Privacy policy

Storytime App Inc. ("Storytime," "we," "us," or "our") provides Signal and the websites, applications, communications and related services that refer to this Privacy Policy (the "Services"). Storytime is based in the United States, and the Services are intended primarily for business customers in the United States.

This Policy explains how we handle personal information in connection with the Services and associated business relationships. It addresses our general practices first, followed by additional information for residents of applicable U.S. states and, where relevant, the European Economic Area (EEA) and United Kingdom (UK). It does not represent that every privacy law applies to every person or activity.

1. Our relationship with you

This Policy applies to customers, prospective customers, authorized users, website visitors, business contacts and other individuals whose information we handle in connection with the Services. It also applies to individuals who do not maintain a Signal account but whose information is provided through an authorized customer, communication or connected service.

Personal information means information that identifies, relates to, describes or can reasonably be associated with an identifiable individual. The term includes personal data where that term is used under applicable law. Information does not cease to be personal merely because it is publicly available or associated with a business or professional role.

A customer may determine the purposes for which information is submitted to or processed through the Services. Where we process information on that customer's behalf, our handling is subject to the customer's lawful instructions, the applicable agreement and our independent legal obligations. The customer is responsible for its own privacy notices, permissions and decisions. We separately determine the handling of information needed to administer our business, customer accounts, billing, support and security.

Recruitment, employment, supplier and professional-service relationships may involve additional personal information. Where relevant, this Policy provides a general framework for those relationships, subject to more specific notices, employment policies, contracts and applicable law. A separate notice may govern another Storytime product or an activity not covered by this Policy.

This Policy does not govern another organization's independent practices. If you deal directly with a customer, social platform, payment provider or other third party, its own notice and terms may also apply. Describing that distinction does not remove our responsibility for processing we undertake or direct.

2. Information involved in the Services

The information we handle depends on your relationship with us, the Services used and the information made available through authorized access. The principal categories are set out below. Examples illustrate the category; they do not mean that every example is collected about every person.

Account, identity and business details

We may receive names, email addresses, telephone numbers where supplied, account identifiers, authentication information, business or organization details, professional roles, account preferences and information used to administer authorized access. Account information may be provided directly or received from an identity provider selected by the user.

Customer content and communications

Information may be submitted, created or maintained in connection with a customer's use of the Services. This can include content, correspondence, notes, instructions, relationship records, permissions, supporting materials and other information the customer chooses to provide. Information about people other than the customer may appear in those materials.

Social content and associated activity

Authorized social-platform access may make available account and profile information, posts, captions, images, videos, comments, mentions, engagement information and related identifiers or activity. Where authorized for a connected account, the Services may also receive direct messages and information about the people participating in those communications. Data availability is determined by the relevant platform, permissions and permitted access.

Subscription and transaction records

We process information relevant to purchases and customer administration, such as subscription terms, billing contacts, transaction identifiers, invoices, payment status and correspondence about charges. A payment provider may collect payment credentials directly and process them under its own notice. Storytime does not require users to send full card details or security codes in ordinary support correspondence.

Online activity and technical records

Requests to a website, application or integration can include an internet protocol address, browser and device information, session information, service activity, request or delivery records, diagnostic information and security-related events. Cookies and similar technologies may support these functions as described below.

Support and other business interactions

We may retain inquiries, support requests, complaint information, feedback, communications preferences and information provided in other business interactions. Recruitment, contracting or personnel administration may involve professional history or other information appropriate to that relationship and any applicable supplemental notice.

Information generated through authorized processing

The Services may organize information or produce reports, classifications, analyses and other information derived from content or activity. Such information remains subject to applicable privacy, purpose and platform restrictions. A derived record is not automatically anonymous, unrestricted or available for an unrelated purpose.

Information may come directly from you, from a customer or organization with which you are associated, from an authorized social platform or identity provider, from a service provider acting on our behalf, from permitted public sources, or automatically through use of the Services. We may combine information where reasonably necessary for a permitted purpose, such as associating a support request with the relevant customer account.

