Privacy Policy

1. Data controller and contact details

The data controller is Winnow Communication, VAT number 05004790266, Italy.

Email for any privacy request: info@winnowcommunication.com

STOORY is a digital publishing platform operated by Winnow Communication.

2. Categories of personal data processed

Depending on the features you use, we may process:

• Account and identity data: name, surname, email address, chosen username or pen name, optional phone number, country;
• Authentication and security data: account identifiers, one-time codes (OTP), session information, authorised devices, IP address, user agent, access logs and security logs;
• Purchase and payment data: purchased product, amount, currency, order date, payment status, transaction identifiers, purchase history, and billing information where required;
• Reading and library data: purchased works, reading progress, last position read, active sessions and authorised devices;
• Content you provide: story ideas, prompts, titles, synopses, characters, drafts, manuscripts, uploaded documents (Word, PDF, text) and images;
• Creator data: creator profile, age declaration, country, sales, accrued royalties, payouts, selected plan and Stripe Connect identifiers;
• Support data: email address, name, content of your request and any attachments;
• Technical/navigation data: IP address, browser, operating system, device, requested pages, date and time and diagnostic information;
• TikTok integration data (only for creators who explicitly connect a TikTok account) — see section 10.

Passwords, where used by the authentication system, are never stored in clear text.

3. Purposes of processing

We process personal data to:

• create and manage your account and authenticate you;
• process orders and payments and deliver purchased works;
• maintain your personal library and reading progress;
• generate, review and publish stories and series, including creator works;
• manage creator earnings, royalties and payouts;
• provide customer support;
• prevent fraud, abuse and unauthorised access, and protect our systems;
• comply with tax, accounting and other legal obligations;
• publish creator promotional content to TikTok when a creator explicitly requests it;
• send service communications and, with consent, newsletters or commercial communications.

4. Legal bases

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): account creation, authentication, purchases, delivery of works, library, creation services, creator services and support.

Compliance with legal obligations (Art. 6(1)(c) GDPR): tax, accounting and administrative obligations and requests from competent authorities.

Legitimate interests (Art. 6(1)(f) GDPR): information security, fraud prevention, protection of our systems and rights, aggregated statistics and technical improvement of the service.

Consent (Art. 6(1)(a) GDPR): newsletters and commercial communications, non-essential cookies and analytics, and the optional TikTok connection. Consent can be withdrawn at any time without affecting processing carried out before withdrawal.

5. Payments and payment providers

Payments are processed by specialised providers, in particular Stripe (including Stripe Connect for creator payouts).

STOORY does not store full payment card details when these are collected directly by the payment provider. The provider processes the data required to complete the transaction, prevent fraud and comply with its own legal obligations, acting as an independent controller or as a processor depending on the activity.

6. Cookies and analytics

STOORY uses cookies and similar technologies. Strictly necessary cookies are used to operate the site, maintain sessions and protect security.

Non-essential cookies, including analytics and marketing pixels where present, are used only in accordance with the preferences you express in the consent banner. Further details are available in the Cookie Policy (/cookie).

7. Automated processing and artificial intelligence

STOORY uses artificial intelligence services to support editorial production, such as narrative development, text generation and revision, consistency checks, synopses, cover and promotional image generation, translations and quality control.

Where necessary to provide the requested service, the information you submit may be transmitted to our technology providers. You should not include unnecessary personal data of third parties in prompts or uploaded documents.

These processes are not used to make solely automated decisions producing legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Anti-fraud systems operated by payment providers may be subject to their own notices.

8. Retention periods

Data is retained only for as long as necessary for the purposes for which it was collected. Indicatively:

• account data: for the duration of the relationship and thereafter as needed to protect legal rights;
• contractual, accounting and tax data: up to 10 years, as required by law;
• orders and transactions: for the period required by tax and accounting rules;
• creator data, sales and payouts: for the duration of the relationship and applicable tax obligations;
• library and reading progress: while needed to provide the service or while the account remains active;
• uploaded and generated content: for the time needed to provide the service, maintain the library, publish the work or honour rights agreements;
• support requests: normally up to 24 months;
• security logs: for the period necessary for security and abuse prevention;
• TikTok access and refresh tokens: until the creator disconnects the integration, the token is revoked, or it expires;
• cookies: for the durations indicated in the Cookie Policy.

After the applicable period, data is deleted, anonymised, or retained only where required by law.

