StoryFace.ai & GDPR.
Editor: NataSquad S.A.S. Address: 10 Rue de la Paix, 75002 Paris, France Contact: contact@storyface.ai Updated: January 2026
At StoryFace, personal data protection is at the heart of our product design. We have architected our platform on the principle of Privacy by Design.
1. Explicit consent — always first
No photo is taken without the participant's clear and prior consent via a validation screen. That screen also informs participants that their photo will be transformed using artificial intelligence and that the resulting images are delivered marked as AI-generated content. (Provisional wording, pending legal validation.)
2. Data deleted within 48 hours (automatically)
All photographs are automatically deleted within 48 hours of the end of the event. No long-term archive.
3. Hosted 100% within the EU
AI servers: OVH (France). Web interface: o2Switch (France/Spain). No transfer of data outside the EEA.
4. Your photos never train our AI
Images are never used to improve or train our AI models. This is contractual and verifiable in our DPA.
5. Security and compliance
HTTPS/TLS encryption. MFA for admins. Supervisory authority notification within 72h for data breaches.
Organisers / Data Processors
StoryFace acts as a data processor. We provide on request: full DPA and processing activities record (contact@storyface.ai).
Exercising Your Rights
Write to us at contact@storyface.ai. In practice, your data will already have been automatically deleted within 48 hours.