Certain information is required to administer a relationship, comply with law or provide a requested service. If necessary information is not provided, we may be unable to complete the request or provide the relevant service. Other information may be optional. Where applicable, additional information about a required field or collection is provided in the context of the interaction.

Customers and individuals should not submit sensitive personal information that is unnecessary for the intended purpose. Content and communications may nevertheless contain sensitive information, including information about health, beliefs or other protected matters. Any additional legal conditions applicable to that information remain in effect; a general account authorization does not override them.

3. Reasons for handling information

Subject to applicable law, customer instructions and platform restrictions, information may be used to:

• Establish and administer accounts, subscriptions and business relationships, authenticate users and manage authorized access.
• Provide the Services requested by a customer, organize authorized content and communications, and produce related reporting or analysis.
• Respond to inquiries, provide support, investigate complaints and communicate about a relationship with us.
• Process and administer transactions, maintain appropriate accounting records and address payment or billing matters.
• Maintain, diagnose and improve the operation, reliability and security of the Services.
• Detect, prevent and address unauthorized access, fraud, misuse, policy violations and threats to individuals or systems.
• Send necessary account, service, administrative, legal and security communications.
• Send optional marketing communications where permitted, subject to applicable consent requirements and the individual's choices.
• Administer relevant recruitment, personnel, supplier and professional-service relationships, subject to any more specific notice.
• Comply with applicable law, respond to lawful requests, obtain professional advice, establish or defend legal claims and enforce applicable agreements.
• Evaluate or carry out a business reorganization or transaction, subject to appropriate restrictions and safeguards.

These purposes are not an unrestricted authorization to use customer information. Information received from a connected platform, including information derived from it, remains subject to that platform's applicable terms. We do not rely on a general reference to service improvement, business administration or analytics to authorize prohibited reuse of Platform Data.

Where a proposed use is materially different from the purpose for which information was obtained, Storytime must evaluate the applicable legal requirements, notices, agreements and permissions before undertaking it. Updating a privacy notice is not, by itself, consent to an incompatible new use.

4. Access by customers and other recipients

Information may be disclosed to the following categories of recipients, as appropriate to the purpose and subject to applicable restrictions:

Customers and authorized users. A customer and the people it authorizes may receive information in connection with the Services provided to it. Customers are responsible for determining who should receive access and for the purposes they direct. Information about an individual may be processed for a customer even if that individual has no separate account with us.

Providers supporting our business. Hosting, storage, communications, payments, support, security and administrative providers may process information needed for their functions. Professional advisers, accountants, auditors, insurers and legal advisers may receive information where appropriate to their role. Legal status depends on the actual relationship; not every recipient is a processor for every purpose.

Connected services and customer-selected recipients. Social platforms, identity providers, payment services and other third parties may receive information needed for a service selected or authorized by a customer or user. Customers may also direct disclosures through integrations, exports, communications or shared material. A shareable link may permit access without a separate account, and recipients may retain or forward copies.

Related entities and transaction participants. Where relevant and legally permitted, information may be disclosed to affiliated entities or to parties evaluating or undertaking a financing, merger, acquisition, reorganization, insolvency proceeding or transfer of business assets. Such disclosures remain subject to appropriate confidentiality protections and applicable privacy and platform requirements.

Authorities and other legally permitted recipients. Information may be disclosed in response to a lawful request, court order or other legal obligation, or where otherwise lawfully necessary to protect rights, address misconduct or protect safety. The scope of a disclosure should be appropriate to its permitted purpose.

Access by personnel and providers acting for Storytime must be limited to legitimate responsibilities and subject to appropriate restrictions. A customer's instructions, a corporate transaction or a disclosure to a service provider does not permit the recipient to disregard obligations attached to the information.

We do not sell or rent personal information or disclose it for cross-context behavioral advertising. We do not use personal information for targeted advertising. These statements do not mean that information is never disclosed: the recipient categories above describe disclosures associated with the Services and our business. This Policy does not grant rights to broker customer Platform Data, commercialize it for unrelated purposes or use it to train general-purpose models.

