Privacy Policy

Last updated: October 19, 2026

This notice explains how HEROCOS uses personal information when you browse herocos.com, buy cosplay costumes or accessories, request a custom design, contact us or subscribe to our emails.

Who is responsible for your information?

HEROCOS is operated by 重庆嗨皮熊电子商务有限公司. We are responsible for the personal information used to run this store. Contact us at info@herocos.com.

Registered address: 3A-07, Floor 3, No. 85 Zhongshan 1st Road, Yuzhong District, Chongqing, China (D1-450). Chinese address: 重庆市渝中区中山一路85号3层3A-07，(D1-450)，中国。Unified Social Credit Code: 91500103MAEWH14K6F.

Information you give us

Orders and delivery: your name, email address, billing and delivery addresses, phone number when provided, selected products and options, order notes, requested delivery date, transaction references and order status. A requested delivery date is a preference, as explained at checkout.
Custom sizing: the body measurements, units and fit notes you enter for a Customized Size item are saved with that cart item and order. Provide only measurements needed for the costume; do not include medical information in the notes.
Custom design requests: your contact details, design description, chosen components, reference files, measurements, budget, requested dates and the confirmations you submit. A request also receives a project number and a record of its progress.
Accounts: your account name, email, password in protected form and profile or address information you choose to save. Guest checkout is available; subscribing to marketing emails is not required to buy.
Messages and reviews: information you send to customer support and information submitted with a review or comment. If a review or comment is published, its displayed name and content are public. Do not include order numbers, addresses or other private details in public reviews.
Online withdrawal notices: your name, the order reference you provide, receipt email, the whole order or items concerned, optional notes, the notice text and the time it is received. We use this record to acknowledge and handle your notice. The form does not require an account or automatically change an order or issue a refund.
Email subscriptions: your email address, confirmation and subscription status, relevant timestamps and the form or page used to subscribe.

If you provide someone else’s delivery details, measurements or reference photographs, make sure you are entitled to share them and tell that person how we use their information. For a child’s costume, a parent or guardian should place the order and provide only what is needed to fulfil it.

Information generated when you use the site

Our website and service providers process technical information such as IP address, browser and device information, requested pages, timestamps and errors to deliver the site, maintain your shopping session and help prevent misuse. A review or comment may also include technical information used for moderation.

If you allow optional analytics in our cookie settings, Google Analytics 4 and Jetpack Stats help us understand how public pages are used. Google Analytics receives page views, public product-view information, a cookie-based browser identifier, the referring website, and browser, device and approximate location information. Our integration removes query strings and fragments from the page address and sends only the referring website origin. It does not send the contents of forms, custom measurements, names, email addresses or customer order details. Google Analytics is limited to public catalog and guide pages and is not enabled for signed-in visitors.

Jetpack Stats can process page views, referring pages, browser and device information, IP address and approximate country information. Optional page-view tracking is disabled on the shopping bag, checkout, account and online withdrawal pages. WooCommerce visitor-shopping analytics and new order-attribution tracking remain disabled. This setup does not send purchase events to Google Analytics.

Why we use information

To respond to requests, prepare quotations, process purchases, arrange custom sizing or production, deliver orders and provide after-sales support.
To maintain an account you request and communicate about your orders or enquiries.
To keep business and transaction records, meet applicable obligations and deal with disputes or fraud.
To protect and maintain the website and improve it using optional analytics when allowed.
To send the marketing emails you choose to receive.

Where European or UK data protection law applies, order, account and enquiry processing is generally necessary to enter into or perform a contract. Required record keeping relies on applicable legal obligations. Security, abuse prevention and the handling of business disputes rely on our legitimate interests, balanced against your rights. Optional marketing emails and optional tracking rely on your consent. Information marked as required is needed to provide the relevant service; optional fields may be left blank.

Who receives information

Information is available to people and providers who need it for the relevant purpose. This can include our authorised store staff and technical support, costume production or fulfilment partners, shipping providers, payment providers, hosting and email services, and professional advisers or authorities where required. A maker may need your costume specifications and measurements; a carrier may need your name, address and contact information. We limit what is provided to the purpose being fulfilled.

The store runs on WordPress and WooCommerce and is hosted on an OVHcloud server. Zoho handles store email delivery and correspondence. The Newsletter plugin manages our subscription list on this website. Connected Jetpack services are provided by Automattic and support site security and related store services; optional visitor analytics are controlled through our cookie settings. Where Gravatar is used to display an avatar with a public review or comment, a hash of the email address may be sent to Automattic’s Gravatar service.

A payment option offered at checkout may require its provider to process payment, billing and fraud-prevention information under that provider’s own notice. Never send full payment-card details or account passwords to us by email. An installed integration by itself does not mean every feature of that service is used.

Google provides Google Analytics. You can read how Google uses information from sites that use its services. Google advertising signals and advertising personalization are disabled in this integration.

Cookies and your choices

Cookies and similar browser storage support the shopping bag, checkout, account sign-in, security and your privacy preferences. Blocking these necessary functions may prevent parts of the store from working.

Optional visitor analytics are off until you choose to allow them. You can accept or reject optional analytics and change your choice through the cookie settings control on this website. A first-party preference cookie remembers that choice for up to 180 days. Google Analytics cookies in this setup are configured for up to 180 days without extending their expiry on each visit. Rejecting or withdrawing optional analytics clears the known Google Analytics cookies from this site. A new statistics provider requires a fresh choice; previous choices are not silently carried over. A Global Privacy Control or Do Not Track signal takes priority and keeps optional analytics off. Withdrawing a choice stops future optional tracking; it does not undo information already processed. You can also clear cookies through your browser. Our cookie controls do not prevent technical processing that is necessary to deliver or secure the site.

Email updates

Email subscriptions use double confirmation: submitting the form starts a confirmation request, and you join the confirmed list only after using the confirmation link. Subscribing is optional. Use the unsubscribe link in an email or contact us to withdraw. We keep subscription and unsubscribe records so that we can manage your choice. In this subscription setup, email open and click tracking are disabled and the stored subscriber IP address is anonymised. See our email subscription notice.

International processing

HEROCOS operates in China and the store server is in the United States. Information may also be processed in locations used by our service providers or by a carrier along the delivery route. Privacy laws in those locations may differ from those where you live. Contact info@herocos.com for information about the providers and international processing relevant to your order or request.

How long information is kept

Retention depends on the purpose: completing an order or custom project, providing support, maintaining an active account, meeting record-keeping duties and handling possible claims. Subscription records are kept to manage consent and prevent unwanted re-subscription. Reviews may remain visible until removed. Backups and technical logs may retain information for their recovery and security purposes.

There is no single deletion period for all information. Closing an account or unsubscribing does not automatically erase transaction, consent or dispute records that still need to be retained. Contact us to request a review of the information held about you and its retention.

Your privacy rights

Depending on the law that applies, you may ask to access or obtain a copy of your information, correct inaccurate details, erase information, restrict its use or receive portable information. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Some requests have exceptions, including information we must keep for legal obligations or claims.

You may object to processing based on legitimate interests, and you may object to direct marketing at any time. To make a request, email info@herocos.com. We may ask for proportionate information to confirm your identity before disclosing or changing a record. Do not send a passport or other sensitive document unless a specific, necessary verification method has been agreed.

You can also raise a concern with your local data protection authority. In the UK, this is the Information Commissioner’s Office; in the EEA, contact the authority in your country of residence, work or the place of the concern.

Updates and contact

We update this notice when the store’s processing changes and show the revision date above. For privacy questions, contact info@herocos.com.