Privacy Policy

Story Planner Pro is a SaaS platform for automating Instagram Stories with AI-generated captions and providing link-in-bio pages. In the course of our operations, we process the following categories of personal data:

• User account data
• Instagram account information
• Uploaded images and videos
• AI-generated content
• Product data from Google Shopping Feeds
• Analytics and usage data
• Payment information

2.1 Our Different Roles

The processing of personal data is based on the following legal bases:

Important: This processing takes place only on our own website (storyplannerpro.de), not on our users' link-in-bio pages.

Technical Description

To measure the success of our advertisements, we use the Meta Conversions API. This is a server-side interface that transmits user interactions such as registrations or subscription completions directly from our server to Meta. Unlike the browser-based Meta Pixel, data transmission occurs server-to-server, enabling higher data quality and better data protection.

The entity responsible for data processing in Europe is Meta Platforms Ireland Limited (Grand Canal Square, Dublin 2, Ireland). The parent company Meta Platforms Inc. is based in the USA.

Purpose at Story Planner Pro

The use of this technology helps us understand which marketing channels bring new users to our platform. This allows us to allocate our advertising budget more effectively and continuously improve Story Planner Pro. The insights gained are used exclusively to optimize our own services.

Categories of Data Transmitted

• Conversion Events: Type of action (e.g. registration, subscription completion), timestamp
• Pseudonymized User Data: Email and internal user ID are cryptographically hashed via SHA256 before transmission
• Technical Data: IP address, browser identifier, operating system, screen size
• Meta-Specific Identifiers: Ad click ID (fbclid), browser cookie (fbp)
• Context Data: URL of the visited page

Storage by Meta

According to Meta, the transmitted customer data is removed from their systems within 48 hours after matching with existing user profiles. Meta operates servers worldwide; aggregated statistics may be retained for longer periods.

Joint Controllership

For the collection and transmission of data to Meta, a joint controllership exists pursuant to Art. 26 GDPR. The joint controllership addendum is available here: https://www.facebook.com/legal/controller_addendum

Your Control Options

Data collection only takes place if you have consented via our cookie banner. You may withdraw your consent at any time via the cookie settings in the footer of our website.

Additionally, Meta offers its own settings:

• Meta Ad Settings: https://www.facebook.com/settings/?tab=ads
• European Opt-Out Platform: https://www.youronlinechoices.com/

International Data Transfer

Meta Platforms Inc. participates in the EU-US Data Privacy Framework and is accordingly certified. This ensures an adequate level of data protection for transfers to the USA. Additionally, EU Standard Contractual Clauses apply (Art. 46(2)(c) GDPR).

Further Information:

• Meta Privacy Policy: https://www.facebook.com/privacy/policy/
• Meta Data Processing Terms: https://www.facebook.com/legal/terms/dataprocessing
• EU-US Data Privacy Framework: https://www.dataprivacyframework.gov/

We use Hotjar to analyze user behavior on our website (storyplannerpro.de) – not on our users' link-in-bio pages.

Processed Data:

• Mouse movements, clicks, scroll behavior (heatmaps)
• Session recordings (anonymized)
• Device information

Legal Basis: Art. 6(1)(a) GDPR (consent)

Data Protection Measures:

• IP addresses are anonymized
• Form fields are automatically masked
• Sensitive data is not captured

Opt-Out: You can prevent data collection by Hotjar by withdrawing your consent in the cookie banner or using the Hotjar opt-out: https://www.hotjar.com/legal/compliance/opt-out

More information: https://www.hotjar.com/legal/policies/privacy/

We use the OpenAI API for generating AI captions.

Processed Data:

• Uploaded images (for analysis)
• Generated captions

Purpose: AI-based image analysis and caption generation

Legal Basis: Art. 6(1)(b) GDPR (contractual necessity)

Important Note: We use the OpenAI API with training disabled. OpenAI does not use any data submitted via our API to train their models. Data is not permanently stored by OpenAI after processing.

International Data Transfer: OpenAI is certified under the EU-US Data Privacy Framework. Additionally, EU Standard Contractual Clauses apply.

More information: https://openai.com/policies/privacy-policy

For sending transactional emails (registration confirmation, password reset, invoices, notifications) and, where applicable, newsletters, we use Brevo (formerly Sendinblue).

Processed Data:

• Email address
• Name (if provided)
• Time and status of email delivery (opened, clicked)
• IP address upon opening (for statistics)

Location: Brevo is an EU provider based in Germany/France. Data processing takes place exclusively within the EU.

More information: https://www.brevo.com/de/legal/privacypolicy/

We only disclose your personal data to third parties to the extent necessary for the provision of our services or where there is a legal basis.

11.1 Processors

11.2 Other Recipients

Personal data is transferred to the USA to the following recipients:

• Microsoft Corporation (Azure)
• Supabase Inc.
• Stripe Inc.
• OpenAI, L.L.C.
• Meta Platforms, Inc. (with consent only)

Safeguards

EU-US Data Privacy Framework: All aforementioned US companies are certified under the EU-US Data Privacy Framework. The European Commission adopted an adequacy decision on July 10, 2023 (Implementing Decision (EU) 2023/1795).

Standard Contractual Clauses: Additionally, we have entered into EU Standard Contractual Clauses pursuant to EU Implementing Decision 2021/914 with all providers.

Supplementary Measures: Primary data processing takes place in EU data centers where possible (Microsoft Azure: West Europe/Germany West Central; Supabase: Frankfurt).

Upon expiration of the retention period, data is deleted or anonymized, unless statutory retention obligations apply.

Under the GDPR, you have the following rights with regard to your personal data:

Exercising Your Rights

To exercise your rights, please contact us at:

We will process your request without undue delay, and in any event within one month. For complex requests, the deadline may be extended by a further two months.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

Competent authority for Hesse:

We implement technical and organizational security measures to protect your personal data:

• SSL/TLS encryption (TLS 1.3) for all data transmissions
• Encrypted storage of sensitive data (AES-256)
• Passwords are stored only as encrypted hash values (bcrypt)
• Two-factor authentication for administrative access
• Regular security updates and patches
• Access control and permission management
• Regular backups in certified data centers (ISO 27001)

Details of our technical and organizational measures can be found in Annex 1 of our Data Processing Agreement: https://storyplannerpro.de/avv

We do not employ automated decision-making, including profiling, pursuant to Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We maintain presences on social networks. When you visit our social media pages, the respective platform's privacy policy applies:

• Instagram: https://help.instagram.com/519522125107875

We have no control over data processing by the platform operators.

We reserve the right to amend this privacy policy to reflect changes in the legal framework or modifications to our services. The current version is always available at:

https://storyplannerpro.de/datenschutz

In the event of material changes affecting your rights, we will inform you separately where possible.

Last updated: January 2026