Privacy Policy | Storystak

1. Who We Are and What This Policy Covers

Storystak ("Storystak," "we," "us") is operated by Storystak LLC, a Tennessee limited liability company, 116 Agnes Rd, Ste 200, Knoxville, TN 37919. This Policy explains how we collect, use, share, and protect personal information when you visit storystak.com or our other sites, sign in to a Storystak Suite, use a Stak through an AI tool, use Dot, or contact us.

Storystak is a business service. We offer it only to businesses, and only to users who are at least 18 years old.

2. Two Roles: Our Own Data and Our Customers' Content

(a) Data we control. For website visitors, account holders, prospects, and the people we correspond with, we decide how personal information is used. This Policy governs that information.

(b) Customer Content we process for customers. Our customers (agencies and companies) put content into their Suites. This includes approved facts, brand materials, reviews, documents, and notes, transcripts and email summaries of their work with their own clients, which may include personal information about the people they work with. We process that content on our customer's behalf, under our agreement and Data Processing Addendum with that customer, as a "service provider" or "processor." We keep each customer's content separate, and we never use one customer's content to build or improve anything for another customer. If your information appears in a customer's Suite, that customer decides how it is used, and you should direct questions or requests to that customer. We will help our customers respond.

3. What We Collect

(a) Information you give us: name, business email, phone number, company, job title, and messages you send us; account and sign-in details; billing contact details; and anything you submit in an application, a demo request or a support email. Our application form on storystak.com asks for your name and work email first, then your agency's website, your role and roughly how many clients you work with. We save your name and work email when you finish the first step, so an application you don't complete still reaches us. With an application we also keep the page you arrived on, the site that sent you, any campaign tags in the link, and a short one-way code made from your IP address, used to limit repeated submissions; we don't keep the address itself.

(b) Information collected when you use the Service:

Sign-in data. When you sign in with Google, we receive your name, email address, and profile identifier.
Connector requests. When your AI tool uses your Stak, it sends our connector a request, and we return content from your Stak. Under your email address, we log which tools you use, when, and which client Staks you work in, and your organization's owners and admins can see that usage. Separately, for each Stak, we log the text of searches (up to 200 characters) and the names of files read. We store these search and file records without your email address or any other identifier, so they are not linked to you. We do not collect your AI conversation history, and we receive only what your AI tool sends to the connector.
Usage and device data. Pages viewed, features used, approvals and edits made in the Surface, IP address, browser type, and error and performance data.
Voice input. When you use Dot, we process your voice to transcribe and act on what you say. Our voice provider transcribes the call and is set not to keep the audio, and we don't keep it either. We and our voice provider each keep the transcript for no more than 30 days, then delete it. Our voice provider is set not to use Dot calls to train its models. The answers you give, including short quotes, are saved in your Suite as part of its content and follow the Suite's retention rules. We do not create voiceprints or use voice data to identify you.

(c) Payment information. Stripe processes card payments. We receive limited details from Stripe (such as card brand, last four digits, and expiration date), not full card numbers.

(d) Information from public sources. Before a demo, we may research a prospective customer and the clients it names, using publicly available business information such as websites, public business listings and published marketing materials. This can include the names and roles of people those businesses list publicly. We use it only to prepare a private demonstration Suite, and we delete it as Section 6 describes if the prospect does not go ahead.

(e) Cookies and page assets. Our Suites use only the cookies needed to sign you in and to remember which AI tools you have approved. storystak.com uses Google Analytics to count visits and see which pages are read. It also keeps its own count of visits on our own systems: the pages viewed, the site a visit came from and any campaign or ad-click tags in the link, country and region, language, device and browser type, page speed and errors, how far people scroll, where they click, and how long they spend in each form field, but never what is typed into one. To count a returning visitor once, it sets two first-party cookies, one lasting up to 90 days and one for the current visit, and it does not keep your IP address. If you send us an application, we link it to the visit it came from. Your browser's own storage holds an unfinished application and how you first reached the site, so the form can pick up where you left off. Our sites and Suites load fonts from Google Fonts and icons from unpkg, and storystak.com loads our booking calendar from Cal.com; those services receive your IP address when they load. We do not use advertising cookies. Because we don't sell personal information or use it for targeted advertising, our sites work the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal. Where a law treats such a signal as an opt-out request, we honor it.

(f) Calls and meetings with us. When you meet with us, we take notes, and if everyone on the call agrees, we record and transcribe it using Google Meet and its note-taker. We keep these notes in our own business records to follow up and to keep a record of our conversations, and we treat what you tell us about your clients as confidential.

(g) Sensitive information. We don't ask for sensitive personal information, such as government ID numbers, financial account numbers, private health records or biometric data, and our customers agree not to upload it to their Suites unless their agreement with us allows it.

