Privacy Policy

Summary of key points

This summary highlights the key points of our Privacy Policy. You can find more detail in the sections that follow.

What personal information do we process? Depending on how you interact with us — visiting our site, creating an account, uploading photos, or contacting us — we may collect your name, email address, password, billing details, the photos you upload (and the metadata they contain, such as location/EXIF data), and biometric data derived from those photos for face detection.

Do we process sensitive personal information? Yes — we process biometric data (faces detected in your photos) with your explicit consent or as otherwise permitted by applicable law.

Do we collect information from third parties? No.

How do we process your information? To provide and improve our services, to communicate with you, for security and fraud prevention, and to comply with law. We process your information only when we have a valid legal reason to do so.

With whom do we share personal information? Only with the third-party service providers we need to operate the service — listed by name in §4.

How do we keep your information safe? We use appropriate organisational and technical measures. No system is perfectly secure, so we cannot guarantee against every form of unauthorised access.

What are your rights? Depending on where you live, you may have rights to access, correct, delete, or restrict our use of your personal information.

How do you exercise your rights? Email us at privacy@denwoodstudio.com or visit https://denwoodstudio.com/privacy.

Table of contents

1. 1. What information do we collect?
2. 2. How do we process your information?
3. 3. What legal bases do we rely on to process your information?
4. 4. When and with whom do we share your personal information?
5. 5. Do we use cookies and other tracking technologies?
6. 6. Do we offer AI-based products?
7. 7. Is your information transferred internationally?
8. 8. How long do we keep your information?
9. 9. How do we keep your information safe?
10. 10. Do we collect information from minors?
11. 11. What are your privacy rights?
12. 12. Controls for Do-Not-Track features
13. 13. Do other regions have specific privacy rights?
14. 14. AI and face detection
15. 15. The other people in your photos
16. 16. Photos of children
17. 17. Do we make updates to this notice?
18. 18. How can you contact us?
19. 19. How can you review, update, or delete the data we collect?

1. What information do we collect?

Personal information you give us

In short: we collect personal information that you provide to us.

When you register, use, or contact us, we collect the personal information you choose to provide. This may include:

• names
• email addresses
• usernames
• passwords
• contact or authentication data
• billing addresses
• photos and images you upload, including any metadata they contain (such as location or EXIF data)

Sensitive information

Where necessary, with your explicit consent or as otherwise permitted by applicable law, we process the following category of sensitive information:

• biometric data (faces detected in the photos you upload)

Payment data

If you make a purchase, we collect data necessary to process your payment, such as your payment instrument number and the security code associated with it. All payment data is handled and stored by Stripe. Their privacy notice is at https://stripe.com/privacy.

We do not store your full payment card details. All card payments are processed securely by Stripe; we only retain limited billing records (such as transaction date and amount) for accounting and tax purposes.

Application data (mobile)

If you use our mobile application, we may also collect:

• Mobile device access. We may request access to certain features on your device, including your device's storage, camera, and photo library, in order to let you select and upload photos. You can change these permissions at any time in your device settings.
• Mobile device data. We automatically collect information about your device, such as device ID, model, manufacturer, operating system, version, language settings, mobile carrier, browser type, and IP address.
• Push notifications. We may request to send you push notifications about your account or features of the app. You can turn these off at any time in your device settings.

This information is primarily used to maintain the security and operation of the application, for troubleshooting, and for our internal analytics.

Information automatically collected

In short: some information — such as your IP address and device characteristics — is collected automatically when you visit our services.

We automatically collect certain information when you visit, use, or navigate our services. This does not reveal your specific identity (like your name or contact information) but may include:

• Log and usage data. Service-related, diagnostic, usage, and performance information automatically collected when you access our services — IP address, device information, browser type and settings, dates and times of use, pages viewed, features used, and similar.
• Device data. Information about the computer, phone, tablet, or other device you use — IP address, device identifiers, browser type, hardware model, operating system, internet service provider, and system configuration.
• Location data. Information about your device's location, which can be either precise or imprecise. The precision depends on the type and settings of the device you use. You can opt out by refusing access to the information or by disabling your device's location setting.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. How do we process your information?

In short: we process your information to provide, improve, and administer our services, to communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our services. These include:

• Account creation and authentication. To let you create and log in to your account, and to keep your account in working order.
• Delivering our services. To provide the StoryFolio service you've asked for — analysing your photos, generating your story, and assembling your photobook.
• Responding to your inquiries. To answer your questions and help you with anything you need.
• Sending administrative information. To let you know about changes to our terms, our policies, and our services.
• Fulfilling and managing your orders. To process payments and manage purchases you make through our services.
• Requesting feedback. To ask how we're doing and what could be better.
• Marketing and promotional communications. To send you information about offers, updates, or new products, where you've agreed to receive this. You can opt out at any time.
• Measuring the effectiveness of marketing. To understand how well our marketing reaches and helps people.
• Identifying usage trends. To better understand how our services are used so we can improve them.
• Protecting our services. To keep our services safe and secure, including fraud monitoring and prevention.
• Protecting vital interests. Where necessary to protect your safety or someone else's.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we have a valid legal reason to do so.

