Privacy policy
How Storyvalo handles account information, source files, generated videos, payments and privacy requests.
Who we are and how to contact us
Storyvalo is operated by DATASCIENCEPRO LLC, a Texas limited liability company, which is responsible for the personal information described in this notice. Contact info@storyvalo.com for privacy questions or requests. This notice describes the Storyvalo service and website.
Information we collect
We collect the name and email you provide, a salted password hash if you choose a password, your Google account identifier if you choose Google sign-in, session identifiers, brand settings, selected source URLs, uploaded files, saved source excerpts and review timestamps, extracted source text, scripts, project settings, generated media, and billing identifiers. We also process request information such as IP addresses for rate limiting and service logs for reliability and security. Do not submit information you lack permission to share or sensitive personal information that is unnecessary for creating your video.
How information is used
We use information to provide your workspace, read requested sources, generate scripts and media, deliver account emails, process purchases and subscriptions, prevent abuse, and respond to support requests. Public webpages you select may receive requests from our servers. We do not sell personal information or use your private projects as public marketing examples without your permission.
Saved versions and video sharing
We store named brand kits, project-specific brand settings and up to 30 saved versions per project, including the script and its source information. Earlier versions can retain text after you edit the current draft; delete the project to remove its saved versions. Finished videos remain private unless you explicitly create a viewing link. That unlisted page exposes the finished video, title, language, narration transcript and stock credits to anyone with the link, but does not expose source documents, prompts or account details. Links expire and can be revoked. Viewers can save or forward what they can access; revocation cannot recall copies already saved. We keep share settings and aggregate delivered bytes to enforce service limits, rather than offering individual viewer analytics.
Service providers
OpenAI receives the content needed for requested AI writing, image generation, narration, and transcription. When you explicitly search the stock library, Pexels receives your search terms and filter choices. Your script and private documents are not automatically sent as stock searches. Stock previews may load from provider media servers, which receive ordinary browser connection data; imported media is stored privately with its contributor and license references. Avoid putting private or sensitive information in search terms. Railway hosts application services, PostgreSQL, and private object storage. Stripe handles checkout and billing; Storyvalo does not store full card numbers. Namecheap Private Email delivers account and support email. If you choose Google sign-in, Google provides your basic profile and verified email; sign-in alone does not give Storyvalo access to your Gmail messages, contacts, Drive files or YouTube channel. Optional connectors and providers described in the next section receive information only when you or your workspace connect or use them. Providers process information under their applicable terms and privacy practices; their processing and retention may differ from ours. We do not claim that sending material to an AI provider guarantees zero retention.
Optional connectors and providers
Some optional features use additional providers only when you or your workspace administrator connect or use them, and not every feature is available to every account. Publishing: when an administrator connects an account and confirms a publication, LinkedIn, Vimeo, TikTok or Meta (Facebook Pages and Instagram) receives the finished video with the title, description or caption and settings confirmed for it; YouTube is described below. Source connectors: Google Drive (described below), Dropbox, Microsoft SharePoint, HubSpot, Shopify, Notion, Webflow and WordPress receive read requests for the files, pages, posts, products or items you select, and Storyvalo saves the selected content in private source drafts without writing content back. Automation: Zapier and Make call Storyvalo’s API with a key your workspace creates and receive only the information that key is allowed to read. Generation: ElevenLabs receives narration text for a stock or cloned voice you select, and receives voice samples only when you consent to creating a clone, Microsoft Azure AI Speech receives narration text for Azure voices you confirm, HeyGen receives a presenter script and your chosen presenter, and Runway receives a motion prompt, clip length and aspect ratio and, when you explicitly confirm reference-guided animation, the selected reference image. Runway’s standard terms permit use of inputs and outputs for model training; Storyvalo requires your confirmation and restricts this feature to public, non-confidential content unless private-content use is separately approved. For connected accounts we store encrypted credentials, account or site identifiers and names, your selections and publication receipts. Disconnecting removes credentials from the active connection. Encrypted credentials may remain in a queue for remote revocation retries; some providers also let you remove Storyvalo’s access in your account with them. Each provider handles information under its own terms and privacy policy.