4. How We Use Personal Information

We use personal information to: provide, secure, and support the Service; create and manage accounts; process payments and send invoices and service notices; respond to inquiries and provide training; prepare demonstrations for prospective customers; improve the Service using usage data, aggregated and de-identified for any use beyond the customer's own Suite; send business communications about Storystak, from which you may opt out at any time; detect and prevent fraud, abuse, and security incidents; and comply with the law and enforce our agreements.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Customer Content, or personal information in it, to train or fine-tune AI models, or to build or improve anything for another customer, and we use AI providers only under terms that prohibit them from training on that content.

We share personal information only:

with service providers that help us run the Service, under contracts that limit their use of the information to providing services to us. Our current list is at storystak.com/legal/subprocessors/: hosting, content storage and scheduled jobs, network delivery, AI processing, voice transcription, email delivery, sign-in and business email, and billing. The vendors that run our website, such as website analytics, fonts, icons and scheduling, are listed separately on the same page;
with the customer whose Suite you use, which controls the content and accounts in that Suite;
with the third-party AI tools you or your organization choose to connect, which receive content from your Stak when you use them and handle it under their own terms and privacy policies;
when the law requires, or to protect the rights, property, or safety of Storystak, our customers, or others; and
with a successor in a merger, acquisition, financing, reorganization, or sale of all or part of our business; the successor will remain bound by this Policy for information it receives.

6. Retention

We keep personal information only as long as needed for the purposes in this Policy.

Customer Content follows our Subscription Terms: it stays read-only for 30 days after a subscription ends, is kept locked until 12 months after the subscription ends, and is then deleted after we email the account owner 30 days ahead. A client Stak that a customer switches off is kept for 12 months and deleted the same way.
Trials. Content in a trial that is not kept is deleted when the prospect tells us they are not going ahead, or 7 days after the trial ends.
Demonstrations. A demonstration Suite for a prospect who does not start a trial is deleted 30 days after the prospect tells us they are not going ahead, or 90 days after our last contact, whichever comes first.
Website visits. Records of visits to storystak.com are kept for up to 13 months, and the detailed events within a visit for 90 days.
Call notes and recordings. Notes of calls with prospects and customers are kept while we have a business relationship and for up to 3 years after our last contact, and call recordings for up to 12 months.
Usage records. Records of activity by day are kept for 90 days. Other usage records, including search and file-read records, are kept while the Suite exists and deleted with it. A removed user's usage records are deleted within 30 days. Search and file-read records are not linked to any person, so they stay with the Suite when a user is removed. We may keep usage information in aggregated, de-identified form.
Deletion on request. When a customer or prospect asks, we delete their content sooner: from the live Service within 30 days of the request. Within 90 days after deleted content leaves the live Service, our backups of it expire and we take reasonable steps to clear it from version history.
Business records. Billing records are kept for 7 years, and other account and business records as long as the law or our legitimate business needs require.

7. Security

We use reasonable administrative, technical, and physical safeguards, including encryption in transit, access controls, and limits on internal access. Our security overview is at storystak.com/legal/security/. No method of transmission or storage is completely secure. If we confirm unauthorized access to personal information, we will notify affected customers and individuals as the law requires.

8. Your Choices and Rights

(a) Everyone. You may ask us to access, correct, or delete personal information we control about you, or to stop sending you marketing email. Email privacy@storystak.com. We will verify your request before acting on it and will respond within 45 days.

(b) State privacy laws. Some states give their residents additional rights, such as the right to know what we collect, to obtain a copy, to correct, to delete, and to opt out of sales, targeted advertising, and certain profiling. We do not sell personal information or engage in targeted advertising or profiling with legal or similarly significant effects. We honor the request rights in subsection (a) for everyone, wherever they live, and we will not discriminate against anyone for exercising them. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal within the time the applicable law requires. You may also use an authorized agent where the law allows.

(c) Information in a customer's Suite. Send requests about Customer Content to the customer that controls the Suite. If you send one to us, we will forward it or tell you whom to contact.

9. Children

The Service is not directed to children, and we do not knowingly collect personal information from children under 13. Our customers agree not to upload children's personal information. If you believe a child's information has reached us, email privacy@storystak.com and we will delete it.

10. Where We Operate

Storystak is based in the United States and offers the Service to customers in the United States. We store and process information in the United States, with two exceptions: Cloudflare, which carries traffic to our sites and Suites, may route it through its global network, and Anthropic, our AI provider, may run its processing in other countries.

11. Changes to This Policy

We may update this Policy. We will post the updated version with a new "Last updated" date and, for material changes, notify account owners by email or in their Suites before the change takes effect.

12. Contact Us

Questions or requests: privacy@storystak.com or 116 Agnes Rd, Ste 200, Knoxville, TN 37919.