Privacy Policy

1. Who Is Responsible for Your Data

The data controller for your personal data is:

Future note: When Storyveo converts to a Czech s.r.o. or Delaware corporation, this section will be updated to reflect the company entity as data controller. You will be notified of any such change.

2. What Data We Collect

2.1 Data collected from all visitors (no account required)

• Usage and analytics data via PostHog: pages visited, clicks, scroll depth, session duration, device type, browser, approximate geographic region derived from IP address.
• Cookie data: see Section 5 for full details.
• Technical data: IP address (anonymised where possible), referrer URL, browser type and version.

2.2 Data collected when you create an account (coming soon)

Account registration is not yet available. This section describes data that will be collected once the feature launches.

• Email address (used to identify your account and communicate with you).
• Password (stored in hashed, encrypted form — we never store your password in plain text).
• Display name (optional, chosen by you).
• Account activity: tips made, notification preferences, saved series.

2.3 Data collected when you tip a creator (coming soon)

Tipping is not yet available. This section describes data that will be collected once the feature launches.

• Payment data: processed entirely by Stripe. Storyveo does not store your card number, bank details, or full payment credentials. We receive only a transaction reference and status from Stripe.
• Tip amount and the creator or series you tipped.
• Transaction timestamps.

2.4 Notification email opt-in

If you voluntarily submit your email address via the notification opt-in form on Storyveo, we collect:

• Your email address.
• The date and time you opted in.

We use this solely to send you platform updates and notifications about new content on Storyveo. We do not use it for marketing unrelated to Storyveo, and we do not share it with any third party. You can withdraw your consent and unsubscribe at any time by emailing tom@storyveo.ai with the subject ‘Unsubscribe’.

2.5 Data you send us voluntarily

• Any information you include in emails or contact messages sent to Storyveo.

3. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Legitimate interests (Article 6(1)(f)): Analytics via PostHog to understand how the platform is used and improve it. We have balanced this against your interests and determined that privacy-respecting analytics constitute a legitimate interest.
• Consent (Article 6(1)(a)): Non-essential cookies and tracking where you have given explicit consent via our cookie banner; email address collection via the notification opt-in form.
• Contract performance (Article 6(1)(b)): Processing your account data and payment-related data to provide the services you have signed up for (applicable once accounts and tipping are live).
• Legal obligation (Article 6(1)(c)): Where processing is required by applicable Czech or EU law (e.g. tax and accounting obligations in relation to payments).

4. How We Use Your Data

• To operate and improve the Storyveo platform and user experience.
• To understand how users discover and interact with AI films and series.
• To send account-related communications (password resets, notification emails — account holders only).
• To process tips and manage creator payouts (once tipping is live).
• To comply with legal and tax obligations.
• To detect and prevent fraud, abuse, or misuse of the platform.

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Cookies and Similar Technologies

Storyveo uses cookies and similar tracking technologies. Our cookie banner allows you to accept or decline non-essential cookies.

Strictly necessary cookies

These are required for the platform to function. They cannot be disabled.

• Session cookies: maintain your browsing session.
• Cookie consent state: remembers your cookie preferences.

Analytics cookies

Set by PostHog. Only set with your consent.

• PostHog tracking cookies: session identification, page view tracking, event data.
• Data is processed by PostHog Inc. (US-based). See Section 7 for information on international transfers.

Functional cookies (coming soon)

• Login session cookies: keep you logged in when accounts are available.

Payment cookies (coming soon)

• Stripe may set cookies during payment flows. These are governed by Stripe's own privacy policy.

To manage your cookie preferences at any time, use the cookie settings option in our footer or banner. You can also control cookies through your browser settings, though this may affect platform functionality.

6. Who We Share Your Data With

We share your data only with trusted third-party service providers (data processors) who act on our instructions and are bound by appropriate data processing agreements:

• PostHog Inc. — analytics platform. Data may be processed in the United States.
• Stripe Inc. — payment processing (once tipping is live). Stripe processes payment data under its own privacy policy and as an independent data controller for regulatory compliance purposes.
• Hosting and infrastructure providers — the servers and CDN that deliver storyveo.ai.

We do not share your personal data with advertisers, data brokers, or unrelated third parties.

We may disclose your data if required by law, court order, or regulatory authority, or where necessary to protect the rights and safety of Storyveo, its users, or others.

7. International Data Transfers

Some of our service providers (including PostHog and Stripe) are based in or process data in the United States. When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions where applicable.

You can request details of the safeguards in place for any specific transfer by contacting us at the address in Section 1.

8. How Long We Keep Your Data

• Analytics data: retained by PostHog for up to 12 months from collection, after which it is aggregated or deleted.
• Account data: retained for as long as your account is active, plus 12 months after deletion to comply with legal obligations.
• Payment records: retained for 5 years from the transaction date in accordance with Czech accounting law (zákon o účetnictví).
• Email correspondence: retained for up to 3 years.

When data is no longer needed for its stated purpose and no legal retention obligation applies, we delete or anonymise it.

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure (‘right to be forgotten’): request deletion of your data where there is no overriding legal basis for retention.
• Right to restrict processing: ask us to pause processing while a dispute is resolved.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests (including analytics).
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: with the Czech supervisory authority — the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz).

To exercise any of these rights, contact us at tom@storyveo.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Children's Privacy

Storyveo is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.

11. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• HTTPS encryption for all data in transit.
• Hashed and salted password storage (when accounts are available).
• Restricted access to personal data on a need-to-know basis.

No method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Embedded Third-Party Content

Storyveo embeds video content hosted on YouTube and Vimeo. When you interact with embedded videos, those platforms may set their own cookies and collect data about your interaction, subject to their own privacy policies. We recommend reviewing the privacy policies of YouTube (Google LLC) and Vimeo, Inc. if you have concerns about their data practices.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the platform, legal requirements, or our data practices. When we make material changes, we will:

• Update the ‘Last updated’ date at the top of this document.
• Notify registered users by email (once accounts are available).
• Display a notice on the platform for a reasonable period.

Your continued use of Storyveo after changes are posted constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions, requests, or concerns:

We aim to respond to all privacy enquiries within 5 business days.