Caption timing
When caption timing by Deepgram is turned on for your account, Deepgram receives the AI-generated narration audio of each scene and its language, and returns the time at which each word is spoken. When caption timing without OpenAI is turned on for your account, Deepgram or ElevenLabs receives the narration audio of each scene and its language, including recordings you upload, cloned voices and presenter videos, and returns the same word times. Otherwise, recordings you upload, cloned voices and presenter videos are not sent to Deepgram or ElevenLabs. Storyvalo uses those times only to place your approved caption text; the provider’s words never replace your script. We ask Deepgram not to use this audio to improve its models; Deepgram states that it then keeps the audio only as long as needed to process the request. ElevenLabs processes the audio under its standard retention; we do not claim zero retention. If Deepgram and ElevenLabs are unavailable, OpenAI times the captions as described above; where OpenAI timing is no longer used, the captions are spread over the narration without word timings.
Additional AI providers
Some newer features send information to additional AI providers only when the feature is turned on for your account and you use it; not every feature is available to every account. Script writing: when the upgraded script writer is turned on for your account, Anthropic (Claude Opus) receives what it needs to write your storyboard: your brief, the source text you selected and any uploaded images or PDFs used as sources. Otherwise OpenAI writes it as described above. Clip quality checks: when AI clip checks by Google are turned on for your account, Google Cloud Vertex AI (Gemini) receives each AI-generated video clip prepared for your scenes, sampled as video frames, and returns whether it shows visible defects or on-screen text. It does not receive your script, sources or account details. Caption timing by ElevenLabs Scribe: when it is turned on for your account, ElevenLabs Scribe receives the AI-generated narration audio of a scene and its language for languages Deepgram does not support, when Deepgram is unavailable, or to re-time captions that fail a quality check, in place of the OpenAI timing described above. It returns the time at which each word is spoken, which Storyvalo uses only to place your approved caption text. Recordings you upload, cloned voices and presenter videos are sent only when caption timing without OpenAI is turned on for your account, as described in “Caption timing”. Sound effects: when you turn on sound effects and ambience for a video, ElevenLabs receives short sound descriptions written from each scene’s visual direction, such as its setting or a key action, and returns the generated audio; your narration text, sources and account details are not sent. Storyvalo does not use ElevenLabs’ zero-retention mode. These providers process information under their API terms and privacy practices; their processing and retention may differ from ours.
YouTube API Services
Storyvalo uses YouTube API Services when a workspace administrator connects a YouTube channel. Provider information is available in the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google Privacy Policy (http://www.google.com/policies/privacy). With the permissions you grant, Storyvalo uploads only videos you explicitly confirm, with the title, description, visibility and other settings you review, and can set a thumbnail you choose. It reads channel and video details to confirm uploads and, if platform metrics are turned on, video statistics. Storyvalo stores the connected channel ID and title, the ID and upload and processing status of each video it uploaded, those statistics and encrypted access and refresh tokens. Stored YouTube channel details, video status and statistics are refreshed or deleted within 30 days of being received. Channel details, upload receipts and metrics support publishing and reports in the connected workspace. Disconnecting clears the connection credentials, the channel details and the YouTube video details and statistics stored for that connection, and queues a request to revoke the Google grant. An encrypted token can remain in the revocation queue while that request is retried. Account deletion also queues revocation. You can revoke Storyvalo’s access directly at any time at https://security.google.com/settings/security/permissions.
Google Drive connector
The optional Google Drive connector requests only the drive.file permission, which lets Storyvalo access just the files you select in Google’s file picker, not the rest of your Drive. Storyvalo reads the selected Google Docs, text files and PDFs, checks them for changes on the schedule you choose, and does not edit or delete them. It stores encrypted access tokens, your encrypted file selection, file details (ID, name, type, version and a content fingerprint) and the extracted source text in private drafts. Disconnecting stops the workflow and removes tokens and file selection from the active connection. Where available, encrypted tokens may remain in a queue for remote revocation retries. Drafts created from Drive remain in the workspace until they are deleted, and removing a disconnected connection deletes its file details. You can revoke access at any time at https://security.google.com/settings/security/permissions.
