Global Privacy & Cookie Notice

YourStoryz · Effective 19 August 2026

Effective date: 19 August 2026

1. Who we are

YourStoryz is a product and service of ShareStoryz GmbH (“ShareStoryz”, “YourStoryz”, “we”, “us” or “our”).

ShareStoryz GmbH Höhenkirchener Straße 134 85662 Hohenbrunn Germany Commercial Register: Amtsgericht München, HRB 255274 VAT ID: DE 329399610 Email: info@yourstoryz.com Telephone: +49 89 7167769

For privacy requests, contact: info@yourstoryz.com with “Privacy Request” in the subject line.

This Notice explains how we collect, use, store, disclose and protect personal data when you use the YourStoryz website, dashboard, mobile applications, YourStoryz Light, customer support, subscriptions, integrations and content-processing or publication services (together, the “Services”).

2. Our role

ShareStoryz acts as a controller when it determines the purposes and means of processing, including for website operation, account administration, billing, security, support and its own communications.

Where a business customer determines why and how content and related personal data are processed and ShareStoryz processes that data only on the customer’s documented instructions, ShareStoryz generally acts as a processor or service provider. The customer remains responsible for its instructions, notices, legal bases and permissions. These arrangements are governed by our Data Processing Agreement.

Privacy laws can assign roles differently in particular circumstances. The role applicable to a specific processing activity will be determined by the facts and applicable law.

3. Scope

This Notice applies to personal data processed through:

• com and related ShareStoryz websites;
• the YourStoryz dashboard;
• native YourStoryz mobile applications;
• YourStoryz Light;
• account registration, subscriptions and customer support;
• media upload, storage, editing, transcription and translation;
• AI-assisted draft creation;
• publication and storage integrations selected by a user or customer; and
• security, operational and usage logs.

Third-party platforms, websites and publication channels have their own privacy notices. This Notice does not govern their independent processing.

4. Personal data we process

Depending on how the Services are used, we may process:

Account and contact data

Name, email address, telephone number, password hash, organisation, profession, customer ID, user ID, account role, language, preferences and communications.

Subscription and transaction data

Plan, billing contact, invoice information, payment status, transaction reference and related accounting records. Payment providers may process payment credentials directly under their own privacy terms. ShareStoryz may also process payments and invoices manually.

Customer content

Video, photographs, audio, voice, text, titles, descriptions, logos, brand assets, transcripts, translations, generated drafts, edits and publication selections. Content may identify users, contributors or other people appearing in or referred to in the content.

Content may reveal sensitive information, such as health, political opinions, religion, racial or ethnic origin, sexual orientation or trade-union membership. Users and customers must not upload sensitive personal data unless they have a valid legal basis and the upload is necessary for the intended purpose.

Technical and usage data

IP address, timestamps, browser, operating system, device type, app version, cookie or device identifiers, referring pages, page and feature interactions, authentication events, error information, server logs, security logs and diagnostic information.

Integration and publication data

Connected account identifiers, channel information, OAuth tokens, permissions, publication settings, destination, status and responses returned by third-party APIs. We request only the permissions reasonably required for the integration selected by the user.

AI-processing data

Content selected by the user, audio or text submitted for transcription or translation, prompts, derived transcripts and draft blogs or posts. AI-generated output is presented as a draft and is not published unless the user reviews and approves it.

Support, complaints and moderation data

Messages, attachments, reports, copyright or unlawful-content notices, account and content references, investigation records and actions taken. Authorised personnel may review relevant content where necessary.

Data about people without an account

Users and business customers may upload content containing people who do not have a YourStoryz account, including interviewees, employees, event visitors, contributors and other individuals. Depending on the circumstances, the uploading user or customer is responsible for informing those people and obtaining any required permissions.

5. How we obtain personal data

We obtain data:

• directly from you when you register, communicate with us, upload content or use a feature;
• from a business customer that creates or manages your access;
• from users or contributors who upload content involving other people;
• automatically through websites, apps, APIs, cookies and logs;
• from payment and integration providers; and
• from publication channels when you connect an account or request publication.

6. Why we process personal data

The table below describes our principal purposes and, for EU/EEA and UK users, our usual legal bases.

Where we rely on legitimate interests, we consider the necessity of the processing, its expected effect on individuals and available safeguards. You may request further information about a specific balancing assessment.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully.

7. AI-assisted features

When you request an AI-assisted function, ShareStoryz extracts the audio track from the selected video and submits the audio file to the OpenAI API for transcription. The resulting transcript is then submitted to the OpenAI API together with a system instruction and user-selected parameters, which may include the requested language, writing style, target audience and social platform. Translation is performed as part of text generation and not through a separate audio-translation request.

The production implementation uses OpenAI’s Audio Transcriptions and Chat Completions APIs. The request does not include the user’s name, email address, account metadata, customer ID or user ID. Audio and transcripts can nevertheless contain personal data where a person is identifiable from the content.

