information, you can remove them in the app with one tap, and you can export everything as a spreadsheet.
Do not put in MyHero anything you are not allowed to hold: government ID numbers, financial account numbers, health details. The service is for contact details and notes.

7. How long we keep it

Account and leads: for as long as the account exists. When you delete a lead or your account, it is removed at once from the live service. Copies in our automatic backups are overwritten as those backups expire.
Sign-in codes and links: 15 minutes. Sessions: 30 days, or until you sign out.
Technical logs: 90 days.
Records we must keep by law (for example invoices): as long as the law requires.

8. Your rights

You can ask to see the personal information we hold about you, ask us to correct it, take a copy, or have it deleted. Account holders can do all of this in the app. Leads can contact the account holder or write to us; we answer within 30 days and we do not charge for it. If we cannot do what you ask, we will tell you why.

9. How we protect it

Everything travels over encrypted connections. Sign-in tokens are stored hashed, so a copy of our database does not sign anyone in. Access to production systems is limited to the people who run the service. Client sites never hold our AI credentials. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner as the law requires.

10. Cookies and local storage

The app keeps one thing in your browser: your sign-in session. There are no advertising cookies and no third-party analytics on the app. The marketing site at myherohq.com uses no tracking cookies either.

11. Children

MyHero is a business tool for licensed professionals. It is not directed at anyone under 19, and we do not knowingly hold their information.

12. Changes and complaints

If this notice changes in a way that matters, we will email account holders before the change takes effect and update the date at the top. If you are not satisfied with how we handled a request, you can contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.