Storykindly — Privacy Policy
Last updated: 2026-10-27 · Policy version: 1.0
The short version
- Two people, two roles. The buyer pays. The storyteller writes their memories. The storyteller's answers belong to the storyteller, and the buyer does not see them unless the storyteller shares them.
- The storyteller decides. They give their own explicit consent, and can skip, pause, leave out any answer, or delete everything at any time.
- We use the stories only to make the book. Never as examples, for testing, for marketing, or to train AI.
- We delete them automatically 30 days after the book is delivered.
- AI edits, automated checks — no human readers. We send answers to our AI provider (Anthropic) to edit and check them.
- No accounts, no passwords, no analytics, no advertising or tracking cookies.
- Link (a Stripe company) handles payment as merchant of record; we never see your card number.
1. Who is responsible
The controller is Intelligence EOOD (Интелиджънс ЕООД), registered in Bulgaria, UIC 206997580, bl. 428, entr. V, apt. 42, Lyulin residential district, Lyulin district, Sofia 1359, trading as Decido Labs. Privacy contact: support@storykindly.com.
- We do not sell to customers in the United Kingdom.
- We are also the controller for information about other people in the stories. The household exemption may cover the storyteller, but not us as the provider of the service (GDPR Recital 18).
2. What we collect
About the buyer
- Email address (from checkout, via Link); your first name if you give it (shown to the storyteller in the invitation: "[BUYER FIRST NAME] gave you…").
- Order details: book size and language, start date, gift or for yourself, consent records (which version of each statement you confirmed, and when), payment and refund identifiers from Link — never your full card number.
- The storyteller's first name and email address, which you give us (see Section 4).
About the storyteller
- First name, email address, the book language.
- Your answers (written text), the edited chapters, your choices (approve, original words, leave out, share), name confirmations, your pace setting.
- Consent records: which version of the storyteller terms and consent you accepted, and when; your choice under Section 9.
About other people mentioned in the stories
- Whatever the storyteller chooses to write: first names, relationships, memories. These may include sensitive details such as health (Section 5).
Technical data
- A salted one-way hash of the IP address for rate limits (deleted when the limit window ends, at most about a day); a Cloudflare Turnstile security check on the order form and on "Email me a new link". Private links are stored only as a one-way hash. No analytics.
What we don't collect: accounts or passwords, full card details, voice recordings or photos, advertising identifiers, location tracking.
3. Why we use it, and on what legal basis
| What we do | Whose data | Legal basis (GDPR) |
|---|---|---|
| Take and manage the order; send the order confirmation and status | Buyer | Contract — Art. 6(1)(b); confirmation on a durable medium — legal obligation, Art. 6(1)(c) (Directive 2011/83/EU Art. 8(7)) |
| Email the storyteller the invitation and the questions | Storyteller (email, first name) | Legitimate interests — Art. 6(1)(f): delivering a gift the buyer paid for, limited to an invitation they can decline |
| Edit, check and show chapters; make and deliver the book | Storyteller | Explicit consent — Arts. 6(1)(a) and 9(2)(a), given the first time the storyteller opens the invitation and withdrawable at any time with "Delete everything now" |
| Use information about living people in the stories | Third parties | Legitimate interests — Art. 6(1)(f); sensitive details about living people are left out of the book unless the storyteller tells us the person has died or agrees (Section 5) |
| Keep a non-reversible fingerprint of an answer the storyteller left out, so that the same words are noticed if they come up again (Section 5) | Storyteller | Legitimate interests — Art. 6(1)(f): honouring the storyteller's own choice; deleted with the answers and at once with "Delete everything now" |
| Information about people who have died | Third parties | The GDPR does not apply (Recital 27); we protect it the same way. |
| Screen answers automatically for attempts to manipulate the AI and for signs that the storyteller may be in crisis (to show support resources only to them) | Storyteller | Art. 9(2)(a) consent (the consent text says that answers are checked automatically) |
| Keep order and consent records (no stories) for refunds, disputes and accounting | Buyer, storyteller (consent record) | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) (legal claims) |
| Protect the service from abuse (rate limits, security check) | Anyone using the pages | Legitimate interests — Art. 6(1)(f) |
We do not send marketing emails to anyone, and we never sell anything to the storyteller.