The temporary audio file on the YourStoryz AI server is deleted immediately after transcription. YourStoryz does not create persistent objects through OpenAI’s Files, Uploads, Assistants or vector-store APIs. Chat Completions uses OpenAI’s default non-storage behaviour; the application currently does not send an explicit store parameter.

According to OpenAI’s business API documentation, API input and output are not used to train OpenAI’s general models unless the customer has expressly opted in. Unless different organisation-level data controls apply, limited input, output and related data may be retained by OpenAI for up to 30 days for abuse monitoring or longer where legally required.

Customer content is not used by ShareStoryz to train recognition, profiling or generative-AI models.

AI output may be incomplete or inaccurate. It is shown as a draft. YourStoryz does not automatically publish AI-generated text. The user must review and approve it before publication.

We do not use customer content for facial recognition, voice recognition, user profiling or solely automated decisions that produce legal or similarly significant effects. We do not use automated content moderation. Where moderation is necessary, it is performed by authorised personnel.

8. Content and publication responsibilities

Users and customers must ensure that they are authorised to upload, edit, process and publish content. This may require privacy notices, consent, copyright permission, image or publicity rights, employment-related authorisation or another legal basis.

Before publication, the user selects the destination and approves the final content. Once content is published to an external platform, that platform processes it under its own terms. Disconnecting an integration or deleting content from YourStoryz may not remove content already published elsewhere.

9. Sharing personal data

We may disclose personal data to:

• business customers that administer accounts or content workflows;
• hosting, storage, analytics, communication, security and support providers;
• payment providers and financial institutions;
• AI service providers when a user requests an AI function;
• publication and storage platforms selected by the user;
• professional advisers, auditors and insurers;
• competent authorities when disclosure is legally required; and
• a successor in connection with a merger, acquisition, restructuring or sale, subject to appropriate safeguards.

We do not disclose personal data to a private claimant merely because an allegation has been made. We assess the request, its legal basis, necessity and proportionality and may require a valid legal order or other substantiation.

Principal providers and integrations

We maintain contracts with processors where required. Some payment providers and publication platforms act as independent controllers for their own purposes.

10. International transfers

ShareStoryz is established in Germany and uses service providers in several countries. The main application environment and its backups are hosted in Amsterdam. Media storage is currently configured in the AWS eu-west-2 region in the United Kingdom.

The European Commission has recognised the United Kingdom as providing an adequate level of data protection. For other transfers from the EU/EEA, United Kingdom or Switzerland, we use an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or another recognised transfer mechanism, together with supplementary safeguards where appropriate.

You may contact us for information about the safeguard applicable to a particular transfer.

11. Retention

We retain personal data only for as long as necessary for the relevant purpose, contractual commitments and legal obligations. Unless a different period is required or agreed:

Deletion from active systems may not immediately remove data from isolated backups. We restrict backup use to security and recovery and delete or overwrite backups according to our backup cycle.

12. Security

We use organisational and technical safeguards designed to protect personal data, including access controls, role-based permissions, encryption in transit, protected hosting environments, backups, logging and incident procedures. Access is limited to personnel and providers who need it for their role and are subject to confidentiality obligations.

No system is completely secure. Users must protect their credentials and notify us promptly of suspected unauthorised access.

13. Your choices and rights

Depending on applicable law, you may have the right to:

• obtain information about our processing;
• access personal data;
• correct inaccurate data;
• delete data;
• restrict or object to processing;
• receive portable data;
• withdraw consent;
• opt out of direct marketing;
• opt out of sale, sharing or targeted advertising where applicable;
• limit certain uses of sensitive personal information;
• appeal a refusal of a request where applicable;
• avoid discriminatory treatment for exercising privacy rights; and
• complain to a privacy or data-protection authority.

Submit a request to info@yourstoryz.com with “Privacy Request” in the subject line. We may take proportionate steps to verify identity and authority. An authorised agent may submit a request where permitted by law. We will respond within the period required by applicable law.

Rights are not absolute. We may retain or decline to disclose data where an applicable exception requires or permits this, including protection of other people’s rights, security and legal obligations. We will explain our decision where required.

14. Regional information

EU/EEA

EU/EEA residents have the rights provided by the GDPR. You may complain to the supervisory authority in your country of residence, workplace or the place of the alleged infringement. For private-sector organisations established in Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), lda.bayern.de.

United Kingdom

UK residents may exercise rights under the UK GDPR and complain to the Information Commissioner’s Office at ico.org.uk. Transfers from the UK are protected using UK-recognised adequacy regulations or appropriate safeguards.

Switzerland

Swiss residents may exercise applicable rights under the Swiss Federal Act on Data Protection and complain to the Federal Data Protection and Information Commissioner.