The GDPR (and UK GDPR) require us to explain the lawful bases we rely on. We may rely on:

• Consent. Where you've given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a contract. Where we need to use your information to deliver the service you've signed up for.
• Legitimate interests. Where we have a reasonable business reason to process your information that does not override your rights. For example: to keep our services secure, to understand how they're used so we can improve them, to handle support requests, or to measure the effectiveness of our marketing.
• Legal obligations. Where we need to comply with applicable laws, such as responding to lawful requests from authorities, or maintaining records required by law.
• Vital interests. Where necessary to protect someone's life or physical safety.

4. When and with whom do we share your personal information?

In short: we share information only with the third-party service providers we need to operate the service.

We work with the following service providers, who only process your information on our behalf and under written contracts that protect it:

• AI service providers — Anthropic (Claude, for writing captions and narrative text) and Amazon Rekognition (AWS, for face detection and image analysis).
• Connect to your third-party accounts — Google (to let you import photos from Google Photos).
• Cloud computing — Amazon Web Services (AWS).
• Functionality and infrastructure — Termly.io.
• Invoicing and billing — Stripe.
• Web analytics — PostHog.
• Website hosting — Amazon Web Services (AWS).
• Performance and error monitoring — Honeybadger.io and Honeycomb.io.

We may also share your information in the following situations:

• Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business.
• Google Maps Platform APIs. We use Google Maps Platform APIs (such as the Maps and Places APIs) to display location context derived from your photos' EXIF metadata. This involves sharing the relevant location data with Google to render the map.

5. Do we use cookies and other tracking technologies?

In short: yes, we use cookies and similar tracking technologies to collect and store information.

We use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our services. Some of these are necessary to keep our services secure, prevent crashes, fix bugs, save your preferences, and enable basic functionality. Others help us understand how our services are used so we can improve them.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

6. Do we offer AI-based products?

In short: yes. AI is at the heart of StoryFolio.

As part of our services, we offer products powered by artificial intelligence and machine learning (“AI Products”). We provide these AI Products through the following third-party providers: Anthropic (Claude) and Amazon Rekognition (AWS). Your photos and related personal information are processed by these AI Service Providers to enable our AI features, in line with the legal bases described in §3.

Our AI Products

Our AI Products are designed for:

• Image analysis (recognising scenes, objects, and locations in your photos)
• Facial recognition (detecting and grouping faces in your photos)
• Text analysis and natural language processing
• Content generation (captions, narrative, and story text)

How to opt out

We believe in giving you the power to decide how your data is used. To opt out, you can:

• Contact us using the details below
• Delete your photos or account at any time, which permanently removes your data from our systems and stops all AI processing
• Decline to upload photos or use AI-based features

7. Is your information transferred internationally?

In short: yes. We may transfer, store, and process your information in countries other than your own.

Our servers are located in Australia and the United States. We may also share your information with the third parties listed in §4, whose facilities are in Australia, the United States, and other countries.

If you live in the European Economic Area (EEA), United Kingdom, or Switzerland, please note that these countries may not have data protection laws as comprehensive as those in your country. We take all necessary measures to protect your personal information in accordance with this policy and applicable law.

Standard Contractual Clauses

Where we transfer personal data out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs). These clauses are built into the agreements we have with our service providers and require them to protect that personal data in line with European data protection law. Our SCCs can be provided on request.

8. How long do we keep your information?

In short: we keep your information only for as long as necessary, unless a longer period is required by law.

We will keep your personal information for as long as you have an account with us. When you delete your account, we permanently delete your photos, story data, and personal information from our active systems, except where we are required by law (for example, by tax or accounting rules) to retain limited records for longer. Where data exists only in backups, we securely isolate it from further processing until deletion is possible.

9. How do we keep your information safe?

In short: we use appropriate organisational and technical measures to protect your personal information.

We have implemented appropriate technical and organisational security measures designed to protect any personal information we process. However, despite our safeguards, no internet transmission or storage system is 100% secure, so we cannot guarantee that hackers or other unauthorised parties will never be able to defeat our security. Transmission of personal information to and from our services is at your own risk, and you should only access our services in a secure environment.

10. Do we collect information from minors?

In short: no. We do not knowingly collect data from, or market to, anyone under 18.

