Consumer Data & Privacy Policy

This policy explains what data Hero collects, how it is protected, and the choices you have. Hero is operated by Harley Darby Consulting HDC Limited ("we", "us") in Papua New Guinea.

What we collect

Account data: organisation name, your name, username, email address and a securely hashed password. Business data you enter: contacts, invoices, quotes, bills, bank statement lines, payroll and related records — this data belongs to you. Technical data: login timestamps and IP addresses (for security rate-limiting), and lightweight product usage (page paths only). We do not use advertising trackers and we never sell data to anyone.

Card and payment data

We never see or store your card number. Payments are processed entirely by our PCI-DSS-compliant payment providers on their own secure pages; Hero receives only a confirmation that payment succeeded, the plan purchased, and a provider reference.

How your data is protected

All traffic is encrypted in transit (TLS/HTTPS). Sensitive financial fields — amounts, descriptions, tax and bank account numbers — are additionally encrypted at the application level with AES-256 keys that we control, on top of the storage provider's own at-rest encryption. Access requires a password plus two-factor authentication. Each customer organisation's records are strictly isolated from every other organisation's.

Where data is stored

Data is hosted on Cloudflare's infrastructure in Sydney, Australia, chosen for proximity and reliability for Pacific customers. Encrypted backups follow the same protections.

Who can access it

Only users you invite to your organisation, and — strictly for support or legal compliance — authorised HDC personnel. We disclose data to third parties only when required by Papua New Guinea law.

Your rights

You may access and correct your data in the app at any time, request a copy of your organisation's data, or request deletion after closing your account (subject to statutory record-keeping periods that may apply to accounting records). Email support@pngcloud.xyz to exercise these rights; we respond within 5 business days.

Retention

Active account data is retained while your subscription is active and for 90 days after cancellation. Security logs are kept for 12 months and product analytics for 90 days, then deleted automatically.

Changes and contact

We will note material changes to this policy on this page. Questions: support@pngcloud.xyz.