5. Connected services, browser technologies and communications

External accounts and integrations

Customers may authorize account connections, programmatic access or third-party integrations. Information within the authorized scope may then be exchanged with the selected service to carry out the customer's instructions. This may include customer-selected external analysis services or developer clients that receive information within the scope of the authorization.

Storytime's handling remains subject to this Policy, applicable agreements and platform restrictions. The selected recipient's independent processing is governed by its arrangements with the customer and its own obligations. A customer-selected tool is not automatically a Company subprocessor. Revoking access may prevent future requests but does not necessarily recall information already transmitted.

Customers should evaluate a recipient's permissions and terms before providing access, limit access to appropriate purposes and withdraw it when no longer needed. Requests, submitted information and related operational records may be processed to operate, protect and troubleshoot integrations. An integration must not be used to circumvent data-use, recipient or deletion restrictions.

Links to external websites are provided for convenience or in connection with a requested function. The presence of a link does not imply that Storytime controls or endorses the external site's practices. Individuals should review the notices applicable to a site or service they choose to use.

Cookies and similar technologies

Cookies, browser storage and comparable technologies may support session recognition, authentication, security and user preferences. Their purpose and duration depend on the function involved. As of the effective date of this Policy, Signal uses these technologies for necessary service functions and preferences, not advertising or non-essential marketing analytics.

If non-essential analytics or other technologies are introduced, their use must be evaluated under applicable notice, consent and opt-out requirements before activation. A technology is not exempt from those requirements merely because it is described as functional or supplied by a service provider. Third-party platforms and hosted services may use their own technologies under their own notices.

You may control or delete cookies and browser storage through browser or device settings. Blocking necessary technologies may interfere with sign-in, settings or other requested functions. Where consent is legally required, an appropriate means of making and withdrawing the choice must be provided.

Communications preferences

You may opt out of optional marketing through an available unsubscribe method or by contacting us. We may continue to send communications needed to administer an account, provide a requested service, respond to an inquiry or meet legal or security obligations. Service communications may include messages to invited users or other individuals without a separate account.

Optional communications must comply with applicable requirements, including relevant U.S. commercial-email laws. A communication must not be classified as transactional merely to avoid marketing obligations. Customers remain responsible for the lawful communications they direct through the Services.

6. Record lifecycle and protection

Retention and deletion

Retention depends on the information involved, its permitted purposes, the duration of the relevant relationship, contractual obligations and applicable legal or platform requirements. Other relevant considerations may include the need to maintain required records, address disputes or investigate misuse. Information should not be retained in identifiable form beyond a permitted need.

By default, saved Story media is viewable in Signal for 30 days, then shown as unavailable. This is a viewing window, not a deletion schedule: the application preserves stored media, records and history. Archiving, hiding, disconnection and access revocation do not physically delete that data. All-time Story viewing, where enabled, allows access beyond the default window. Requests requiring erasure are recorded for manual review, not automatically performed or reported as completed. These preservation controls do not waive applicable legal or platform obligations.

Canceling a subscription, revoking a social-platform authorization and requesting deletion are separate actions. Cancellation or disconnection does not necessarily erase every previously stored record. Some administrative, security, archival or other records may be retained separately, subject to applicable requirements. A general retention exception does not authorize indefinite unrelated use.

You may request deletion of personal information or closure of an account by emailing [email protected]. Customers, users and other individuals whose information is processed may use this route, including individuals without an account. Provide enough information to identify the relevant relationship and records; do not send passwords or unnecessary sensitive documents.

Requests are subject to reasonable verification and applicable legal conditions. We will respond within the period required by law and explain any required limitation, refusal or extension. Where information is processed for a customer, we may coordinate with that customer. Relevant providers and recipients must be addressed where applicable duties require it. Independently held copies may require a separate request to the relevant third party.

Safeguards and incident handling

Appropriate administrative, technical and organizational safeguards should be maintained in light of the nature of the information and the risks involved. These may include access restrictions, secure authentication, protection of credentials, secure transmission, maintenance, monitoring, confidentiality obligations and incident-response measures.

