1. Scope and our role
StoryFluxa stores the materials needed to run your workspace and shares selected materials with contracted service providers only when needed to deliver, secure or support a feature you request.
This policy applies to the StoryFluxa website, creator workspace, account and billing features, automated video workflows and supported social publishing connections. It does not replace the privacy policies of TikTok, Google/YouTube, Meta/Instagram, the payment provider displayed at checkout, or other third-party services you choose to use.
2. Data we collect
Account and support information
- Email address, authentication identifiers and secure session information.
- If you continue with Google, the authentication service receives your verified email address, name, profile image and Google account identifier. StoryFluxa does not receive your Google password.
- Server-controlled records showing the legal terms version, acceptance method and acceptance time when an account is created or Google sign-in is used.
- Messages, content-safety reports, rights complaints, appeals and diagnostic information you send to support, including the content or generation identifiers and supporting information you choose to provide.
Content and project information
- Reference videos or public links, product footage, presenter videos, voice samples, transcripts, scripts, captions, covers, music and finished renders.
- Project settings, generation status, provider job identifiers, usage, errors and credit records.
- Voice and content-rights confirmations, including the time you confirmed you had permission to use a voice, likeness, media or music.
Connected social account information
- When social publishing is enabled and you connect an account: the platform account identifier, display name, granted permissions, authorization tokens, token expiry, publishing choices and post status returned by the platform.
- We do not ask for or store your TikTok, Google/YouTube or Instagram password.
Billing and technical information
- Payment-provider customer, checkout, order, transaction and subscription identifiers; payment and refund status; selected plan; credit balance; and billing history. StoryFluxa does not receive your full card number.
- IP address, browser and device details, request logs, cookie identifiers, security events and performance/error logs.
3. How we use data
- Authenticate users by email and password or, when selected, through Google as an identity provider, and keep each workspace private.
- Associate a verified sign-in identity with an existing StoryFluxa account that uses the same verified email address so the user retains one workspace and credit account.
- Upload, transcribe, rewrite, generate voice, synchronize lips, render, store and deliver videos and related assets.
- Publish content to a social account only after the user selects the account, post settings and publishing action.
- Process subscriptions, credits, usage and service-related communications.
- Secure the service, prevent abuse, investigate content-safety and rights reports, enforce the content standards in our Terms, troubleshoot failures and comply with legal obligations.
- Improve reliability and usability using operational information. We do not sell personal data or use connected-platform data for targeted advertising.
Where applicable law requires a legal basis, we rely on performance of our contract, legitimate interests in operating and protecting the service, compliance with law, and consent where the law or a platform requires it.
4. AI models used
StoryFluxa uses AI models such as OpenAI GPT and Google Gemini Flash to provide its media creation features.
StoryFluxa does not use customer content to train a StoryFluxa general-purpose model. We do not authorize third parties to use connected Google user data or social authorization data to train general-purpose models. Provider retention and training controls must be configured consistently with this policy before a provider is enabled in production.
6. When data is shared
We share data only as needed to provide the service, protect users, complete a transaction or follow law. Categories of recipients may include:
- Authentication providers: contracted identity services manage application identities and sessions; Google acts as an identity provider when the user selects Google sign-in.
- Hosting and storage providers: contracted infrastructure services host the application and store private account, project and media data.
- AI and media-processing providers: contracted processors receive only the text, audio, video, image or composition data needed to perform the transcription, rewriting, voice, lip-synchronization or rendering feature requested by the user.
- Payment services: the provider displayed at checkout processes payments, identity and fraud checks, taxes, invoices, subscriptions, refunds and chargebacks according to its role in a transaction.
- User-directed publishing platforms: TikTok, Google/YouTube or Meta/Instagram receive content and publishing settings only when you connect the corresponding account and request a publishing action.
- Professional and legal recipients: advisers, authorities or transaction counterparties when reasonably required and legally permitted.
We require service providers to process data for the contracted service and apply appropriate safeguards. We do not sell your uploaded content or social account data.
7. Cookies
StoryFluxa currently uses essential cookies and similar storage for authentication, session continuity, security and saved workspace state. The payment provider displayed at checkout or a connected platform may set its own cookies when you visit its checkout, customer portal or authorization pages. If StoryFluxa later adds non-essential analytics or advertising cookies, we will provide any notice and choice required by applicable law before using them.
8. Retention and security
- Account and project content is normally retained while your account is active or until you delete it or request deletion.
- Google sign-in creates a secure StoryFluxa application session; StoryFluxa does not store a Google access token or refresh token for authentication-only login.
- Social publishing authorization tokens are retained until they expire, you disconnect the account, the platform revokes them, or your StoryFluxa account is deleted.
- Billing, credit, fraud-prevention, security and legal records may be retained for the period required by tax, accounting, dispute and legal obligations.
- Backups and provider logs may take additional time to age out under controlled retention schedules.
StoryFluxa uses private object storage, row-level access controls, short-lived signed media links, server-only provider credentials and access checks. No internet service can promise absolute security, so please report suspected unauthorized access promptly.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, delete or restrict certain processing, withdraw consent, or object to some uses. You may also:
- Disconnect a social account in StoryFluxa when that control becomes available and revoke the app directly in the platform's account settings.
- Delete individual project assets where the workspace provides a delete control.
- Report prohibited content, an unauthorized likeness or a rights concern through the content-safety reporting channel in our Terms. Do not send suspected CSAM as an attachment.
- Request account and data deletion using our data deletion instructions.
- Contact us to ask what personal data is associated with your account.
We may verify your identity before completing a request. You may appeal or contact your local privacy authority where applicable.
10. International transfers
StoryFluxa and its providers may process data in countries other than your own. Where required, we use contractual or other recognized safeguards for international transfers. The availability and location of a specific processor may depend on the provider configuration used for your generation.
11. Children
StoryFluxa is a commercial creator tool and is not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to create an account. Do not upload a minor's voice, likeness or personal data unless you have all legally required parental or guardian permissions.
12. Changes to this policy
We may update this policy when the product, providers or legal requirements change. We will update the effective date and provide additional notice when a material change requires it.
13. Contact
Data controller/operator: StoryFluxa.
Privacy and support email: support@storyfluxa.com.
5. TikTok, YouTube and Instagram data
You authorize your own account through the platform's official screen. StoryFluxa uses the granted access only for the publishing features shown in the product.
Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We request the narrowest permissions needed, do not sell connected-platform data, and do not transfer it for advertising or data-broker purposes.
You can revoke StoryFluxa from the relevant platform settings. Revocation stops future API access but does not automatically delete content that was already published on that platform.