4. If you are the storyteller: how we got your details
[BUYER FIRST NAME] bought Storykindly for you and gave us your first name and email address. We use them only to send you the invitation, at most 2 reminders, and — if you accept — the questions. We tell you this in the invitation itself (Art. 14 GDPR). If you don't accept within 14 days, or you say "No thanks", we stop, and we delete your details 30 days after the buyer's refund.
Your explicit consent is asked by you, for you, the first time you open the invitation — the buyer cannot give it for you. Without it, you get no questions.
5. Sensitive information, other people and children
Memories often include health, religion, family conflict, or a crime — about the storyteller or about others (Arts. 9 and 10 GDPR).
- The storyteller's own sensitive data — we use it only with their explicit consent (Art. 9(2)(a)), only to make the book, and delete it on the schedule in Section 10.
- Other living people. We ask storytellers to write about others by first name. Our software shortens surnames of living people to an initial, removes phone numbers, email addresses and house numbers automatically, and leaves out of the book any sentence about another living person's health, religion, politics, sexuality or criminal matters — unless the storyteller tells us that the person has died or knows and agrees. For each first name we keep only the storyteller's choice ("alive", "has died" or "knows and agrees"), the version of the text they saw and when they chose, only for this book; we delete them together with the answers (Section 10). Every answer can be left out at any time. When you leave an answer out, we delete its text, the chapter made from it and our notes on it at once. We keep only a non-reversible fingerprint of it — a short code made with a secret key from groups of a few words, with no readable text — so that if the same words come up again in a later answer, we can notice and ask you before they go into your book. The fingerprint cannot be turned back into your words, cannot be used to identify anyone, and is deleted together with your answers (Section 10) — at once if you choose "Delete everything now".
- Children. We ask storytellers to name children by first name or nickname only, or by relation ("my grandson"). The service is not for children: storytellers and buyers must be adults.
- People who have died are protected the same way.
- Who sees what. Before the storyteller shares, the buyer sees only progress. Answers that are left out are never shown to anyone. Signs of crisis are never shown to the buyer.
6. AI and automated processing
- An AI model edits each answer; a second automated check compares the chapter with the answer. If the check fails, or a usage limit is reached, the chapter uses the storyteller's original words. The book page states: "Edited with AI assistance from [STORYTELLER FIRST NAME]'s own words. Automated checks only."
- These decisions only choose between an edited chapter and the original words; the storyteller always approves the result. We do not believe this is a decision with legal or similarly significant effects (Art. 22).
- Nobody at Storykindly reads answers or chapters. Support does not open them unless the storyteller sends them to us.
7. Who we share data with
We do not sell personal data and do not share it for advertising.
| Provider | What they do | Role | Location / safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, background jobs, security check | Processor | US and global; the safeguards in Section 8, as set out in its data processing agreement |
| Anthropic, PBC | AI models that edit and check chapters | Processor | US; the safeguards in Section 8, as set out in its data processing agreement |
| Resend, Inc. | Sending invitations, questions, reminders, order and book emails | Processor | US; the safeguards in Section 8, as set out in its data processing agreement |
| Link (a Stripe company) / Stripe | Payment, receipts, tax, refunds | Independent controller (merchant of record) — see Link's own privacy policy, linked at checkout | [per Link's privacy policy] |
| Advisers, authorities | Only where required by law or for legal claims | Independent controllers | — |
About our AI provider. Anthropic processes answers on our behalf only to edit and check them, under a data processing agreement, and does not use them to train its models.
8. Transfers outside the EU/EEA
Where a provider processes data in a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (Decision (EU) 2021/914); for providers certified under the EU–US Data Privacy Framework, on the adequacy decision of 10 July 2023.
9. If the storyteller cannot finish
When the storyteller first joins, they can choose — it is off unless they turn it on — that, if they die or can no longer continue, the chapters they already approved may be made into a book for the buyer. We act on this only when a close relative (a spouse or partner, child, grandchild, parent, brother or sister) asks and sends a document (a death certificate or a medical certificate), and we delete that document as soon as we have acted on it. Chapters that were not approved, and answers that were left out, are never included. If the choice is off, everything is deleted. The storyteller can change this choice at any time.