AI markings in exported videos
Storyvalo is designed to add a machine-readable AI marking, where available, to a video that contains AI-generated images, footage or speech: the IPTC digital source type, the name of the service and the generation providers and models used, the kind of AI media, the time of creation and a plain-language disclosure sentence. Where Storyvalo holds a signing certificate, the marking is also a signed C2PA content credential, which includes the name of the organisation the certificate is issued to and may include a time stamp from a time-stamp authority. The marking contains no account information, no name of yours and no source content. Platforms you publish to may read it to label the video as AI-generated.
Google user data
Google user data supports the features you request, including sign-in, YouTube publishing and Drive source drafts. If you use AI features on a draft that contains Drive content, the text needed for that feature is sent to the AI providers described above. The Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) describes Google’s requirements for apps that access Google user data.
Storage, access, and retention
Projects and files are associated with your signed-in account and retained while you use the service unless you request deletion. Render checkpoints are retained to support retries. Sessions expire after seven days and email sign-in, verification, password-reset and deletion-confirmation links expire after 30 minutes. Customer-requested media deletion is processed by our background workers; active renders finish before their media is removed. Render scratch files are removed after successful publication, and old inactive scratch files are cleaned automatically. Operational logs, security records, and billing records may be retained where reasonably needed for support, fraud prevention, disputes, or legal obligations. Backup copies may remain until their normal rotation; deletion is not necessarily immediate from every provider system.
Your choices and requests
Use Account settings to export your profile and project data, remove source files, sign out on all devices or request account deletion. You can delete individual projects in the editor. Account deletion requires an email confirmation, cancels subscriptions immediately on confirmation and then queues content for permanent removal. Email info@storyvalo.com for corrections, additional access requests or privacy concerns. We may verify your identity before acting. You may also appeal a decision by replying with “Privacy appeal” in the subject. We handle requests according to the laws that apply to you. You can cancel renewal without deleting your account through the billing portal. Payment records held by Stripe and pseudonymous billing references may remain for legal and accounting purposes.
Creator proposals and community cards
Creator collaboration proposals are private to you and our review team. We use your account email to respond about the proposal, without enrolling you in marketing. Showcase submissions ask separately for permission to display the exact submitted title, credit, description and public link on Storyvalo.com after review. Your account email is not displayed. This permission does not authorize us to download, edit, repost or advertise your video. Submitted links open on the creator’s external platform under that platform’s privacy policy; we do not embed or fetch them. You can withdraw and delete a submission from the creator or community page at any time. This removes the saved proposal and any public card; your account-data export includes current submissions, and confirmed account deletion removes them. Otherwise we retain submissions while your account exists to manage the collaboration or display the approved card. Contact info@storyvalo.com for corrections or removal assistance. Copies independently saved by others and ordinary rotating backups may remain.
Product activity counts
We count key product steps, such as signup, rendering, playback, sharing and checkout, to understand reliability and usage. Reports contain daily counts and fixed categories, not source text, project titles, email addresses or individual viewer profiles. Internal account-linked receipts prevent duplicate counts and are included in your account-data export and removed with account deletion. Daily counts and ordinary receipts expire after 180 days; first-account milestone receipts remain while the account exists. Anonymous page opens are counted without an analytics identifier or cookie. When you follow one of our campaign links and create a new account, we may associate a fixed campaign category with that account for up to 180 days. We do not store the referring page, arbitrary URL parameters, or a cross-site identifier. This attribution is included in account exports and removed with account deletion. Do Not Track and Global Privacy Control signals prevent new campaign attribution. Reports compare signup cohorts with verified accounts and accounts that completed a video; they do not measure anonymous click conversion or prove revenue.
