Privacy Policy

1. Data controller

The controller of the personal data collected via hestoria.app is Hestoria, reachable at [email protected].

2. Data collected

Hestoria collects only the data strictly necessary for the service:

• User account: E-mail address, first name (optional), encrypted password - when registering by email or via Google OAuth.
• Uploaded photos: used for AI analysis, generation and then editing of your book (preview, photo replacement, page re-generation). Kept for the time strictly necessary for these operations, then automatically deleted along with your story, no later than 30 days after its creation — or immediately if you delete your story or your account.
• Generated photo books (PDF): stored on our servers (Supabase Storage, private bucket) to allow download and delivery by e-mail. Automatically deleted 30 days after creation, together with the associated photos. Remember to keep the PDF received by e-mail.
• Payment data: Processed exclusively by LemonSqueezy (third-party payment processor). Hestoria does not store any banking data. Only the order status (paid/refunded) and the order identifier are kept.
• Technical data: IP address, browser type, connection logs - anonymized and kept for 12 months.
• Traffic statistics: URL visited, date, traffic source (organic, direct, social) - no personally identifying data. page_views and traffic_sources tables in our database; aggregated and used only to measure site performance.
• Analytics and advertising cookies: only if you consent via the cookie banner. Detailed in our cookie policy.

3. Purposes of processing

• Creating and managing your user account;
• Generating the AI-personalized photo book;
• Sending the PDF by e-mail after payment;
• Displaying your stories on the "My stories" page;
• Responding to your support requests via the contact form;
• Improving the service (anonymized statistics);
• Complying with our legal and accounting obligations.

4. Legal basis for processing

• Performance of the contract: Generating the photo book, sending the PDF, managing the account;
• Consent: Analytics and advertising cookies, newsletter sign-up, requesting a customer review. You can withdraw it at any time;
• Legitimate interest: Security of the service, improvement, fraud prevention;
• Legal obligation: Retention of invoices (10 years) and connection logs (12 months).

5. Retention period

• Uploaded photos: automatically deleted along with the associated story, no later than 30 days after its creation (or immediately if the story or account is deleted);
• Photo books (PDF): 30 days, then automatic deletion;
• User account: Kept until deletion by the user or after 3 years of inactivity;
• Guest sessions (anonymous account): automatically deleted after 7 days if no order or story is attached to them;
• Billing / order data: 10 years (legal accounting obligation);
• Customer reviews: until your request to remove them or deletion of the account;
• Technical logs: 12 months.

6. Processors and recipients

Your data is never sold or rented. It is transmitted only to the following providers, strictly within the scope of the service:

• Railway Corp. - Server hosting (San Francisco, USA - GDPR safeguards via SCCs);
• Supabase Inc. - Database and authentication (Singapore - GDPR safeguards via SCCs);
• LemonSqueezy - Payment processing (USA - PCI-DSS compliant);
• Resend Inc. - Sending transactional e-mails (USA - GDPR safeguards via SCCs);
• Google LLC - Google OAuth authentication + Google Analytics + Google Tag Manager (USA - EU-US Data Privacy Framework);
• Meta Platforms Ireland Ltd. - Meta Pixel for advertising measurement and retargeting (Ireland - EU-US Data Privacy Framework);
• TikTok Information Technologies UK Ltd. - TikTok Pixel for advertising measurement and retargeting (United Kingdom - standard contractual clauses);
• Upstash Inc. - Redis rate-limiting (USA - SCCs);
• Cloudflare Inc. - Content delivery network (CDN), security and anti-DDoS protection in front of the site (USA - SCCs);
• Functional Software, Inc. (Sentry) - Technical monitoring and error detection (USA - SCCs). E-mail addresses are not transmitted (sendDefaultPii: false);
• OpenAI - Analysis of photos and generation of the narrative text (USA - SCCs). Your photos and text are not used to train the models (commercial API).

7. Your rights (GDPR)

In accordance with the GDPR, you have the following rights:

• Access: Obtain a copy of your data;
• Rectification: Correct inaccurate data via /compte;
• Erasure: Delete your account and all your data via /compte or by e-mail;
• Portability: Receive your data in a machine-readable format;
• Objection: Object to certain processing;
• Restriction: Request the suspension of a processing operation.

To exercise your rights (GDPR DPO): [email protected]. Response within 30 days at most.

You may also lodge a complaint with the CNIL (French data protection authority): www.cnil.fr.

8. Right to erasure - Account deletion

You can delete your account at any time from the My account page. This action permanently deletes:

• Your e-mail address and profile information;
• The history of your generated stories;
• All your stored PDF files.

Only data subject to a legal retention obligation (invoices and order data, 10 years under the French Commercial Code) is kept after account deletion, in an isolated form and inaccessible outside of that obligation.

9. Security

• HTTPS (TLS) encryption for all communications;
• Encrypted passwords (bcrypt via Supabase Auth);
• Protection against compromised passwords (HaveIBeenPwned);
• Restricted and logged access to data;
• Photos and PDFs stored in private buckets, automatically deleted at the end of the retention period (30 days);
• Cryptographic signature (HMAC) of session cookies.

10. Changes

Any change will be published on this page with the update date. Using the service after a change constitutes acceptance of the new policy.

11. Contact

[email protected] or via our contact form.