Privacy Policy

This Privacy Policy explains what Storiara Inc. ("Storiara", "we", "us") collects, how we use it and the choices you have. It covers our website, storiara.com (the "Site"), and the Storiara production planning service at app.storiara.com and in dedicated customer environments (the "Service").

When a production company or school uses the Service to manage its own cast, crew and projects, it decides what is entered and why. In that case Storiara handles the information on its behalf, under our agreement with that customer, and requests about that information are best sent to the customer first.

a. Account information

When you create an account or contact us, we collect:

• Your name and email address
• Your sign-in details. If you sign in with Google or Apple, we receive your name and email address from them, and never your password
• Your phone number, if you add one
• Your school or company, if you tell us

b. Payment information

Payments for paid plans are handled by Stripe. Card details are entered on Stripe's pages and are not stored by Storiara. We keep a record of your plan, its status and your billing history.

c. Content you add to the Service

The Service stores what you and your team put into it, including:

• Scripts, breakdowns, scenes, schedules, budgets, call sheets, receipts and images
• Details of cast, crew and other contacts on your production, such as names, email addresses, phone numbers, roles, availability and rates
• Comments, messages and other activity inside a project

If you add information about other people, you are responsible for having the right to share it with us.

d. Usage and device information

When you use the Site or the Service, we collect the browser type and version, IP address, device type, pages visited, the date and time of access and referring URLs. Inside the Service we also keep sign-in records and logs of activity in a project, so project owners can see who changed, opened, exported or sent what.

e. Cookies and similar technologies

The Service uses cookies and browser storage to keep you signed in and remember your settings. The Site uses a Google Ads tag to measure how our own advertising performs. You can block or delete cookies in your browser settings; the Service needs its sign-in storage to work.

f. Calendar data

If you choose to connect your calendar for scheduling features, we access:

• Free/busy information for scheduling purposes
• Calendar availability for shoot scheduling

We do not access, read, or store any other information from your calendar, such as event titles, descriptions, locations, or attendees. This access is read-only and temporary.

Calendar data deletion: You can disconnect your calendar at any time through your account settings. When disconnected, we immediately revoke access to your calendar and delete any cached availability data. No calendar information is permanently stored on our servers.

We use the information we collect to:

• Provide the Service: store your projects, produce breakdowns, schedules and budgets, and send the call sheets, invitations and messages you ask us to send
• Create and secure your account, and prevent abuse
• Process payments and send receipts and service notices
• Answer questions and support requests
• Understand how the Site and the Service are used so we can improve them
• Send product updates and newsletters, which you can opt out of at any time
• Meet legal and regulatory obligations
• Sync calendar availability for production scheduling

The Service uses AI models to read scripts and other documents you upload and turn them into breakdowns, schedules, budgets and images. To do this, the relevant content is sent to Google's Gemini models on Google Cloud, under our own cloud account. Descriptions of budget lines are sent to TypeSafe to match them to production incentive rules.

We do not use your content to train AI models, and Google Cloud's terms say customer data is not used to train its models. You keep ownership of everything you upload.

We do not sell or rent your personal information. We share it only with:

• Service providers that process it for us under contract: Google (cloud hosting, database, file storage, sign-in, AI models, maps and weather), Stripe (payments), Twilio (email and text messages), Mapbox (maps and address search), TypeSafe (incentive tagging of budget lines) and Resend (messages sent through our contact form)
• People you choose: members of your projects, and anyone you send a call sheet, availability form or shared link to. These links open without a sign-in, so send them only to the people who need them
• Authorities, when the law requires it
• A successor, if Storiara is involved in a merger, acquisition or sale of assets, under the protections of this policy

The Google Ads tag on the Site sends Google information about visits to the Site, such as your IP address and the pages you viewed, so we can measure our advertising. It never receives your project content.

Storiara is based in the United States, and the Service stores information in Google Cloud data centers in the United States. If you use the Service from another country, your information is transferred to and processed in the United States. For customers who need one, we offer a data processing agreement that includes the European Commission's standard contractual clauses.

We keep your information for as long as your account is open, and afterwards only as long as needed for the purposes in this policy or as the law requires, for example for transaction records.

Calendar data: We do not store your calendar event details on our servers. When you sync your calendar, we temporarily access your free/busy information in memory to determine your availability for production scheduling. This data is not retained after the sync process is complete. The authentication token granting access to your calendar is used for a single session and is not stored.

Calendar data deletion: Calendar connections can be revoked immediately through your account settings. When you disconnect your calendar, we instantly delete any cached availability data and revoke all access permissions. Calendar data is never permanently stored, ensuring your calendar information remains private and under your control.

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal data
• Receive a copy of your data in a portable form
• Withdraw consent
• Object to or restrict data processing
• File a complaint with a data protection authority

You can correct most information, export a project and delete a project or your account from inside the Service. To exercise any other right, email us at [email protected]. We do not treat you differently for using these rights.

You can ask us to delete your personal data. When you do:

• We delete your account and the personal information associated with it
• Projects you own, with their scripts and generated content, are deleted, or transferred to another member if you ask
• Calendar connections are immediately disconnected and any cached availability data is deleted
• We keep only what the law requires or what we need for legitimate business purposes, such as transaction records

Account deletion: You can delete your account at any time through your account settings, or by contacting us at [email protected]. Account deletion is irreversible.

Timing: Deletion requests are completed within 30 days of verification. Copies held in backups expire within 7 days after the data is deleted from the live Service.

We protect your information with encryption in transit and at rest, access rules that limit each project to its members, daily backups, audit logging and restricted administrator access. Our security page and our trust center at trust.storiara.com describe these measures. No internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security.

To report a security concern, email [email protected].

The Site and the Service are for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

The Site may contain links to external websites. We are not responsible for their privacy practices, so please review their policies separately.

We may update this Privacy Policy from time to time. When we do, we change the date at the top of this page. Continued use of the Site or the Service after a change means you accept the updated policy.

Questions or concerns?