Privacy Notice

This notice explains what StoryEmbed collects, why, and who we share it with. The data controller is Story Embed, Isidora Goyenechea 2800, Santiago, Chile. For anything in this notice, contact [email protected].

What we collect

Data	Why	Basis
Name, email address and profile picture from your Google account	To create and identify your account	Performance of a contract
Session token stored in a cookie	To keep you signed in	Strictly necessary
The Instagram handles you add	To retrieve and serve their stories	Performance of a contract
Story media and metadata for those handles	To render your widget	Performance of a contract
Subscription status and billing identifiers	To grant the plan you paid for	Performance of a contract
Usage analytics	To understand how the site is used	Consent / legitimate interests

We do not receive or store your Google password, and we never see your card details — those go directly to our payment provider.

Who we share it with

• Google — sign-in, hosting on Google Cloud, and Google Analytics. Google Fonts are loaded from Google's servers, which receives your IP address.
• Paddle.com Market Ltd — merchant of record for payments. Paddle collects the billing information needed to process your purchase and is its own controller for that data.
• MongoDB Atlas — database hosting for account and story records.
• Redis Cloud — queueing of story refresh jobs.

We do not sell your personal data.

Instagram content

When you add a handle, we retrieve that account's currently active stories and store the media references needed to display them. Stories older than your plan's window stop being served. We are not affiliated with Instagram or Meta Platforms, Inc., and their handling of your data is governed by their own policies.

How long we keep it

• Account data: for as long as your account exists, then deleted on request.
• Session tokens: 30 days, or until you sign out.
• Story records: until they fall outside your plan's retention window.
• Billing records: as long as required for tax and accounting purposes.

Cookies

We set one strictly necessary cookie to keep you signed in, plus short-lived cookies during Google sign-in to prevent cross-site request forgery. Google Analytics sets its own cookies to measure usage.

Your rights

Depending on where you live, you may have the right to access, correct, delete, export or restrict processing of your data, and to object to it. To exercise any of these, email [email protected] and we will respond within 30 days. You can also complain to your local data protection authority.

International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States and the European Union. Transfers rely on the safeguards those providers put in place, such as standard contractual clauses.

Children

StoryEmbed is not intended for anyone under 18 and we do not knowingly collect their data.

Changes

We will update this notice as the service changes, and will note the date of the most recent revision at the top.