Privacy Policy

Effective Date: August 7, 2026

1. About this Policy

Astorie is operated by StoryFlow AI, Inc.. StoryFlow AI, Inc.("StoryFlow AI, Inc.", "Astorie", "we", "us", or "our") is the data controller responsible for the personal information described in this Privacy Policy. This Privacy Policy explains how we collect, use, share, retain, and protect personal information when you use Astorieand related websites, applications, APIs, AI tools, and services (collectively, the "Service").

Capitalized terms not defined here have the meanings given in our Terms of Service.

Our business address is 1003 Post St, Apt 8, San Francisco, CA 94109, United States. For questions or requests, contact us at support@astorie.ai or via our Contact page.

2. Scope

This Privacy Policy applies to personal information we process in connection with the Service. It does not apply to (i) third-party websites, services, or applications that we do not control, even if they are accessible through the Service; or (ii) data processing performed under a separate written agreement with you (for example, a Data Processing Addendum, Enterprise Agreement, or order form), which governs to the extent it conflicts with this Policy. A separate notice, available on request, governs processing relating to our employees and contractors.

3. Personal Information We Collect

We collect personal information that you provide to us, that we collect automatically, and that we receive from third parties. Specific categories include:

3.1 Account and Profile Information

• name, email address, password (hashed), profile picture, display name, username, website, language, time zone, country, and other profile fields; and
• authentication identifiers from third-party sign-in providers (e.g., Google, Apple) where you choose to use them.

3.2 Billing and Subscription Information

We use third-party payment processors such as Stripe to process payments. They collect your payment card details and other billing information directly from you. StoryFlow AI, Inc. does not store full payment card numbers, but may store information associated with your payments such as the last four digits of your card, card-issuer country, billing address, transaction history, subscription status, plan, credit balance, and invoices.

3.3 Customer Content (Inputs and Outputs)

We collect and process the content you submit to or generate through the Service, including:

• Inputs: text prompts, instructions, descriptions, commands, comments, messages, parameter values, settings, seeds, characters, styles, references, and uploaded files (images, video, audio, documents);
• Reference assets: reference images, reference videos, reference audio, and other materials you submit so the Service can condition Outputs on them;
• Outputs: images, videos, audio, text, transcripts, edits, variations, captions, scripts, workflows, and other materials generated by the Service in response to your Inputs;
• Project, canvas, and workflow data: nodes, connections, project structure, canvas state, comments, attachments, drafts, versions, and templates;
• Job and generation metadata: timestamps, model and provider identifiers, generation settings, seed values, file metadata (such as EXIF), file size, format, duration, dimensions, job IDs, status, error logs, and credit usage;
• Communications: support tickets, feedback, ratings, survey responses, and other messages you send us;
• Showroom, gallery, and shared content: workflows, posts, captions, comments, likes, follows, and other content you choose to publish or share within the Service.

Inputs, references, and Outputs may include personal information of you or others (for example, faces, voices, names, or contact details). You are responsible for ensuring you have the rights to submit that content. See our Terms of Servicefor restrictions on submitting another person's likeness, voice, or biometric data without sufficient rights.

3.4 Workspace and Collaboration Information

If you use the Service through a Workspace, team, or organization, we process information about that Workspace and its members, including roles, seats, member identifiers, sharing settings, access permissions, member activity, credit allocations, and billing information for the Workspace administrator. The Workspace administrator may have access to information about Workspace members and their activity within the Workspace.

3.5 Usage and Device Information

• IP address, approximate location inferred from IP, internet service provider, device type, operating system, browser type and version, language, screen size, referring URL, exit URL, pages and screens viewed, links clicked, time spent, and other interaction signals;
• cookie identifiers, mobile and other unique identifiers, MAC address, and similar device identifiers;
• performance and diagnostic data, error logs, telemetry, request IDs, and security signals; and
• information collected through cookies, pixel tags, web beacons, local storage, and similar technologies (see Section 6).

3.6 Bot and Abuse Detection (Cloudflare Turnstile)

To protect account registration, social sign-in, one-time passcode flows, and other security-sensitive interactions from spam, fraud, and automated abuse, we use Cloudflare Turnstile, including its invisible mode. Cloudflare may receive technical and connection information such as your IP address, user agent, browser and device characteristics, TLS fingerprint, sitekey, origin, and request metadata. We use this only to distinguish humans from bots and to help keep the Service safe and available. See Cloudflare's Turnstile Privacy Addendum and Privacy Policy.

3.7 Information from Third Parties

We may receive information about you from authentication providers, referral partners, business partners, marketing or analytics providers, fraud-prevention providers, or — if you use the Service on behalf of an organization — from that organization. We handle such information consistent with this Policy and the terms under which it was provided to us.

