Privacy policy

1. What we collect

• Account data: name, email address, username, password hash, or your Google profile basics.
• Content: images you upload, notes and descriptions you write, AI drafts, and the case studies and portfolio you publish.
• Billing data: plan, credit balance, and payment history. Stripe holds your card details; we never see the full number.
• Usage data: pages viewed, features used, device and browser type, approximate location from IP.
• Technical data: error reports and logs, which can include your IP address and account ID.
• Messages: emails you send to support.

2. How we use it, and our legal basis

3. AI processing

When you ask for a draft, we send your uploaded images and notes to Anthropic or OpenAI through their APIs. Under their API terms, these providers [CONFIRM: do not train models on API data and retain it for up to N days for abuse monitoring]. We do not use your content to train our own models. More detail is in the AI disclosure.

4. Who we share it with

We don't sell your personal data or share it for cross-context behavioral advertising. We use these service providers to run Storycase. Each processes data on our behalf under a contract.

We may also disclose data if the law requires it, or to a buyer if the business is sold, under the same protections.

Anything you publish is public. Anyone can see it, and search engines may index and cache it.

5. International transfers

Storycase is run from the United States and most of our providers store data there. If you are in the EU, UK or another region with transfer rules, we rely on [TRANSFER MECHANISM, e.g. EU Standard Contractual Clauses / EU-US Data Privacy Framework] for these transfers.

6. How long we keep it

• Account data and content: while your account is open.
• After you delete your account: a 7-day grace period in which you can restore it, then permanent deletion from our live systems. Backups roll off within [BACKUP RETENTION, e.g. 30 days].
• Billing records: [PERIOD REQUIRED FOR TAX, e.g. 7 years].
• Analytics data: [POSTHOG RETENTION].
• Error reports and logs: [SENTRY / LOG RETENTION, e.g. 90 days].

7. Your rights

Depending on where you live, you can:

• access the personal data we hold about you and get a copy;
• correct data that is wrong;
• delete your data (you can also delete your account yourself in settings);
• export your data in a portable format;
• object to or restrict processing based on legitimate interests;
• withdraw consent at any time, for example to marketing emails or analytics cookies.

EU and UK residents can also complain to their local data protection authority. [EU / UK REPRESENTATIVE, IF REQUIRED]

California residents have the right to know, delete and correct personal information, and to opt out of its sale or sharing. We don't sell or share it in that sense. We won't treat you differently for using these rights.

To make a request, email [PRIVACY CONTACT EMAIL] from the address on your account. We answer within 30 days, or sooner where the law requires.

8. Security

Data is encrypted in transit. We limit access to people who need it to run the service. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

9. Children

Storycase is not for children under [MINIMUM AGE]. If we learn we hold a child's data, we delete it.

10. Cookies

See the cookie notice.

11. Changes

We'll post changes here and update the date at the top. For material changes we'll email you first.