Privacy Policy

# Privacy Policy *Draft for attorney review. Effective \[Effective Date\]. Version 1.* This policy explains how \[Company LLC Name\], a Massachusetts limited liability company ("we"), handles personal information in the Impact Story service, our website at impactstoryapp.com, and each organization's subdomain. We operate only in the United States. ## 1. Our role - **For stories,** we act on behalf of the organization that invited you (a "service provider" or "processor"). The organization decides how your story is used, within the choices you made when you signed. Questions about a specific story can go to the organization or to us. - **For organization accounts, billing and our website,** we decide how information is used (a "business" or "controller"). ## 2. What we collect | From | What | Source | | --- | --- | --- | | Storytellers | Name, email, confirmation that you're 18 or older (we ask your birth month and year but don't keep them), voice recordings or typed answers, photos, transcripts, consent choices and signature, device and browser type, IP address | You, when you record or sign | | Organization staff | Name, email, role, sign-in activity | You or your organization | | Organization billing | Billing contact, organization name and address, tax-exemption certificate. Card details go directly to Square; we don't store them | You | | Website and story-page visitors | Pages viewed, which page or embed a video was played from, device type, approximate location from IP address | Your browser | | People who contact us | Name, email, message | You | **Sensitive information.** Stories often include religious beliefs and may include health, addiction or recovery information. We use it only to make and deliver the story you agreed to share. Health information is used only with your separate consent; see the Consumer Health Data Privacy Policy. **Faces and voices.** To crop and blur photos, software finds where faces appear in a photo and saves only those positions. We don't create or store face templates, faceprints or voiceprints, and we don't use face recognition. We don't collect biometric identifiers. **Children.** The service isn't for anyone under 18, and we don't knowingly collect information from them. If we learn we have, we delete it. Children may appear in photos an adult uploads with permission. ## 3. How we use it - To record, transcribe, edit and render stories, and to deliver them to the organization and the places you agreed to. - To carry out your consent choices, removal requests and the 3-year check-in. - To run accounts, billing and support, and to keep the service secure and working (preventing abuse, fixing errors, measuring costs). - To send service emails, such as your "Manage my story" link and invite reminders. - To understand which steps of the recording flow people finish, using counts that don't include names or story content. **AI.** We use AI services to transcribe recordings, select passages, describe photos, suggest titles and captions, and, if you choose, read your words in a stock AI voice. We don't use your story to train AI models, and our AI providers are contractually barred from doing so. ## 4. Who we share it with - **The organization** that invited you, which uses your story within the choices you made. - **A parent network** of the organization, only if you ticked that box, and never for health stories. - **The public,** only through the channels you agreed to and the organization chose. - **Service providers** that help us run Impact Story (hosting, storage, video rendering, transcription, AI, email, payments, tax), bound by contracts to use information only for us. The current list is in the Data Processing Agreement. - **Legal reasons:** to comply with law or valid legal process, or to protect people's safety or rights. - **A business transfer,** if we merge or are acquired, with this policy continuing to apply. **We don't sell personal information or share it for targeted advertising.** We don't use advertising cookies or pixels. ## 5. Cookies and analytics We use cookies only to keep you signed in, remember settings and keep the service secure. Our analytics are first-party counts. There are no third-party trackers, ad pixels, heatmaps or session recordings on storyteller pages. ## 6. How long we keep it - Raw recordings and photos: 12 months after the story is published, or sooner if the organization chooses. - Finished videos: until removed, or 30 days after the organization closes its account. - Consent records: for as long as the story exists, plus 4 years, to prove what was agreed. - Backups: roll off within 35 days. - If you withdraw, your story is unlisted immediately and deleted on the schedule above. ## 7. Security We encrypt data in transit and at rest, limit staff access, require two-factor sign-in for our administrators, log access to stories, and test our backups. No system is perfectly secure; if a breach affects you, we'll notify the organization within 72 hours and help notify you as the law requires. ## 8. Your rights Depending on your state, you may have the right to: - Know what personal information we have about you and get a copy. - Correct it. - Delete it. - Withdraw consent, including for sensitive and health information. - Opt out of sale, targeted advertising and profiling. We don't do any of these. - Appeal if we deny your request. To use these rights, use your "Manage my story" link, email privacy@impactstoryapp.com, or contact the organization. You can use an authorized agent. We'll verify your request, usually by email, and respond within 45 days. We won't treat you differently for using your rights. If we deny an appeal, you can contact your state attorney general. ## 9. California notice In the past 12 months we collected the categories in section 2: identifiers, audio and visual information, sensitive personal information (religious beliefs and health, with consent), internet activity and commercial information (billing). We collect them for the purposes in section 3, disclose them to the parties in section 4, keep them for the periods in section 6, and don't sell or share them. We use sensitive information only to provide the service. ## 10. Changes and contact We'll post changes here with a new effective date and email organizations about material changes. **Contact:** privacy@impactstoryapp.com · \[Company LLC Name\] · \[Mailing Address\]