California

If the California Consumer Privacy Act applies to ShareStoryz, California residents may request access to categories and specific pieces of personal information, correction and deletion, and information about sources, purposes and recipients. They may opt out of sale or sharing and limit specified uses of sensitive personal information, where applicable, without discriminatory treatment.

ShareStoryz does not sell personal information for money. Some analytics or advertising disclosures may qualify as “sharing” under California law even without payment. Where required, we provide a “Do Not Sell or Share My Personal Information” mechanism and honour recognised opt-out preference signals, including Global Privacy Control.

For the preceding 12 months, the categories described in section 4 may have been collected and disclosed to the categories of recipients described in section 9 for the stated business purposes. ShareStoryz does not knowingly sell or share the personal information of persons under 16.

This section applies only if ShareStoryz meets the CCPA’s applicability requirements.

Other United States states

Residents of states with applicable comprehensive privacy laws may have rights to access, correct, delete and obtain portable data, and to opt out of sale, targeted advertising or certain profiling. Where required, we provide an appeal process. Submit requests through the contact channel in section 13.

Canada

You may request access to and correction of personal information and withdraw consent where processing depends on consent, subject to legal restrictions. You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial authority. We process information across national borders as described in section 10.

Brazil

Data subjects in Brazil may exercise rights under the LGPD, including confirmation, access, correction, anonymisation, blocking or deletion where applicable, portability, information about sharing, withdrawal of consent and review of qualifying automated decisions. ShareStoryz does not make solely automated decisions producing legal or similarly significant effects. The contact in section 1 serves as the privacy channel.

Australia

Individuals may request access to and correction of personal information and may complain to us about our handling of personal information. If unresolved, an eligible complaint may be made to the Office of the Australian Information Commissioner. Overseas recipients may be located in Germany, the Netherlands, the United Kingdom, the United States and the countries in which selected publication platforms operate.

New Zealand

Individuals may exercise applicable access and correction rights and complain to the New Zealand Office of the Privacy Commissioner. International disclosures are handled using contractual or other safeguards required by applicable law.

Other countries

Additional rights may apply in countries in South America, the Middle East and Asia. We honour applicable mandatory rights and may provide local notices or representatives where required. Availability of the Services does not mean that every feature is offered in every country.

The Services are not offered in Russia.

15. Children

The Services are intended only for persons aged 16 or older. Users must confirm during registration that they are at least 16. We do not knowingly permit persons under 16 to create an account. If we learn that an account holder is under 16, we may suspend or delete the account and take appropriate steps to delete associated personal data unless retention is legally required.

People under 16 may appear in content uploaded by an adult or business customer. The user or customer must have an appropriate legal basis and obtain parental or guardian permission where required.

16. Cookies and similar technologies

We use cookies, local storage, tags and comparable technologies. Strictly necessary technologies support security, consent choices, session management and requested functions. Analytics, preference or marketing technologies are used only after consent where required.

Current known technologies

The public marketing website and application environments use different technologies. Google Analytics 4 and Complianz have been observed on the public WordPress website. In the dashboard code, Google Tag Manager container GTM-TC6P54K is present only on certain legacy guest, login or invitation pages; it is not loaded throughout the authenticated dashboard. The dashboard code does not itself provide Google Analytics User-ID values or application events to the data layer.

On legacy pages, Google Tag Manager is used to manage website tags. Non-essential tags are configured to respect the visitor’s consent choices where prior consent is required. Google Signals, advertising functions and User-ID are not used unless they are separately disclosed and, where required, enabled by the visitor.

SimpleStats operates server-side and does not rely on a separate tracking cookie, but it still processes personal data, including full IP addresses and internal user IDs. Cookie-free does not mean privacy-law exempt.

Managing consent

Where consent is required:

• non-essential technologies are disabled until a user chooses to enable them;
• “Accept” and “Reject” are offered with comparable prominence and effort;
• users may select categories separately;
• no optional category is preselected;
• consent can be withdrawn through a persistent “Manage consent” link; and
• withdrawal is as easy as giving consent.

Browser controls may also block or delete cookies, but they do not replace our consent mechanism where prior consent is legally required.

We honour legally required browser-based opt-out preference signals. Rejecting optional technologies does not prevent access to core functions, although optional features may be affected.

17. External links and platforms

Our Services may link to or publish content on third-party platforms. We do not control their independent privacy practices. Review the privacy notice and settings of each connected service. We do not receive your third-party password through a correctly implemented OAuth connection.

18. Changes

We may update this Notice to reflect legal, technical or business changes. We will change the effective date and provide additional notice where a change materially affects individuals or where law requires it. We will request new consent where a new processing activity legally requires consent.

19. Contact and complaints

Contact us at info@yourstoryz.com or the postal address in section 1. Please describe the request and the relevant account or Service. We will investigate privacy complaints and respond within the applicable legal period.