3.8 Surveys, Contests, and Events

When you participate in surveys, contests, conferences, webinars, or events that we host, run, or sponsor, you may provide information such as name, email address, mailing address, demographic data, and event-specific responses.

4. How We Use Personal Information

We use personal information and Customer Content (including Inputs, Outputs, and metadata) for the following business purposes. Where required by applicable law, we rely on a lawful basis described in Section 11.

4.1 Provide and Operate the Service

• create and maintain accounts, Workspaces, and authentication;
• receive, process, route, and store Inputs and Outputs;
• transmit Inputs and Outputs to AI Model providers, GPU/inference providers, and storage providers as needed to fulfill your requests;
• personalize the Service, remember your preferences, and recommend features;
• process subscriptions, credits, payments, refunds, and invoices; and
• provide customer support and respond to your inquiries.

4.2 AI Model Training and Product Improvement

We may use User Content (including Inputs, Outputs, references, and project data), Feedback, metadata, usage data, telemetry, and related information to train, fine-tune, evaluate, benchmark, test, develop, enhance, evolve, and improve StoryFlow AI, Inc.'s and its affiliates' AI Models, algorithms, machine-learning systems, classifiers, products, services, and related technologies. This may include human or automated labeling, classification, content moderation, abuse and fraud detection, safety review, quality control, and model evaluation.

These uses apply to the default consumer, free, pro, and team plans. They do not apply to the extent restricted by an applicable account or workspace setting we expressly designate as restricting AI training or product-improvement use, by a plan-specific term we publish, or by a Separate Agreement (such as an Enterprise Agreement, DPA, order form, or enterprise terms) that expressly modifies or limits these rights for the customer covered by that Separate Agreement.

4.3 Trust, Safety, and Security

• detect, prevent, investigate, and respond to fraud, abuse, illegal activity, security incidents, and policy violations;
• scan, classify, label, filter, restrict, refuse, remove, and moderate User Content for compliance with our Acceptable Use Policy and applicable law;
• verify identity for security-sensitive actions; and
• protect the rights, property, safety, and security of StoryFlow AI, Inc., our users, and the public.

4.4 Analytics and Research

We use personal information for analytics, research, benchmarking, performance monitoring, and quality improvement, including by generating aggregated, de-identified, or anonymized data. We may retain and use such aggregated, de-identified, or anonymized data indefinitely without further notice to you.

4.5 Marketing, Promotional, and Showcase Use

Subject to the visibility settings then in effect for your User Content, applicable plan-specific terms, and any Separate Agreement that modifies these rights, we may use User Content, Inputs, Outputs, your public profile, username, displayed name, public Workspace name, public projects, public workflows, public templates, and public remixes for marketing, promotional, social, showcase, advertising, sales, investor, partner, case study, educational, demonstration, gallery, marketplace, community, and discovery purposes — including through our website, blog, product surfaces, social channels, ads, sales decks, presentations, press materials, and other media.

We may also send you direct marketing communications about the Service, new features, or events, where permitted by law. You can opt out of marketing emails at any time using the unsubscribe link or by contacting us.

4.6 Legal and Compliance

We use personal information to comply with applicable laws, regulations, court orders, subpoenas, and governmental requests; to enforce these Terms; to establish, exercise, or defend legal claims; and to protect our legitimate business interests.

5. How We Share Personal Information

We share personal information only as described below.

5.1 Affiliates

We share personal information with our parent, subsidiaries, and other affiliates for the purposes described in this Policy.

5.2 Service Providers and Subprocessors

We share personal information with vendors that perform services for us — including AI model providers, GPU and inference providers, hosting and infrastructure providers, storage providers, analytics providers, payment processors, fraud-prevention and bot-detection providers, content-moderation and trust-and-safety providers, customer support tools, email and notification providers, marketing providers, and professional advisors. These providers are permitted to process your information only on our instructions and for the purposes for which we engaged them.

5.3 Third-Party Subprocessors

The following table identifies third-party subprocessors authorized to process customer or personal data on behalf of StoryFlow AI, Inc. to provide the Service. We may add or remove subprocessors over time.

5.4 Workspace and Shared Content

If you use the Service in a Workspace, members and administrators of that Workspace may see your activity, content, and account information within the Workspace. If you make User Content public (for example, by posting to a community, gallery, marketplace, showcase, share, or remix surface, or by sharing a link), other users and members of the public may view, copy, download, cache, screenshot, share, repost, or remix that content. We do not control how third parties use Public Content.

