TELL ^a STORY – Data Protection & Privacy Policy, version 3.0

1. About this policy and legal framework

TELL^aSTORY is operated by BFLG Management AB, a company registered in Stockholm, Sweden. As an entity operating within the European Union, we are committed to protecting your privacy in compliance with:

• The EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679;
• Applicable Swedish data protection laws and international privacy standards.

This policy applies to all Visitors, registered Members, and paid Subscribers across www.tellastory.io, lifestory.tellastory.io, and associated mobile or web applications.

2. Information we collect and the grounds for processing

We collect personal data strictly necessary to provide, secure, and improve our Services.

2a. Information you provide directly

• Account and subscription data: name, username, email address, password, billing address, and transaction metadata. Payments are processed by a third-party payment gateway; TELL^aSTORY does not store complete card numbers.
• User content and media: photos, videos, audio recordings, text logs, geographic location tags, and timestamps uploaded to public or private maps.
• Sensitive data: detailed location logs, biographical references, or personal narratives that you choose to upload.
• Marketplace and creator data: if you buy on the Marketplace, transaction metadata is handled via Stripe. If you sell, we collect registration details, payout account details (via Stripe Connect), and the tax and billing identifiers needed for compliance and fee processing.

2b. Information collected automatically

• Technical and usage data: IP address, device type, operating system, browser configuration, time zone, language preferences, and interaction metrics.
• Anti-abuse signals: when you register, Google reCAPTCHA receives your IP address and interaction signals in order to score the request as human or automated.

3. Public and private content

3a. Public content

Content classified as PUBLIC is accessible to all Visitors and Members, may be indexed by public search engines, and is eligible for platform feature highlights, as set out in our Terms & Conditions.

3b. Private content and private Life Story mapping

• Isolated processing: content designated as PRIVATE — private life story maps, personal timeline entries, restricted media — is stored securely and processed solely to present it to you and to the people you invite.
• No publication: private content is never indexed by search engines, never published, never sold, and never used in TELL^aSTORY marketing.
• Analytics on private pages: if you accept statistics or marketing cookies, our analytics providers (see section 4) record that a page was visited and how it was interacted with, and this includes pages that display private content. They are not given your media files. If you would rather they did not run at all, decline those categories in cookie settings; nothing in section 4 marked as optional runs without your consent.
• Access link responsibility: sharing via private email, invite link, or QR code transfers access to those recipients. You remain in control of who receives those links and codes.

3c. Marketplace transactions

• Buyers: financial data and checkout interactions are processed directly through Stripe. TELL^aSTORY does not store complete card or financial instrument details.
• Sellers: independent sellers provide payout and contact information solely for managing platform commissions and tracking net payouts. Sellers act as independent controllers in respect of their own customer data and tax reporting obligations.

4. Third parties, sharing and international transfers

We do not sell, rent, or trade your personal data. It is shared only with the service providers below, each under a data processing agreement, and only for the purpose stated.

• Hosting and storage (necessary): DigitalOcean — application hosting and the managed database, in the Amsterdam (EU) region. Amazon Web Services S3 — media file storage, in the Frankfurt (EU) region.
• Payments (necessary): Stripe — card processing, subscriptions, Marketplace payouts.
• Email (necessary): Mailgun — delivery of account, notification and data-export emails.
• Anti-abuse (necessary): Google reCAPTCHA — scoring registrations to block automated signups.
• Maps (necessary): Google Maps — rendering map tiles and geocoding.
• Statistics (optional, consent required): Google Analytics and Google Tag Manager; Microsoft Clarity, which records interaction sessions such as pointer movement and clicks.
• Marketing (optional, consent required): Meta Pixel.
• Newsletter (optional): Mailchimp, where you have subscribed.

Items marked optional do not load until you have accepted the corresponding cookie category, and you can withdraw that consent at any time from cookie settings.

International transfers. Primary storage and processing take place in EU data centres. Where a provider processes data outside the European Economic Area, the transfer is protected by a recognised legal mechanism — a European Commission adequacy decision, the EU–U.S. Data Privacy Framework, or Standard Contractual Clauses embedded in our data processing agreements.

Authorities. We disclose personal data to law enforcement or public authorities only where legally required by court order or statute, or to protect someone's vital interests.

5. Retention, account closure and deletion (GDPR Articles 5 and 17)

In line with the storage limitation principle (Article 5(1)(e)), we apply the following lifecycle:

• End of a paid period: when a subscription's paid period ends, paid features and access to private maps become unavailable. Read-only access is not maintained.
• Closing date: a request to close your account does not take effect immediately. The account stays open and the request stays reversible until its closing date — the end of your paid period if you hold a TELL^aSTORY subscription, 5 days if you hold only a Life Story membership, or 30 days if you hold no subscription. Signing in before that date cancels the request and restores any subscription cancelled alongside it.
• Downloading your data: you can request a copy of your account data from your account settings before your closing date. It is prepared in the background and emailed to you as a secure link that does not require signing in, so you can still retrieve it after the account has closed. The link stays valid until your data is deleted. This packaged archive is a paid service and the fee is shown before you confirm. It does not affect your right under Article 15 to obtain a copy of your personal data free of charge, which you can exercise at any time by emailing support@tellastory.io.
• Permanent deletion: your content is permanently deleted from our primary databases and backup cycles within sixty (60) days of the closing date — measured from the date the account closes, not from the date you asked. Once deleted it cannot be recovered.
• Content bought by other members: where another member purchased content from you, that content is retained so the buyer keeps what they paid for. Your authorship is anonymised on deletion and the content is no longer linked to you or your profile.
• Statutory retention: invoices and transaction records are kept for as long as Swedish accounting and tax law requires, independently of account closure.
• Inactive accounts: accounts with no sign-in for more than 12 consecutive months may be archived or closed. We will give you notice first, and signing in keeps an account active.

6. Your rights under the GDPR

As a data subject under EU law you have the following rights:

• Access (Art. 15): obtain a copy of the personal data we hold about you, free of charge.
• Rectification (Art. 16): have inaccurate or incomplete data corrected.
• Erasure (Art. 17): have your data permanently deleted, subject to the statutory financial, accounting and tax retention obligations that apply under Swedish law to commercial transactions and Marketplace payouts.
• Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Object or restrict (Art. 18 and 21): object to processing based on legitimate interests, or to direct marketing.
• Withdraw consent: change or withdraw your cookie choices at any time from cookie settings.

To exercise any of these rights, email support@tellastory.io. We respond to verified requests within thirty (30) days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

7. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 and TLS 1.3) and encryption at rest for our managed database and media storage;
• Role-based access control for internal staff;
• Regular dependency and security updates.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Contact

For privacy enquiries or to exercise your rights:

• Data controller: BFLG Management AB (for and on behalf of TELL^aSTORY)
• General privacy enquiries: info@tellastory.io
• Data subject requests and support: support@tellastory.io
• Postal address: BFLG Management AB, 115 59 Stockholm, Sweden