Legal
Privacy Policy
Last updated: 8 July 2026 · Status: DRAFT
RiseWorks Media, PBC (“RiseWorks,” “we,” “us”), a Delaware public benefit corporation, operates StoryOS and the storyos.org website. This Privacy Policy explains what personal information we collect through storyos.org, how we use and share it, and the choices and rights you have. It covers visitors to this marketing site. Where we process personal information contained in footage, media, or other content on behalf of a StoryOS customer, we act as that customer’s processor under our Data Processing Addendum — see “Customer content and AI” below and our Trust & Security page.
Information we collect
Information you give us.When you join the waitlist, fill in a contact or sales form, or email us, we collect the details you provide — typically your name, work email address, organization, role, and the content of your message.
Information collected automatically.When you browse storyos.org we collect standard technical and usage data such as your IP address, browser and device type, referring page, and the pages you view. Analytics identifiers are set only after you opt in — see Cookies below.
We do not intentionally collect special-category (sensitive) personal data through this website, and we ask that you not include it in form submissions.
How we use information
- respond to your inquiries, sales questions, and partnership requests;
- operate the waitlist and send updates you have asked for;
- measure and improve the website and our content;
- keep the site secure and prevent abuse; and
- meet legal, accounting, and regulatory obligations.
Our legal bases (where the GDPR or UK GDPR applies) are your consent (analytics, marketing email), our legitimate interests (operating and improving the site and understanding demand), and compliance with legal obligations. You may withdraw consent at any time.
Cookies and analytics
storyos.org uses cookies and local storage as described in our Cookie Policy. Strictly-necessary storage is always active; analytics cookies (Amplitude and Google Analytics 4) load only after you opt in, and nothing is sent to an analytics provider before you accept. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.
How we share information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only with service providers (“subprocessors”) who process it on our behalf under contract, and where required by law. For this website those providers are Vercel (website hosting), GoHighLevel / LeadConnector (the customer-relationship system that receives waitlist and contact submissions), Slack (an internal notification of each submission, sent to a private RiseWorks channel), Amplitude (product analytics, only after you opt in), and Google (Google Analytics 4, only after you opt in).
The subprocessors that power the StoryOS product are listed on our Trust & Security page. Our current subprocessor list and Data Processing Addendum are available on request at privacy@riseworks.org. We may also disclose information to comply with law, enforce our terms, protect rights and safety, and in a merger or acquisition (with notice where required).
Customer content and AI
When you are a StoryOS customer, the footage, media, and other content you upload is processed under our Data Processing Addendum, and the following commitments apply (see Trust & Security for detail):
- No AI provider trains on your content. The AI features StoryOS runs use US-hosted Google Gemini through the Vercel AI Gateway with zero data retention and redacted payloads. We never use Chinese-hosted models.
- Real footage. Source footage is always real; AI-generated imagery is limited to thumbnail graphics.
- Human approval. A person approves anything AI drafts before it reaches an audience.
- Face recognition is opt-in.It is off by default and enabled per tenant only with your instruction; only human-confirmed identity tags persist. This is relevant to biometric-privacy laws such as the GDPR and Illinois’ BIPA.
- US data residency by default, with enterprise options to keep data in your own cloud region.
Your rights
Depending on where you live, you have some or all of the rights below, which we honor regardless of where you live, subject to verification.
EEA / UK / Switzerland (GDPR, UK GDPR). Access; rectification; erasure; restriction; objection (including to processing based on legitimate interests and to direct marketing); data portability; and withdrawal of consent at any time. You may also lodge a complaint with your local supervisory authority.
California (CCPA/CPRA).The right to know, access, delete, and correct your personal information; to opt out of the “sale” or “sharing” of personal information (we do neither — see Do Not Sell or Share); to limit use of sensitive personal information; and not to be discriminated against for exercising these rights.
Brazil (LGPD) and other jurisdictions provide comparable rights. To exercise any right, email privacy@riseworks.org. We honor recognized opt-out preference signals such as Global Privacy Control.
International transfers
We are based in the United States and process website data in the US by default. Where we transfer personal information from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK Addendum. A copy of the relevant safeguards is available on request.
Data retention
We keep personal information only as long as needed for the purposes above — for example, we retain contact and waitlist details until you ask us to delete them or they are no longer needed, and analytics data for the periods described in the Cookie Policy. We then delete or anonymize it.
Security
We protect personal information with encryption in transit (TLS 1.2+) and at rest (AES-256), least-privilege access, MFA, and a documented information-security program with a 72-hour breach-notification commitment. Details are on our Trust & Security page. No system is perfectly secure, but we work to protect your information and to notify you and regulators of a breach as required by law.
Children’s privacy
storyos.org is a business website not directed to children, and we do not knowingly collect personal information from anyone under 16.
Changes to this policy
We may update this policy from time to time. We will post the new version here and update the “Last updated” date; material changes will be flagged more prominently.
Contact us
RiseWorks Media, PBC — operator of StoryOS
Privacy: privacy@riseworks.org
Security & vendor reviews: security@riseworks.org
Our Data Processing Addendum and subprocessor list are available on request. If you are in the EEA or UK and are not satisfied with our response, you may contact your local data protection authority.