5.5 Marketing and Promotional Use

As described in Section 4.5, we may use User Content, Inputs, Outputs, public profile information, and other content for marketing and promotional purposes through our website, ads, social media, sales materials, and other channels.

5.6 Advertising Matched Audiences

We may share hashed customer identifiers (such as a SHA-256 hash of your email address) with advertising platforms such as X (formerly Twitter) to create matched audiences. We currently use matched audiences for suppression — that is, to exclude existing customers from paid advertising campaigns so you see fewer irrelevant ads — and we do not upload raw (unhashed) contact details. These platforms are permitted to use the uploaded lists only to perform matching on our behalf, not for their own purposes. You can opt out of matched-audience sharing at any time by contacting us at support@astorie.ai; opt-outs are recorded on your account and take effect no later than the next list refresh (within one month).

5.7 Legal, Safety, and Compliance Disclosures

We may disclose personal information when we believe in good faith that disclosure is necessary or appropriate to: comply with applicable law, regulation, legal process, court order, subpoena, or governmental request; enforce these Terms or other agreements; protect the rights, property, safety, or security of StoryFlow AI, Inc., our users, or the public; respond to claims of intellectual-property infringement; or prevent or investigate fraud, abuse, or technical or security issues.

5.8 Business Transfers

We may share or transfer personal information in connection with, or during negotiations of, a merger, acquisition, financing, sale of assets, reorganization, bankruptcy, or other change of control or business transfer, or in the unlikely event we go out of business. The acquirer or successor may continue to process your personal information consistent with this Policy or as otherwise permitted by law.

5.9 With Your Consent

We may share personal information with other parties when you direct us to or otherwise consent.

6. Cookies and Tracking Technologies

We use cookies, pixel tags, web beacons, local storage, and similar technologies (collectively, "Technologies") on the Service. Categories include:

• Essential Cookies: required for authentication, security, and core functionality.
• Basic Analytics Cookies: help us measure and improve the Service through tools such as PostHog, Vercel Analytics, Vercel Speed Insights, and Ahrefs Web Analytics. These are included in the required Basic settings.
• Preference Cookies: remember preferences such as language, theme, and most recently selected workspace.
• Marketing Cookies: support advertising and marketing tags we run through Google Tag Manager on an opt-out basis, or after you consent where you have made a choice.

You can choose Basic or Full settings through the Cookie settings link in our footer or your browser. Basic settings are required; Full settings also allow optional marketing and advertising tags. Marketing and advertising tags are active by default and you can turn them off at any time through the same Cookie settings link; a saved choice is always respected. We honor Global Privacy Control (GPC) browser signals as an opt-out of marketing and advertising tags, including over a previously saved setting.

7. Automated Decision-Making and AI Processing

The Service uses AI Models and automated systems to: generate Outputs in response to your Inputs; recommend features, models, templates, or workflows; detect and prevent abuse, fraud, and policy violations; classify, label, and moderate content; and measure quality and performance. We do not use automated decision-making to make decisions that produce legal effects concerning you or similarly significantly affect you, except where such processing is necessary for entering into or performing a contract with you, is authorized by law, or is based on your explicit consent.

You may have the right to request human review of an automated decision that significantly affects you, to express your point of view, and to contest the decision. Contact us using the details below to exercise these rights.

8. Retention and Deletion

We retain personal information for as long as needed to fulfill the purposes described in this Policy, including providing the Service, complying with legal, accounting, audit, tax, fraud- prevention, safety, and reporting obligations, resolving disputes, and enforcing our agreements. Specific guidance:

• Account Information: retained for the duration of your account plus a reasonable period (generally 30 days) after account deletion, unless longer retention is required by law.
• Customer Content (Inputs, Outputs, projects): retained for the duration of your account or until you delete it, plus a reasonable period for backups, abuse investigation, and operational purposes.
• Transaction and billing records: retained for up to 7 years to comply with tax, accounting, and financial obligations.
• Communication records: retained for up to 3 years for customer service and legal purposes.
• Logs, telemetry, and analytics: typically retained in identifiable form for a limited operational period and in aggregated or anonymized form for longer periods.

When we no longer need personal information, we will delete, aggregate, or anonymize it, or isolate it from further use. However:

• personal information may persist in routine backups, logs, audit trails, caches, or content-delivery systems for additional time before being purged on the standard schedule;
• we may retain information longer when required by law, in response to a litigation hold, regulatory or law-enforcement request, abuse investigation, or to enforce or defend our legal rights; and
• information that has been used to train, fine-tune, or evaluate an AI Model, or that has been incorporated into aggregated, de-identified, or anonymized datasets, may persist in model parameters or derived datasets even after deletion of the source content, and we are not obligated to retrain models or remove parameters in response to a deletion request, except as required by applicable law.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. No system can be guaranteed to be completely secure, and we cannot guarantee the security of any information you transmit to us or store on the Service.

