Privacy Policy

01Controller

The data controller is STORI ART sp. z o.o., ul. Tadeusza Kościuszki 37 m. 1, 80-445 Gdańsk, Poland, registered under KRS 0001246643, VAT ID PL5842886018. Contact: support@stori.art. No data protection officer is appointed; privacy questions go to the same address.

02What stays on your machine

Stori is local-first. Your sessions, nodes, generated images, video, audio, agent chat history, and run history are stored on your own computer and are never uploaded to us automatically. Local model runs never leave your machine.

03What we process and why

Account: your email address, display name, and profile picture, plus sign-in records. The picture comes from Google if you sign in with Google; a photo you upload yourself is stored in our storage at an address only Stori links to, so anyone given that link can open it. Legal basis: performance of the contract.

Billing: your billing name and address, VAT number if you give one, your prepaid balance, top-up history, invoices, and the per-run charges for hosted models. If you choose to keep a card on file we store only its brand, last four digits, expiry, and issuing country; the card number itself is entered in Revolut's secure field and never reaches us. Legal basis: contract and legal obligations for accounting.

Hosted runs: the inputs you send to a hosted model (prompts, reference images, settings) pass through our proxy to the model provider named on the node, and the output returns to you. We keep only the metadata needed to bill and reconcile the run: provider, model, price, timestamps, amounts, and the provider's job reference. We do not store your prompts, your uploaded files, or the generated outputs. Legal basis: contract.

Agent chat: your messages to the agent are relayed to the model provider for that turn and are stored only on your machine. The relay keeps billing metadata for the turn, not its content.

Problem reports: automatic error reports, which you can turn off in Settings, carry technical details only: the app version and build, your operating system and hardware, the screen you were on, and what failed. They never include your prompts, file names, or content. A report you write yourself also contains what you type and any files you choose to attach. Support email contains what you write to us. Legal basis: legitimate interest in keeping Stori working.

Website: server logs with IP address and browser details for security and capacity, kept 30 days. We use no advertising trackers.

04What we never do

We never use your prompts, uploads, or outputs to train or improve models, and we never sell your data or share it for advertising. We do not build profiles of you, and no decision with legal or similar effect on you is made by automated means alone.

05Faces, voices, and other people

Your inputs may show or sound like people, including you. A hosted run sends those inputs to the provider named on the node only to make that output; we do not keep them, and we do not use them to recognise or identify anyone. If your inputs include other people, you need a lawful reason to use them, such as their permission.

06Who receives data

Supabase (authentication and account database, hosted in Zurich, Switzerland, a country covered by an EU adequacy decision); Google Cloud (our proxy and hosting, in the EU); Resend (sign-in codes, receipts, and support email, EU region); Revolut (payments, card storage, and refunds); and the model providers you choose per run: Fal, OpenAI, Anthropic, Google, Moonshot, DeepSeek, Magnific by Freepik, ElevenLabs, and Exa. Each processes data under a contract with us or under their own terms, which are named on the node for that run.

Some providers are outside the EU. For those we rely on an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or on the EU standard contractual clauses in the provider's data processing terms. A run only reaches the provider you selected on the node.

Beyond that, we disclose data only when the law requires it, for example to answer a valid request from an authority, or to a company that takes over Stori, which would remain bound by this policy.

07How long we keep it

Account data for as long as your account exists, then 30 days after deletion while backups roll over. Billing records, including invoices and the run metadata behind them, for the period Polish accounting law requires: five years from the end of the tax year in which the document was issued. Server logs for 30 days.

08Your rights

You can see and correct your account details and download your invoices on the Account page, and delete your account there too. For a copy of everything we hold about you, in a machine-readable form, write to support@stori.art from your account email. We answer every request within one month; if a request is complex we may take two more months, and we will tell you why.

You may object to processing based on legitimate interest, ask us to restrict processing while a question is open, and withdraw any consent at any time. Your work is already on your machine, so it is yours to copy or move whenever you like.

You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, or to the authority where you live.

09Security

Data in transit is encrypted, access to account and billing data is limited to the people who need it, and card numbers never reach our systems. If a breach puts your data at risk, we report it to the supervisory authority within 72 hours and tell you without undue delay where the law requires it.

10Cookies

The website sets one kind of cookie: the sign-in cookie that keeps you signed in to your account, named after our authentication service (it begins with sb-). It stays until you sign out or it expires. While you are paying, your browser also keeps the open checkout for 30 minutes in its session storage, so a reload does not start a second payment; it is cleared when you close the tab.

There are no analytics, advertising, or third-party cookies, so there is no cookie banner. The secure card field you pay in is served by Revolut under its own policy.

11Children

Stori is for people aged 18 and over. We do not knowingly collect data from anyone younger, and we delete an account we learn belongs to a minor.

12Changes

We update this policy when our processing changes. The date at the top tells you when. Material changes are announced in the app and by email.