No system, transmission or storage method can be guaranteed completely secure. Users and customers are responsible for safeguarding access and for information, devices and recipients they control. Additional security obligations may be specified in a separate written agreement.

Suspected incidents should be evaluated promptly to assess the information involved, potential consequences, containment, remediation and notification duties. Where notification to individuals, customers, public authorities or other parties is required by applicable law, platform terms or contract, it must be provided within the applicable period. A duty to investigate does not suspend a notification obligation that has already arisen.

Security concerns may be reported to [email protected]. Privacy complaints and personal-information requests should be sent to [email protected].

7. Requests, choices and resolution of concerns

We provide a contact route for questions about our handling of personal information and requests to access, correct or delete it. The rights, remedies and obligations applicable to a request depend on the law governing the particular processing. Additional U.S. state and European information appears below.

A request should identify the person or authorized representative making it and describe the information or action concerned. We may request proportionate information to verify identity, authority or scope. Where permitted, an authorized agent may submit a request, subject to reasonable confirmation of the person's authority. You do not need a paid subscription to exercise an applicable privacy right.

Responses should be understandable and appropriate to the request. Requests are ordinarily handled without charge. A fee, refusal or limitation may be applied only where legally permitted, such as in a qualifying excessive request or where disclosure would improperly affect another person's rights. Required reasons and available review or appeal rights will be explained.

Storytime may need to coordinate a request with a customer, service provider or other recipient. Where required, appropriate recipients must be informed of a correction, deletion or restriction, subject to lawful exceptions. Product controls and downloads do not replace a statutory request process when additional action is required.

Please contact [email protected] if you wish to raise a concern or challenge a response. Contacting us first is encouraged but is not a condition of a legal right to contact a regulator, seek a judicial remedy or make a protected report. We will not unlawfully retaliate against or discriminate against an individual for exercising an applicable right.

8. Additional information for U.S. residents

State privacy rights

Depending on your state, the nature of the information, the relationship involved and the applicability of a particular law, you may have rights to:

• Confirm whether personal information is processed and obtain information about the categories, sources, purposes and recipients involved.
• Access personal information and receive a copy in an available portable format where required.
• Request correction of inaccurate information and deletion of information subject to applicable exceptions.
• Opt out of the sale of personal information, targeted advertising or specified profiling that produces legal or similarly significant effects.
• Exercise additional controls concerning sensitive personal information where provided by law.
• Use an authorized representative or agent where permitted.
• Appeal a decision concerning a privacy request and contact an appropriate regulator.

These rights are not uniform across all states. Business-contact, employment and other exceptions also differ. References to state rights do not imply that Storytime meets every statutory applicability threshold or that a particular exemption applies to all information about you.

Requests and appeals may be submitted to [email protected]. State-law requests generally have an initial response period of 45 days, subject to the applicable law, permitted extensions and any separate appeal period. Where additional time is legally available, the required notice and explanation will be provided. An appeal can be made by replying to the response or identifying the earlier request in a new message.

Storytime does not sell personal information, share it for cross-context behavioral advertising or use it for targeted advertising. Where an applicable opt-out preference signal or other legally required choice applies to processing, that choice must be recognized as required by law. Browser settings or legacy tracking signals are not substitutes for compliance with a specifically applicable legal requirement.

California considerations

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, relevant categories may include identifiers and account details; commercial and transaction information; internet or other electronic activity; professional or business information; content and communications; and information derived from authorized service activity. Sensitive information may appear in material submitted by a customer or individual and remains subject to any applicable additional protections.

The categories and collection contexts described in Section 2, purposes in Section 3 and recipient types in Section 4 should be read together. A category does not mean that every possible item in it is collected or disclosed about every individual. The specific information associated with a person varies with the person's interaction, permissions and applicable retention criteria.

California residents may exercise the rights provided by applicable law, including access, deletion, correction and any applicable limitation or opt-out right, subject to lawful exceptions. We do not use sensitive personal information to infer characteristics for unrelated purposes. Nothing in this Policy waives a right or remedy that California law makes non-waivable.