Campaign and share-link attribution
Storyvalo pages opened from a tagged link, such as a campaign post or the “Made with Storyvalo” and “Create your own video” links on shared, embedded and review pages, are counted by five link tags: utm_source, utm_medium, utm_campaign, utm_content and ref. Tags must match a short list of channel names or a simple lowercase format; anything else is counted only as “other”. A first-party cookie keeps the tags of the first tagged visit and its date in the same browser for up to 30 days. It contains no identifier, and we do not store the full link, the referring page or advertising click identifiers. This cookie holds no advertising click identifier; Google’s advertising tag, described below, can keep one only with your separate consent. If you then create an account, we save those tags with the account, or “direct” if there were none, delete the cookie and count your later product steps by those tags in daily totals. Account attribution is kept for up to 180 days, is included in your account-data export and is removed with account deletion. Do Not Track and Global Privacy Control signals prevent the cookie and account attribution. We count a visit by its link tags and set this cookie only after you accept optional cookies in the consent banner; you can withdraw at any time with “Cookie settings”, which deletes the cookie.
Viewing statistics on shared videos
When a video owner turns on viewing statistics for a shared video link, the video page asks each viewer whether they agree to share anonymous playback statistics. Only viewers who agree are counted, and nothing is counted when the browser sends a Do Not Track or Global Privacy Control signal. We record page-session events such as views, starts, progress, completions, caption use and call-to-action clicks, linked to a random identifier that exists only while the page is open. We do not use cookies, IP addresses or device fingerprints for these statistics. The video owner sees totals and reports, not individual viewers. These records expire within 90 days, sooner if a workspace retention policy removes them, and are kept longer only while a workspace legal hold applies.
Optional cookies and analytics: your consent
Some processing described in this notice is optional and runs only with your consent: the attribution cookie used for campaign and share-link attribution, the referral cookie of the referral and affiliate program, and product analytics sent to our analytics provider, where this notice describes them. When any of it is turned on, a banner asks you to accept or reject it, and both choices are equally available. Until you accept, and if you reject, we set neither cookie and do not send your product events. If you opened a tagged or referral link and accept during that visit, we then save that link’s tags or referral code as described in those sections. Your choice is kept in the first-party storyvalo_consent cookie for 12 months and, when you are signed in, with your account so that our servers can honour it. A choice made before you create an account is applied to that new account. An existing account keeps its own choice; if it has none, or its choice is more than 12 months old, we ask again after you sign in. Signing out deletes the choice and the optional cookies from your browser, so the next person using it is asked again. You can change your choice at any time with “Cookie settings” at the bottom of our pages and on this page. Withdrawing consent deletes the attribution and referral cookies from your browser and stops product analytics from then on; it does not affect processing that took place before. Cookies needed for sign-in, language, workflows and other features you ask for do not need consent. Do Not Track and Global Privacy Control signals still prevent the attribution and referral cookies and product analytics, whatever you choose.
Storyvalo Chrome extension
After you open the Storyvalo Chrome extension, its popup reads the current tab’s title and address and shows them locally. Clicking “Make a video” or the extension’s context-menu item opens storyvalo.com with the selected page address and fixed campaign tags identifying the extension. The address keeps its query parameters, which can contain identifiers, and drops its fragment. The extension does not read page contents, other tabs, cookies or browsing history, save selected-page data on your device, or run analytics scripts. The website then handles the address under this notice, including the 30-minute storyvalo_source cookie that keeps the choice through sign-in. Optional attribution follows your website consent choice.