9.1 Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Our notification will describe the nature of the breach, likely consequences, mitigating measures, and contact information for further inquiries.

10. International Data Transfers

We are based in the United States, and we and our service providers may process personal information in the United States and other countries that may have different data-protection laws than your country of residence. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland to a country that has not been recognized as providing an adequate level of protection, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or other legally accepted means.

11. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal information on the following lawful bases:

• Contract: to provide the Service you have requested or to take steps at your request before entering into a contract.
• Legitimate interests: to operate, secure, and improve the Service; to develop, train, fine-tune, and evaluate our AI Models and related products and services; to detect and prevent abuse and fraud; to market our Service; to understand our audience; and to protect our legal rights — in each case where these interests are not overridden by your rights and interests.
• Legal obligation: to comply with applicable law, regulation, court orders, or governmental requests.
• Consent: where required by law (for example, for certain marketing or cookie uses), based on your consent, which you may withdraw at any time without affecting the lawfulness of prior processing.

12. Your Rights and Choices

Subject to applicable law and verification of your identity, you may have the following rights with respect to your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete personal information.
• Deletion: request that we delete personal information we hold about you. Where you have a right to deletion, we will take reasonable steps to delete your personal information from our active systems, subject to the limitations described in Section 8 (including the AI-training and aggregated- data carveouts).
• Portability: request a copy of certain information you have provided to us in a structured, commonly used, machine-readable format.
• Restriction: request that we restrict our processing in certain circumstances.
• Objection: object to processing based on our legitimate interests, including for direct marketing.
• Withdraw consent: where we rely on consent, withdraw consent at any time without affecting the lawfulness of prior processing.
• Marketing opt-out: opt out of marketing communications using the unsubscribe link or by contacting us.
• Complaints: lodge a complaint with your local data-protection authority.

To exercise these rights, contact us at support@astorie.ai. We will respond within the time periods required by applicable law, typically within 30 days. We may need to verify your identity before processing your request and may decline requests where permitted by law (for example, where the request would impair the rights of others or where we must retain information to comply with legal obligations).

13. U.S. State Privacy Disclosures

If you are a resident of California or another U.S. state with comprehensive privacy legislation, you may have additional rights, including the rights to know, access, correct, delete, and opt out of certain sharing or sale of personal information, and the right not to be discriminated against for exercising these rights. We do not knowingly "sell" personal information for money, but our use of certain advertising and analytics Technologies, and our sharing of hashed identifiers for advertising matched audiences (Section 5.6), may be considered a "sale" or "sharing" under some state laws. For United States visitors these tags run on an opt-out basis. You can opt out of marketing and advertising tags through the Cookie settings link in our footer, and we honor Global Privacy Control (GPC) browser signals as a valid opt-out request, even when they conflict with a previously saved site setting. You can opt out of matched-audience sharing by contacting us; matched-audience opt-outs are recorded on your account and take effect no later than the next list refresh.

Shine the Light (California):California residents may request information about the categories of personal information we have shared with third parties for those parties' direct-marketing purposes during the prior calendar year. To make a request, contact us with "California Privacy Rights Request" in the subject line.

Do Not Track:we do not currently respond to browser "Do Not Track" signals.

14. Children

The Service is not intended for individuals under the age of 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

15. Enterprise and Separate Agreements

Enterprise customers and certain other customers may enter into a Separate Agreement with us — for example, an Enterprise Agreement, DPA, order form, or enterprise terms — that may modify how we process customer data, including with respect to AI training, retention, data residency, audit rights, security commitments, and confidentiality. To the extent any such Separate Agreement conflicts with this Privacy Policy with respect to the same subject matter for that customer, the Separate Agreement controls for that customer.

To request enterprise terms, please contact us through our contact page or at support@astorie.ai.

16. Other Sites and Services

The Service may link to or integrate with third-party websites or services. We are not responsible for the privacy practices or content of those third parties. Please review their privacy policies before providing personal information.

17. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective Date" above and, where required or appropriate, take reasonable steps to notify you (for example, by email, in-product notice, or by re-prompting you to accept the updated Policy). Where required by law, we will obtain your consent before applying material changes that require it.

18. Contact Us

Astorie is operated by StoryFlow AI, Inc.. For any questions, requests, or concerns regarding this Privacy Policy or our data practices, contact us at support@astorie.ai, visit our Contact page, or write to 1003 Post St, Apt 8, San Francisco, CA 94109, United States.