9. Service providers and third parties

Personal data may be disclosed, strictly to the extent necessary, to providers supporting the operation of STOORY, including:

• hosting, cloud and database infrastructure providers;
• authentication services;
• payment providers (Stripe, Stripe Connect);
• email delivery providers;
• security services;
• artificial intelligence and media generation providers;
• TikTok, when a creator uses the TikTok integration;
• tax, accounting and legal advisers;
• public authorities where required by law.

These parties act as processors, independent controllers or sub-processors depending on the case. An up-to-date list of the main categories of providers can be requested from the data controller.

10. TikTok integration and data obtained through TikTok APIs

Purpose of the integration. The TikTok integration is used only by authorised STOORY administrators to publish short, non-promotional narrative videos based on real stories from the STOORY catalogue to STOORY's official TikTok account. STOORY readers and users are not asked to connect their own TikTok account. The integration is never used for advertising profiling, building audiences, or reading private TikTok activity.

Consent. The account is connected only through the official TikTok OAuth flow (Login Kit). Before every post, the administrator sees the authorised account returned by TikTok (creator_info), confirms the caption, chooses a visibility among the options TikTok allows, and explicitly consents to publishing. STOORY never asks for or stores TikTok passwords.

Permissions/scopes used. STOORY requests only the following TikTok scopes:

• user.info.basic — to retrieve the basic public profile information of the connected account (open ID, display name and avatar) in order to show which TikTok account is connected and to associate published videos with it;
• video.publish — to upload and publish editorial videos to the connected account only after the explicit confirmation described above (Content Posting API, Direct Post), together with the publishing status returned by TikTok.

Data obtained through TikTok APIs. Through these scopes we process: the TikTok open ID and union ID, display name and avatar URL of the connected account, the OAuth access token, refresh token, their expiry and granted scopes, and the identifiers and publishing status of videos submitted by STOORY. We do not collect TikTok followers, direct messages, comments, or videos that were not published through STOORY.

Security of TikTok credentials. TikTok access and refresh tokens are stored server-side only, in our protected database, are never exposed to the browser, never included in public pages or client-side code, and are never shared with third parties. Access is restricted to the server functions that perform authorisation and publishing.

How to revoke the TikTok authorisation. You can revoke access at any time by emailing info@winnowcommunication.com (we then delete the stored TikTok tokens and profile data), or directly in TikTok under Settings and privacy → Security and permissions → Manage app permissions. Revoking access stops any further publishing; videos already published on TikTok remain governed by TikTok's own policies and can be deleted from your TikTok account.

11. International data transfers

Some of our technology providers may process data outside the European Economic Area, including in the United States.

In such cases the transfer takes place on the basis of one of the instruments provided by the GDPR, such as an adequacy decision of the European Commission, EU Standard Contractual Clauses, or other safeguards under Articles 44 et seq. GDPR.

12. Your privacy rights

Subject to the conditions of the GDPR, you may exercise the rights of:

• access to your personal data;
• rectification;
• erasure;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent at any time;
• not being subject to certain solely automated decisions.

Requests can be sent to info@winnowcommunication.com. We may ask for information needed to verify your identity. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.

13. Account and data deletion

You can request deletion of your account and associated personal data at any time.

Self-service procedure: visit the data deletion page at /data-deletion and follow the instructions, or send a request from your registered email address to info@winnowcommunication.com with the subject “Account deletion”.

When a deletion request is verified, your account, profile, library records, uploaded content and any connected third-party tokens (including TikTok tokens) are deleted or irreversibly anonymised, except for data we are required by law to retain (for example invoices and accounting records) or data needed to protect legal rights. Deletion is normally completed within 30 days.

14. Minors

Features involving contracts, commercial publication, monetisation, royalties and creator payouts are reserved to adults or to persons legally represented under applicable law. STOORY does not knowingly collect personal data from minors in breach of applicable law.

15. Security

We implement technical and organisational measures designed to protect personal data against unauthorised access, loss, disclosure, alteration and unlawful use. Secrets and third-party credentials are stored server-side only. No system can, however, guarantee absolute security.

16. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes to the platform, new features, changes of providers or legal developments. The updated version will be published on STOORY with the date of the latest update.

17. Contact

Winnow Communication — VAT 05004790266 — email: info@winnowcommunication.com — contact page: /contatti