StoryStudio
Privacy policy
This policy explains how BFC GROUP ("we", "StoryStudio") collects and processes personal data when you use storystudio.cc, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data-protection law.
1. Data controller
BFC GROUP — SAS with share capital of €10,748 Registered office: 14 rue Artaud, 69004 Lyon, France SIREN: 830 940 979 Privacy contact: [email protected]
No Data Protection Officer (DPO) has been appointed. For any privacy question, contact us at the address above.
2. Data we collect
Depending on how you use StoryStudio, we process:
- Account data: e-mail address, phone number, and a user identifier — managed through Firebase Authentication.
- Content data: your prompts, uploaded reference images and videos, generated media (images/videos), projects and "story bible" data — stored on Cloudflare R2 and, where applicable, in Firestore.
- Payment data: subscription and credit purchases are processed by Stripe. StoryStudio does not store your card numbers.
- Integration data: MCP / OAuth tokens and, if you choose to connect them, your social-media account authorisations (TikTok, Meta, LinkedIn, YouTube).
- Technical data: server logs and audience statistics via Google Analytics 4, only if you accept the cookie banner (see Section 7).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account, providing the service | Performance of the contract (Art. 6.1.b) |
| Processing payments, credits and subscriptions | Performance of the contract; legal obligation (Art. 6.1.b/c) |
| Generating content via AI providers | Performance of the contract (Art. 6.1.b) |
| Security, fraud prevention, logs | Legitimate interest (Art. 6.1.f) |
| Audience measurement (Google Analytics) | Your consent, via the cookie banner (Art. 6.1.a) |
| Publishing to your social accounts | Your consent, when you connect an account (Art. 6.1.a) |
4. Processors and recipients
We share data with the following processors and recipients, strictly to operate the service:
| Processor | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, media storage (R2), AI (Workers AI, Vectorize), firewall | United States |
| Google / Firebase | Authentication (email + phone), Firestore database, Google GenAI models (Veo, Gemini) | USA / Ireland |
| Stripe | Payments, credits, subscriptions | Ireland + USA |
| Replicate, Inc. | AI model inference (image/video) | United States |
| ByteDance / BytePlus (ModelArk) | Seedance video generation | Singapore / USA |
| fal.ai | Model inference (fallback) | United States |
| ElevenLabs | Voice-over / dubbing | United States |
| Google LLC (Google Analytics 4) | Audience statistics, only after consent | USA (Data Privacy Framework) |
| TikTok, Meta, LinkedIn, YouTube | Publishing, only if you connect your accounts | United States |
We do not sell your personal data. Content you submit to AI providers is processed to generate your outputs, subject to those providers' own terms.
5. Transfers outside the European Union
Several processors are located outside the EU, notably in the United States. These transfers are governed by appropriate safeguards under Articles 44 et seq. GDPR, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, certification under the EU–U.S. Data Privacy Framework.
6. Retention
- Account and content data: kept for as long as your account is active, then deleted within 3 years after account closure.
- Generated media and projects: kept until you delete them or close your account.
- Billing records: kept for 10 years to meet accounting and tax obligations.
- Logs: kept for 3 years.
7. Cookies and similar technologies
StoryStudio uses:
- Strictly necessary cookies/technologies, exempt from prior consent: authentication session (Firebase); payment flow (Stripe Checkout).
- Audience measurement (Google Analytics 4), only after you accept the cookie banner shown on your first visit. We use Google's Consent Mode v2: analytics storage defaults to denied and is only enabled if you click "Accept". You can withdraw your consent at any time by clearing your browser's local storage for this site.
No advertising or advertising-retargeting trackers are present.
8. Your rights
Under the GDPR you have the rights of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw consent (for social publishing) at any time.
You can exercise these rights at [email protected]. We respond within one month. You may also lodge a complaint with the French authority (CNIL — www.cnil.fr), the Spanish authority (AEPD — www.aepd.es), or your local supervisory authority.
9. Children
StoryStudio is not intended for children. You must be at least 16 years old to create an account.
10. Security
We apply appropriate technical and organisational measures to protect your data. However, no online service can guarantee absolute security.
11. Changes
We may update this policy. The applicable version is the one published on this page at the date of your consultation.
Last updated: 1 July 2026.