Digital Stories Privacy Policy

1. Data controller

The controller is Julia Polkowska, operating an unregistered activity in Poland under the Digital Stories brand.

Email: hello@digitalstories.app.

Phone: +48 518 153 394.

2. Data we process

Depending on how the service is used, we may process:

• account and authentication data, including the email address and account identifier;
• contact details;
• order, price, currency and payment status information;
• information about purchased products and renewals;
• invitation content and event details;
• photographs and other uploaded material;
• information required for purchased add-ons, such as a gift list, quiz, playlist or song requests;
• RSVP responses and other information submitted by guests;
• customer support and complaint correspondence;
• contact-form details: name, email address, optional phone number, subject, optional message, the language of the form and, when the person is signed in, the account identifier;
• technical diagnostics and security logs.

The exact categories depend on the features actually used.

3. Purposes and legal bases

We process data to:

• create and maintain accounts;
• provide purchased services and features;
• process orders, payments and renewals;
• answer enquiries, including messages sent through the contact form, and resolve complaints;
• maintain security and prevent abuse;
• comply with legal obligations;
• establish, exercise or defend legal claims where appropriate.

The legal basis depends on the purpose and may include performance of a contract, compliance with legal obligations, legitimate interests or consent where required.

Consent is not inferred merely from using the service when an actual consent is required.

The service does not send marketing messages and does not store marketing consent. Email about an order or an invitation is transactional.

4. Invitations and guest data

Customers may include event details, photographs and information about invited guests in their invitations.

Customers should limit information to what is needed for their event and ensure they have an appropriate basis to share it.

Information included in a published invitation may be accessible to people who have the invitation link, depending on the product features.

Guest data are processed to operate RSVP and other enabled invitation features.

The responsibilities of the event organiser and Digital Stories depend on the information the organiser enters and the features they enable. Digital Stories does not automatically assume all of the organiser's data-protection responsibilities.

5. Payments

Payments are processed through Stripe. Payment takes place on Stripe's page.

Digital Stories maintains the information needed to identify orders, confirm payment and provide customer support.

We do not store full payment-card details to the extent that these are handled directly by Stripe.

6. Service providers

To operate the platform we use the following providers:

• Supabase — accounts, authentication, the database and file storage, including invitation photographs and the guest gallery;
• Vercel — application hosting and scheduled technical jobs;
• Stripe — payment processing;
• Resend — transactional email about an order or invitation, when sending is configured;
• Google or Apple — only when sign-in with that provider is enabled and the customer uses it. Email and password remain the default way to create an account.

Depending on the features in use, the application may also connect to:

• OpenStreetMap Nominatim — when coordinates are looked up for an event address;
• Cloudflare Turnstile — when abuse protection is enabled for a guest action;
• Spotify, YouTube or Apple Music — when the organiser added an embedded playlist and a guest's browser opens it.

We do not use analytics or advertising tools.

7. International transfers

Some third-party providers may process data outside the European Economic Area.

This applies in particular to the providers listed above. The location of that processing and the safeguards used for such a transfer follow the relevant provider's terms.

We do not state that all data are stored exclusively in the European Union.

8. Data retention

Order and payment records are retained as needed to fulfil orders and meet applicable legal obligations. This policy does not state a separate numeric deadline for deleting transaction records.

Invitation content, photographs, RSVP responses and add-on data are retained in connection with providing the service and allowing customers to manage their invitations.

When an invitation expires, its public page becomes unavailable. Expiration alone does not mean that all content and photographs are automatically deleted.

Guest-gallery photographs are marked in the application to expire 12 months after the event starts. The application includes a process that removes expired gallery files and unfinished uploads. That process does not delete the invitation content, photographs placed in the invitation itself, or account and order data.

The post-event archive turns off some public features. It is separate from access expiry and does not delete retained data.

Contact messages with the status new or in progress are kept for as long as needed to handle them. The application does not delete them automatically merely because time has passed. This is not a commitment to keep them indefinitely: once handling ends, the message is closed and one of the periods below starts.

The application deletes messages with the status resolved or rejected 12 months after the closing date.

The application deletes messages marked as spam 30 days after that mark. The spam status clears a dispute mark. A spam message does not receive the longer period used for disputes.

A message marked as a dispute or legal claim is not deleted automatically while its status remains new or in progress. After it is resolved or rejected, the application keeps it for 3 years after the closing date, rather than the usual 12 months. A longer period is possible only where it is justified by the need to establish, exercise or defend a claim. An administrator can then pause automatic deletion of that message and must record a reason. When the pause is turned off, the message returns to the ordinary retention period.

Deletion is carried out by a scheduled task in the application. That task does not delete orders, payments or accounts. The periods above are Digital Stories' own rules. They are not, as such, derived from the GDPR and they are not deadlines absolutely required by that law.

9. Security

We apply appropriate technical and organisational measures designed to protect personal data.

We cannot guarantee that all Internet-related risks can be eliminated.

10. Cookies and technical data

We use cookies and similar mechanisms that are necessary for accounts, sign-in and security. We do not use analytics cookies, advertising cookies or other tracking tools.

Necessary cookies:

• Supabase session cookies, whose names start with “sb-” and contain “auth-token”, and a short-lived sign-in verifier — keeping the session and completing sign-in;
• ds-auth-next — remembering the in-site page to return to after sign-in; this cookie has a short lifetime;
• ds-auth-recovery — a short-lived HttpOnly cookie set after a password-recovery link is opened; it allows saving a new password and is removed after that save or when it expires;
• ds_guest — a random identifier valid for 24 hours, marked HttpOnly, used only to limit abuse of guest actions. The IP address is not stored in this cookie.

Browser storage that is not a cookie:

• localStorage under digitalstory:rsvp: — a copy of the guest's own RSVP on that device; the server remains the source of the response;
• localStorage under ds-lifecycle-notice — remembering that the owner dismissed a notice in the dashboard;
• sessionStorage under ds-editor-draft — a draft of the editor in the current browser tab.

Stripe may use its own cookies on its payment pages. Digital Stories does not embed a payment script on its own pages.

11. Data subject rights

Depending on applicable law and the circumstances, individuals may have rights including:

• access;
• correction;
• erasure;
• restriction of processing;
• data portability;
• objection;
• withdrawal of consent where consent is the legal basis.

Requests can be sent to hello@digitalstories.app.

Individuals may also complain to the relevant supervisory authority, including the Polish President of the Personal Data Protection Office where applicable.

12. Policy changes

The current version of this Privacy Policy is published on this page with its last-updated date.