Referral and affiliate program
When the referral program is available and you open a Storyvalo referral link, a first-party cookie keeps only the referral code and the date of your visit in the same browser for up to 60 days, and the visit is counted in daily totals for the person who shared the link. The cookie is not set in a signed-in browser or when your browser sends a Do Not Track or Global Privacy Control signal. It is set, and the visit counted, only after you accept optional cookies in the consent banner; you can withdraw at any time with “Cookie settings”, which deletes the cookie. If you then create an account, we link it to the account that shared the link, delete the cookie and later record which of your payments earned that account a commission or bonus minutes. The person who shared the link sees only totals, never your name, email address or purchases. If you join the program, we store your referral code, your program choice, your acceptance of the affiliate terms, a payout email address, visit counts and your commission, reward and payout records. Affiliates are paid manually through PayPal or Wise, which receive the payout email address and amount. Program data is included in your account-data export. Deleting your account removes your code, payout email address and visit counts; commission and payout records are kept with billing records for accounting and legal obligations.
Advertising measurement with Google Ads
We advertise Storyvalo with Google Ads. If you allow “Advertising measurement” in the consent banner, a choice separate from the other optional processing and off until you make it, our pages load Google’s advertising tag from Google’s servers. Google then sets first-party advertising cookies on storyvalo.com (_gcl_au and, when you arrive from a Google ad, cookies such as _gcl_aw that keep that ad click’s identifier) for 90 days, a period the tag may renew on later visits, and may read or set its own cookies on Google domains, including to link this information with other information Google holds. Google receives your IP address and browser details, the identifiers in these cookies, the address and title of each page where the tag loads (without query values other than Google’s ad click identifiers) and the referring site’s domain and, after you verify a new account or complete a purchase, that this happened, with a coded reference that prevents double counting and does not reveal your account or order and, for a purchase, its amount and currency. So that nothing is reported twice, your browser keeps the references already reported in its local storage until you withdraw or clear your browser data; Google’s tag may also keep an ad click identifier there. We never send your name, email address, project content or other account details, and we do not use enhanced conversions, remarketing or ad personalization. While you are signed in, the tag loads only to report such a sign-up or purchase, and it never loads on private pages such as shared-video, review and account pages. Nothing is loaded before you allow it, if you do not, or while your browser sends a Do Not Track or Global Privacy Control signal. Your choice is kept only in the storyvalo_consent cookie of this browser, not with your account, for 12 months; other browsers and devices ask separately. You can withdraw at any time with “Cookie settings”: the tag then reports nothing further, and we delete the Google advertising cookies and local-storage entries on storyvalo.com from your browser; cookies Google keeps on its own domains are managed in your browser and Google account settings. This does not affect what was sent before. We rely on your consent for this processing. Google acts as an independent controller of the information it receives and, for personal data from the EEA, the UK and Switzerland, relies on the EU-U.S. Data Privacy Framework, including its UK extension and the Swiss-U.S. Data Privacy Framework, and in some cases on standard contractual clauses. We also turn on Google’s restricted data processing for the tag: Google then limits how it uses this information and, under U.S. state privacy laws, acts as our service provider. Google keeps this information as described at https://policies.google.com/technologies/retention. Google processes this information under its own privacy policy (https://policies.google.com/privacy), including in the United States; how Google uses information from sites that use its services is described at https://policies.google.com/technologies/partner-sites.
Cookies and international use
Storyvalo uses a first-party session cookie to keep you signed in and a preference cookie to remember your chosen language. When you choose a workflow, a functional cookie remembers only that choice in the same browser for up to 30 minutes, until you use or dismiss it. It does not contain your prompt, source content or an analytics identifier. A first-party attribution cookie, described above, keeps only the link tags of your first tagged visit for up to 30 days. Apart from the Google Ads tag described above, which runs only with your consent, we have not installed advertising pixels or third-party analytics. Stripe and other sites you visit may use their own cookies under their policies. The service operates from the United States; international users’ data may be processed in the US and other places where our providers operate. Applicable privacy rights are not waived by using the service.
Children, security, and updates
Storyvalo is intended for adults aged 18 and over. We do not knowingly offer accounts to children. We use access controls, encrypted network connections, hashed passwords, and private storage, but no system guarantees absolute security. We may update this notice as the service changes and will publish the updated date here, with additional notice where required.