By using our services, you confirm that you are at least 18, or that you are the parent or guardian of a minor and consent to their use of the services. If we learn that we have collected personal information from someone under 18, we will deactivate the account and take reasonable steps to delete the data. If you believe we may have collected data from a child under 18, please contact us at privacy@denwoodstudio.com.

11. What are your privacy rights?

In short: depending on where you live, you may have rights to access, correct, delete, or restrict our use of your personal information.

In some regions (such as the EEA, UK, and Switzerland), you have certain rights under applicable data protection law. These may include the right to: (i) request access to and a copy of your personal information; (ii) request correction or erasure; (iii) restrict our processing of your personal information; (iv) data portability where applicable; and (v) not be subject to automated decision-making. You can exercise these rights by contacting us using the details in §18.

We will respond to and act on any request in accordance with applicable data protection laws.

If you live in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you live in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent

Where we rely on your consent to process your personal information, you can withdraw it at any time by contacting us. This will not affect the lawfulness of the processing that happened before your withdrawal, nor will it affect processing we carry out under another legal basis.

Opting out of marketing communications

You can unsubscribe from our marketing emails at any time by clicking the unsubscribe link in any of those emails, by updating your account details, or by contacting us. We may still send you service-related messages — for example, to manage your account, respond to service requests, or for other non-marketing purposes.

Account information

If you want to review or change information in your account, or close it, you can log in to your account settings and update or delete it. When you close your account, we will deactivate or delete your account and information from our active databases. We may keep some information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with applicable legal requirements.

Cookies and similar technologies

Most web browsers accept cookies by default. You can set your browser to refuse cookies or to alert you when cookies are being sent. If you choose to refuse cookies, some features of our services may not work properly.

If you have questions or comments about your privacy rights, you can email us at privacy@denwoodstudio.com.

12. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting you can activate to signal that you do not want your online browsing activity tracked. There is currently no uniform technology standard for recognising and implementing DNT signals, so we do not respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard is adopted that we must follow, we will update this policy.

13. Do other regions have specific privacy rights?

In short: yes — you may have additional rights based on the country you live in.

Australia and New Zealand

We collect and process your personal information under the obligations set by Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. This Privacy Policy satisfies the notice requirements under both Acts — in particular, what personal information we collect, where we collect it from, why we collect it, and who we share it with.

If you do not provide the personal information we ask for, it may affect our ability to offer you our services, including our ability to:

• offer you the products or services you want
• respond to or help with your requests
• manage your account with us
• confirm your identity and protect your account

At any time, you have the right to request access to or correction of your personal information. You can make such a request by contacting us using the details in §19.

If you believe we are unlawfully processing your personal information, you have the right to complain about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner, or about a breach of the New Zealand Privacy Principles to the Office of the New Zealand Privacy Commissioner.

14. AI and face detection

StoryFolio uses AI to turn your photos into a story. Here’s exactly what that means, in plain terms.

We use AWS Rekognition to spot and group faces in your photos, so we can work out who’s in your story. We also use AI to read what’s in each photo — the scene, the place, what’s going on. Then we use it to write the captions and the words that tie your story together.

That’s the whole job. Your photos and faces are used to build your book and nothing else. We don’t use them to train AI. We don’t sell them. We don’t hand them to advertisers. The face data lives inside your story and gets deleted for good when you delete your account.

If that’s not for you, that’s completely fair — don’t upload your photos, and you can delete your account and everything in it whenever you like.

15. The other people in your photos

Your photos almost certainly have other people in them — family, friends, someone’s kid, a stranger who wandered into the shot. By uploading them, you’re telling us you’re allowed to. We only use those photos to build your story, and nothing goes public unless you decide to publish and share it. If someone asks you to take their photo out of your story, please do — it’s your book, you’re in control of it.

Once a book has been published and shared, you can also unpublish it at any time to take it offline.

16. Photos of children

StoryFolio isn’t something children sign up for themselves — you’ve got to be old enough to open your own account. But kids will turn up in the photos, because that’s what family memories look like. Their photos get treated exactly like everyone else’s: used only to make your book, never made public unless you publish it, and gone for good when you delete your account.

17. Do we make updates to this notice?

In short: yes — we will update this notice as needed to stay compliant with applicable laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date at the top of this policy. If we make material changes, we may notify you either by prominently posting a notice or by contacting you directly. We encourage you to review this Privacy Policy from time to time to stay informed about how we protect your information.

18. How can you contact us?

If you have questions or comments about this notice, you can email us at privacy@denwoodstudio.com, or write to us at:

Denwood Studio Pty Ltd

20 York St

East Ipswich, Queensland 4305

Australia

19. How can you review, update, or delete the data we collect?

Based on the laws of your country, you may have the right to request access to the personal information we have about you, learn how we have processed it, correct any inaccuracies, or delete it. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit https://denwoodstudio.com/privacy or email us at privacy@denwoodstudio.com.