10. How long we keep data
| Data | How long |
|---|---|
| Order form that was not paid | 7 days, then deleted |
| Storyteller's answers, chapters, the fingerprints of left-out answers (Section 5) and the book page | Until 30 days after the book is delivered; we remind both of you 7 and 21 days after delivery to download the book; then permanently deleted. |
| Invitation declined or not accepted in 14 days | The storyteller's first name and email are deleted 30 days after the buyer's refund |
| A book that is not finished (the storyteller never opens the review, or cannot continue, and nothing was shared) | We remind the storyteller 60 and 100 days after the last activity; everything is deleted 120 days after the last activity |
| A book we could not deliver (our emails to you keep failing) | We try for 7 days, then contact you by other means or refund you; the book and the answers are deleted 37 days after the book was ready |
| "Delete everything now" (storyteller) | Answers, chapters, fingerprints of left-out answers, links, and the first names of other people with the storyteller's choices about them are deleted at once from the live system (backups within 30 days). The storyteller's name and email, and the order, stay for 30 days — or until the buyer's 14-day cancellation period ends, if that is later — so that a refund that is owed can be paid. |
| First names of other people in the stories, with the storyteller's choice for each | Kept only with the storyteller's answers and deleted together with them, on the schedules above; at once if the storyteller chooses "Delete everything now" |
| Order and consent records — which version of each statement the buyer and the storyteller confirmed, and when (no stories, no chapters, no names of other people) | 5 years after your personal data was removed from the order, which is at least 5 years after payment |
| Payment and refund records (order number, amount, payment and refund identifiers — never your stories or your email) | 10 years after the end of the year of payment, as Bulgarian accounting and tax law requires. One exception: our tamper-evident log of automatic refunds (date, amount, reason, order number and refund identifier — never your email, name or stories) cannot be edited or deleted without breaking its integrity check, so it is kept; once the order and payment records it points to are deleted, it no longer identifies anyone. |
| Rate-limit counters (salted IP hash) | Until the window ends (at most about a day) |
| Technical logs (order number, status, costs, errors — never answers or chapters) | Within 30 days |
| Private links | Stored only as a one-way hash; storyteller links stop working after 21 days at most (the invitation link at the end of the 14-day window); the buyer's status link 30 days after the last event |
| Emails we sent | Remain in your inbox; our email provider keeps delivery logs for a limited time under its data processing agreement |
11. Your rights
Everyone — buyer, storyteller, and people mentioned in a story — has the rights of access, correction, deletion, restriction, objection and portability (Arts. 15–21 GDPR), and the storyteller can withdraw consent at any time (Art. 7(3)). The fastest way for the storyteller to delete everything is "Delete everything now" on any of their pages. Otherwise email support@storykindly.com from the address we have for you; we may ask you to confirm through your private link. We reply within one month.
If you are mentioned in someone's story: we usually cannot tell who a first name refers to (Art. 11) and cannot inform everyone mentioned (Art. 14(5)(b)). If you believe a story about you is stored with us, contact support@storykindly.com. We keep at most your first name and the storyteller's choice about you, and only until the book's data is deleted.
Complaints: in Bulgaria the Commission for Personal Data Protection (КЗЛД, www.cpdp.bg), or the authority where you live or work.
12. Cookies
No analytics, tracking or advertising cookies, so no cookie banner. Cloudflare Turnstile runs on the order form and on "Email me a new link" as a security check; it is strictly necessary and sets no tracking cookie. The payment page is run by Link/Stripe under its own policy.
13. Security
Private links are long and random (128 bits) and we store them only as a one-way hash. Answers are kept out of logs. Please keep your links private.
14. Changes
If we change this policy, we update the date above and, for significant changes that affect an active order, tell the buyer and the storyteller by email.
15. Contact
Intelligence EOOD (Интелиджънс ЕООД), trading as Decido Labs · bl. 428, entr. V, apt. 42, Lyulin residential district, Lyulin district, Sofia 1359 · UIC 206997580 · support@storykindly.com