Privacy Policy
Last updated: 29 September 2026
This Privacy Policy explains how we collect, use, share and retain personal data when you visit storyfuze.com or use the StoryFuze application, and what rights you have over that data. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).
1. Who is the controller
The data controller is Home Help Search SRL, registered in Romania under number CUI 45500693, with its registered office at Jud. Ilfov, Com. Chiajna, Sat Roșu, Str. Weiner Palada nr. 1, Romania. For any question about this policy or about how your data is handled, contact [email protected].
2. Data protection contact
Privacy requests and questions go to [email protected], marked "Privacy request". If we have appointed a Data Protection Officer, their contact details are published here: [email protected]. We answer requests within one month; where a request is complex we may extend that period by up to two further months and will tell you why.
3. What data we collect
Account data — name, email address, password (stored only as a salted hash), account language and preferences, and the organisation name where you provide one.
Subscription and billing data — the plan you are on, billing period, invoice history, VAT identifier where supplied, and the last four digits and brand of the payment card. We never see or store full card numbers; card data is collected directly by our payment processor.
Content data — the files you upload, the projects, transcripts, captions, creatives and exports you generate, and the metadata attached to them (file name, size, duration, format, timestamps).
Connected Channel data — the access tokens and the account identifiers and display names of the third-party channels you authorise us to publish to. Tokens are stored encrypted and are used only to perform actions you request.
Usage and technical data — IP address, browser and device type, operating system, pages viewed, features used, quota consumption, referring URL, timestamps, and error diagnostics.
Support and communications data — the content of messages you send us and our replies.
Marketing data — your email address and consent status if you subscribe to our newsletter.
We do not deliberately collect special categories of personal data. Please do not upload such data unless it is necessary for your project and you have a lawful basis for it.
4. Legal bases and purposes
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and administering your account | Account data | Performance of a contract, Art. 6(1)(b) |
| Providing the Service: editing, transcription, captioning, exports, publishing | Content data, Connected Channel data | Performance of a contract, Art. 6(1)(b) |
| Taking payment, issuing invoices, managing subscriptions | Subscription and billing data | Performance of a contract, Art. 6(1)(b); legal obligation for tax records, Art. 6(1)(c) |
| Keeping the Service secure, preventing abuse and fraud, enforcing quotas | Usage and technical data | Legitimate interests, Art. 6(1)(f) — securing our service and our users |
| Product and performance analytics | Usage and technical data, cookie identifiers | Consent, Art. 6(1)(a) |
| Advertising and audience measurement | Cookie and pixel identifiers | Consent, Art. 6(1)(a) |
| Service emails (password resets, billing notices, policy changes) | Account data | Performance of a contract, Art. 6(1)(b) |
| Newsletter and product marketing | Marketing data | Consent, Art. 6(1)(a) — withdrawable at any time |
| Answering support requests | Support and communications data | Performance of a contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Establishing, exercising or defending legal claims | As relevant | Legitimate interests, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
We do not carry out automated decision-making that produces legal or similarly significant effects on you. Automated processing inside the Service (for example generating a transcript or reframing a clip) produces content, not decisions about you.
5. How long we keep data
Account data — for as long as your account is open, then deleted or anonymised within 90 days of closure.
Content data — until you delete it or close your account; after closure it stays available for export for 30 days and is then deleted from active systems, with encrypted backups rotating out within a further 30 days.
Billing records and invoices — 10 years, or the period required by tax law in Romania.
Connected Channel tokens — until you disconnect the channel or close your account, then deleted immediately.
Usage, technical and security logs — up to 12 months, then deleted or aggregated so that they no longer identify you.
Support correspondence — 24 months from the last message.
Marketing consent records — for as long as you are subscribed plus 3 years, as proof of consent.
6. Sharing and processors
We do not sell personal data. We share it only with providers who process it on our instructions under a written data processing agreement, and only to the extent necessary:
- Hosting and infrastructure — our server provider hosts the application and databases in the European Union.
- Object storage — a cloud storage provider stores your uploaded and exported files.
- Payment processing — our payment processor handles card data, subscriptions and invoices, and acts as an independent controller for its own anti-fraud and regulatory purposes.
- Transactional email — the provider that delivers password resets, billing notices and service announcements.
- Google Tag Manager (Google Ireland Limited) — loads and manages our measurement tags. It is deployed only after you accept analytics/marketing cookies; our container identifier is GTM-P3K4MF4N.
- Meta Pixel (Meta Platforms Ireland Limited) — measures the effectiveness of our advertising and builds audiences. It is deployed only after you accept marketing cookies. Meta acts as a joint controller with us for the collection and transmission stage of this processing.
- Connected Channels — when you publish, we transmit the assets and copy you selected to the platform you chose. That platform's own privacy policy then applies.
We may also disclose data where required by law, court order, or a valid request from a competent authority, and in connection with a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different privacy policy.
7. International transfers
Our primary hosting and storage are located in the European Union. Some providers — in particular Google and Meta — may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, by an adequacy decision (such as the EU–US Data Privacy Framework, where the recipient is certified), and by supplementary technical and organisational measures. You can request a copy of the relevant safeguards at [email protected].
8. Security
We use TLS in transit, encryption at rest for stored files and tokens, hashed passwords, role-based access limited to staff who need it, audit logging of administrative actions, and regular backups. No system is perfectly secure; if a personal data breach is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR.
9. Your rights
Under the GDPR you have the right to: access the personal data we hold about you and receive a copy; rectify inaccurate or incomplete data; erase your data ("right to be forgotten") where one of the grounds in Article 17 applies; restrict processing in the circumstances set out in Article 18; data portability — receive the data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible; object to processing based on our legitimate interests, including profiling, and to object at any time to direct marketing; and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Most of these you can exercise yourself: edit your details in Settings, export your projects from the dashboard, disconnect channels from the Publishing Hub, unsubscribe using the link in any marketing email, and change cookie choices via "Cookie settings" in the footer. For anything else, write to [email protected]. We may ask for information to verify your identity before acting on a request. If you believe we have not handled your data lawfully, you may lodge a complaint with the supervisory authority in Romania or in the EU country where you live or work.
10. Children
The Service is not intended for children under 16. We do not knowingly collect personal data from children under that age. If you believe a child has given us personal data, contact [email protected] and we will delete it.
11. Changes to this policy
We may update this policy. The current version is always at storyfuze.com/politics with a "Last updated" date. Where a change is material, we will notify you by email or in-app before it takes effect.
12. Contact
Home Help Search SRL, Jud. Ilfov, Com. Chiajna, Sat Roșu, Str. Weiner Palada nr. 1, Romania, Romania. Registration number CUI 45500693. E-mail: [email protected].