Privacy Policy

The controller of your data is Storia, based in Chile. For any privacy question write to dpo@storiaapp.com.

This policy covers storiaapp.com, the application and the emails we send you, and is governed by Chilean Law 19.628 on the protection of private life, as amended by Law 21.719.

• Account: email, name, language and password. The password is stored by our authentication provider as a hash; nobody can read it.
• Profile and brand: your role, what you use Storia for and your brand voice (audience, tone and topics).
• Content: ideas, articles, voice recordings and their transcripts.
• Publishing credentials: the GitHub token and the Make.com webhook URL you connect, always encrypted.
• Usage: AI usage for the period and publishing history.
• Technical data: IP address and browser in security and audit logs.
• Waitlist and updates: your email and the optional answers of the form, or your newsletter subscription if you turn it on.

• Providing the service (storing your work, generating drafts, transcribing audio and publishing): necessary to perform the agreement you accept when you create your account.
• Security and abuse prevention (logs, usage limits, support audit trail): our legitimate interest in protecting the service and the people who use it.
• Newsletter: only with your consent, which you can withdraw at any time.
• Usage statistics (Google Analytics): in the European Economic Area, the United Kingdom and Switzerland, only with your consent. Everywhere else, our legitimate interest in understanding how Storia is used so we can improve it; you can object at any time from the "Cookies" link.
• Anonymous visit counting (Vercel Web Analytics): our legitimate interest in knowing how many people visit each page. It uses no cookies and no data that identifies you.
• Legal obligations: answering requests from authorities and keeping what the law requires.

We don't sell your data, we don't use it for advertising and we don't train AI models on your content.

We use these providers, which process data only on our behalf:

• Supabase — database, authentication and files. Servers in São Paulo, Brazil.
• Vercel — application hosting and anonymous visit counting (Vercel Web Analytics), which uses no cookies, doesn't follow you across sites and doesn't store your IP address. United States.
• OpenAI — draft generation and voice transcription. Receives the text or audio you send to the AI. Under its API terms, it does not use this data to train its models. United States.
• Resend — email delivery (invitations, account notices). United States.
• Google Analytics — statistics on visits and app usage, while the "Statistics" category is on (see Cookies). If you are signed in, we link those statistics to an internal identifier of your account, never to your email. United States.
• Sentry — error detection and performance measurement. Receives technical data about the error (browser, page, time and technical details) and your account's internal identifier if you are signed in. When an error happens, it also receives a recording of the session with all text and form content hidden, and no images. United States.

When you connect GitHub or a Make.com scenario (for LinkedIn), we send your content to those accounts because you ask us to. From there, those services handle it under their own policies.

There is no payment gateway today: we don't receive or store card data.

Some providers are outside Chile (Brazil and the United States). We work with providers that offer contractual data protection safeguards and require them to process data only to provide their service.

• Your account data and content, for as long as the account exists.
• Voice recordings, until you delete the session or the account.
• If you delete your account, we erase your data within 30 days, except what we must keep by law or for security (for example, the audit log).
• Waitlist data, until we invite you or you ask us to delete it.

• All communication is encrypted in transit (HTTPS).
• Publishing credentials are encrypted with AES-256-GCM before being stored.
• Each workspace is isolated at the database level: nobody sees another workspace's content.
• Any support action on your account is recorded in an audit log.

You can exercise your rights of access, rectification, erasure, objection, portability and blocking, and not to be subject to decisions based solely on automated processing that significantly affect you.

Do it from Settings → Privacy or by writing to dpo@storiaapp.com. We answer within 30 calendar days, which we may extend once for the same period if the request justifies it, telling you why.

If you are not satisfied, you can file a complaint with Chile's Personal Data Protection Agency.

We use cookies and browser storage in three categories. You can review them and change your choice at any time from the "Cookies" link in the site footer or from Settings → Privacy.

• Necessary: they keep you signed in and remember the language, security state and your cookie choice. They are always on because the site doesn't work without them.
• Preferences: they remember choices such as the light or dark theme. If you turn them off, Storia goes back to the defaults on every visit.
• Statistics: Google Analytics, to understand how Storia is used with aggregated data.

Preferences is on everywhere: it only stores what you choose, such as the theme, and you can turn it off at any time. What happens with Statistics depends on where you are.If you visit Storia from the European Economic Area, the United Kingdom or Switzerland, it stays off until you accept it. From anywhere else it is on from the start, based on our legitimate interest, and we tell you on your first visit so you can turn it off. To tell where you are we only use your browser's time zone, without looking up your IP address.

We also count visits anonymously with Vercel Web Analytics, which uses no cookies and stores nothing in your browser nor your IP address, so it works with any choice. Error detection (Sentry) doesn't use cookies.

If an incident compromises your data, we will notify Chile's Personal Data Protection Agency and, where applicable, the people affected, through the fastest available means and without undue delay.

Storia is intended for people over 18. We don't knowingly process data from minors.

If we change this policy substantially, we will email you at least 30 days in advance. Every version is recorded with its date.