9. EEA and UK supplement

This section applies only to the extent the GDPR, UK GDPR or other relevant European data protection requirements govern our processing. The Services' primary U.S. focus does not exclude obligations that apply to a particular European individual or activity.

Roles and lawful grounds

For our own account administration, business operations, support and security purposes, Storytime acts as the controller where that legal classification applies. Where we process personal data on a customer's lawful instructions, the customer may be the controller and Storytime the processor. The actual role depends on the processing activity, not merely the label in a contract.

Where required, the applicable lawful ground may be performance of a contract with the individual or requested precontractual steps; compliance with a legal obligation; consent for a purpose requiring it; or legitimate interests in providing, administering and protecting the business service, assessed against the individual's interests, rights and reasonable expectations.

A contract with a company is not automatically the contractual basis for all data concerning its employees or other individuals. Consent may be withdrawn without affecting earlier lawful processing. Sensitive information requires satisfaction of the applicable additional conditions. An exceptional ground available under a particular law may be used only where its specific legal conditions are met; it is not a general alternative to consent for ordinary commercial purposes.

Individual rights and timing

Where applicable, you may have rights to information, access, correction, erasure, restriction, portability, objection and withdrawal of consent, as well as protections concerning solely automated decisions producing legal or similarly significant effects. Objection to direct marketing may be made at any time. Automated organization or analysis does not necessarily constitute such a legally significant decision.

Requests generally require a response without undue delay and within one month, subject to applicable exceptions and permitted extensions. Where an extension is allowed, the required notice and reasons must be provided within the initial period. Required direct-collection notices are generally provided when information is collected. Indirect-collection notices are subject to the applicable timing rules and exemptions, including any earlier notice required upon communication or disclosure.

You may contact [email protected] or lodge a complaint with the competent supervisory authority, including a relevant EEA data protection authority or the UK Information Commissioner's Office. Where appointment of a representative or data protection officer is legally required, the required role and contact information must be established and made available through an appropriate notice.

10. Processing locations and international access

Storytime operates from the United States. Information may be stored, accessed or processed in the United States and in other locations associated with relevant customers, personnel or providers. The Services do not promise storage exclusively within a particular jurisdiction unless separately agreed in writing.

Where a transfer is subject to legal restrictions, it must be supported by an applicable lawful mechanism. Depending on the governing rules, this may involve an adequacy determination, approved contractual safeguards and supplementary measures, or another legally available mechanism. EEA and UK transfer requirements must each be considered where applicable.

You may contact [email protected] for information about safeguards applicable to your information and to request a copy or explanation where required by law. Appropriate steps may be taken to protect confidential information while responding. International access does not remove the limitations on purpose, recipients or retention attached to customer information or Platform Data.

11. Age, changes and contact information

Age and information about minors

Signal accounts are intended for adults acting for business purposes, and the Services are not directed to children under 13. Account users must satisfy the eligibility requirements in the Terms of Service. Information in third-party content or communications may nevertheless concern individuals whose age is not known to us.

Customers must not use the Services to exploit children or engage in unlawful targeting or profiling. If you believe a child has submitted information or that information concerning a minor has been handled inappropriately, contact [email protected] so the matter can be assessed and appropriate action taken under applicable law.

Updates and additional notices

We may revise this Policy to reflect changes in the Services, our practices or applicable obligations. The effective date identifies the relevant version. Material changes will be communicated by an appropriate method, with any advance notice required by law or an existing binding agreement. Where consent or another legal step is required for a new use, posting an updated Policy does not replace it.

A supplemental notice may provide additional information for a particular interaction or category of individuals. Such a notice does not reduce a mandatory legal protection. A negotiated data processing agreement may govern customer-directed processing on its stated terms.

Contacting Storytime

Storytime App Inc.
Privacy questions, rights requests and complaints: [email protected]
General business and service inquiries: [email protected]
Security concerns: [email protected]

Please provide enough information to identify the relevant relationship and request without sending unnecessary sensitive material. If you need assistance submitting a request or an accessible version of this Policy, contact our privacy address.