Privacy Notice

1. Data controller

The legal operator below is the data controller for personal data processed through Story By Anyone, except where a provider acts as an independent controller for its own legally defined purposes.

2. Data we process

• Contact and order data, including name, email, package, price, currency, order reference and delivery status.
• Story material, interview answers, Story Brief, Story DNA, musical preferences, reference artists and revision notes.
• Generated and edited outputs, including lyrics, creative reviews, prompts, audio, artwork and delivery links.
• Consent and contract records, including the legal-document versions accepted at checkout, the request for immediate production and any optional Story By Anyone social-feature permission.
• Support messages, cancellation requests, complaint information and internal audit records.
• Technical and security information such as guest-project identifiers, Story Vault magic-link and session records, timestamps, browser and network information, error logs and abuse-prevention signals.
• Private delivery engagement such as page views, play counts, approximate listening-completion thresholds, downloads, whether a review prompt became eligible, whether a review reminder was scheduled and whether a private post-delivery release offer became available and whether NorthBeat manually extended that offer for customer-service purposes.
• Optional customer feedback, including song ratings, written review text and any separate permission to feature that review publicly.

Story By Anyone does not receive full payment-card details. Stripe processes payment information through its own secure checkout.

3. Why we use the data

Perform the contract

Create the project, keep separate stories connected to the same customer email in Story Vault, preserve approved story versions, produce the song, take payment, deliver files, provide revisions and support the order.

Legal obligations

Keep accounting, tax, payment, consent and dispute records where required by law.

Legitimate interests

Secure the service, prevent fraud and misuse, diagnose failures, maintain quality, understand whether delivered songs are being used successfully, request one-time service feedback after meaningful engagement, surface the same fixed post-delivery release-production offer when a customer meaningfully engages with their own delivered song, document production decisions and defend legal claims.

Consent

Used where consent is the appropriate basis, including the optional Story By Anyone social-feature permission, a separate post-delivery NorthBeat Release Selection application, the customer’s public story-credit choice, permission to make a selected song public and permission to feature a customer review publicly.

4. AI and production providers

Selected providers may process story material and prompts to create or evaluate outputs. Current provider categories include language models, music generation, hosting, database storage, payment processing and transactional email. Depending on configuration, providers may include OpenAI, xAI, Google Gemini, ElevenLabs, Supabase, Vercel, Stripe and Resend.

Only information reasonably needed for the relevant task should be sent. Provider access is controlled through account settings, contracts, technical safeguards and internal permissions. Providers may change when necessary for quality, availability, security or cost, but the purpose of processing remains the same.

Private story material is not used by Story By Anyone for public marketing, a public portfolio or training a general-purpose public AI model without a separate lawful basis and, where required, separate consent. If a customer deliberately publishes a social post and tags or credits Story By Anyone, Story By Anyone may repost that already-public post under the Licence Terms. If the customer separately selects the optional Story By Anyone social-feature permission, the delivered song may be featured on Story By Anyone-controlled social channels within that recorded scope; the private interview, Story Vault, email, photograph and non-public identity information remain private. If the customer submits and NorthBeat approves a separate Release Selection application, the released song, lyrics, title, artwork, chosen public story credit, public metadata and promotional excerpts may become public. A provider's own processing is governed by the provider agreement and the configuration used for the service.

5. International transfers

Some providers may process data outside Sweden or the European Economic Area. Where required, transfers are protected through an adequacy decision, standard contractual clauses or another lawful transfer mechanism together with appropriate technical and organisational safeguards.

6. Sensitive and third-party information

The service is designed for meaningful stories, but customers should not include unnecessary health data, political or religious beliefs, sexual information, biometric data, criminal allegations, confidential information or intimate details about another person. Do not submit another person’s sensitive information without their explicit permission and a lawful reason.

We may ask the customer to remove information, pause processing or decline material where privacy, safety or legal risks outweigh the need to include it.

7. Retention

• Unpaid drafts may be deleted after 90 days of inactivity. Linking a draft to Story Vault helps the customer find it again but does not by itself guarantee indefinite storage.
• Paid story material, generated outputs and private audio are normally retained for up to 24 months after delivery so the order can be supported and redelivered, unless the customer chooses an ongoing Story Vault service or a separate release agreement requires longer retention.
• Support, security and dispute records are kept only as long as reasonably needed for their purpose.
• Payment, accounting, contract and consent records may be retained for up to seven years or longer where law or an active dispute requires it.
• Publicly released NorthBeat materials may be retained for the duration of the release and related rights administration under the separate release agreement.
• Delivery-engagement, private-offer timing and review records are normally retained with the related paid order for support, quality, service-improvement and offer-integrity purposes. Public review use ends if the applicable permission is withdrawn, subject to reasonable technical and archival limitations.
• Content featured under the optional Story By Anyone social-feature permission may remain on Story By Anyone-controlled social channels until the permission is withdrawn or the content is otherwise removed, subject to reasonable technical and archival limitations.

Where deletion is requested, data that must be retained for legal obligations or legal claims is restricted and kept only for that purpose.

8. Security

Story projects use private guest-session tokens, hashed one-time Story Vault links, hashed Vault session tokens, restricted administrative access, private storage, signed delivery links, provider keys stored as server-side secrets and audit records. No internet service can promise absolute security, but access is limited to people and systems that need it for the stated purposes.

9. Your rights

Depending on the circumstances, a person may request access, correction, deletion, restriction, portability or objection, and may withdraw a consent. Requests can be sent to the legal email above. Identity may need to be verified before private story data is disclosed or changed.

A person also has the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the competent data-protection authority in their country.

10. Children

The purchasing service is intended for adults. A person under 18 must use the service through or with permission from a parent or legal guardian. Stories about children should contain only information reasonably needed for the song.

11. Changes

Material changes are published with a new version and effective date. The privacy notice accepted or acknowledged for an order is recorded with that order.