Privacy Policy

Last updated: June 27, 2026

This Privacy Policy (the "Policy") explains how we collect, use, share, and protect your personal data when you use the meStory platform, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Romanian data protection law. The data controller is identified above.

Operator / legal name: CSO CODESOFT SRL
Tax ID (CUI): 43602018
Trade Registry No.: J39/45/2021
Contact: contact@getmestory.com
Registered office: Sat Vidra, Comuna Vidra, Județul Vrancea, 627415, România

1. Categories of data we collect

We collect: (a) identification and account data — name, email address, encrypted password; (b) usage data — stories read, current chapter, choices made within stories, purchase history; (c) technical data — IP address, browser/device type and version, operating system, mobile advertising identifiers; (d) payment data — managed exclusively by Stripe, with us retaining only a transaction reference, not card data.

2. Purposes and legal bases for processing

We process your data to: (a) provide the Service and grant access to purchased stories — legal basis: performance of a contract (GDPR Art. 6(1)(b)); (b) process payments and prevent fraud — legal basis: performance of a contract and legitimate interest (Art. 6(1)(b) and (f)); (c) send marketing communications, only with your explicit consent — legal basis: consent (Art. 6(1)(a)); (d) analyze and improve the Service — legal basis: legitimate interest (Art. 6(1)(f)); (e) comply with legal obligations (e.g., accounting records) — legal basis: legal obligation (Art. 6(1)(c)).

3. Sub-processors and recipients of data

We share data with the following third-party providers, acting as processors, under data processing agreements (DPAs): Stripe, Inc. (payment processing, USA, certified under standard contractual clauses); Google LLC / Firebase (authentication, database, hosting, cloud infrastructure, USA/EU); Google Analytics (traffic analysis, anonymized where possible); Meta Platforms, Inc. (advertising performance measurement, only with consent). No provider is permitted to use your data for its own purposes outside those we've established.

4. International data transfers

Some of our providers (Stripe, Google/Firebase, Meta) process data in the United States. These transfers are carried out under Standard Contractual Clauses approved by the European Commission or other transfer mechanisms recognized under Chapter V of the GDPR, which ensure a level of protection equivalent to that in the European Union.

5. Retention period

We keep your account data for as long as your account remains active. After your account is closed, we retain data necessary for legal obligations (e.g., accounting records, for up to 10 years under Romanian accounting law) and for defending potential legal claims, for a maximum of 3 years from your last interaction. Anonymized technical data may be retained indefinitely for statistical purposes.

6. Your rights under the GDPR

You have the right to: (a) request access to your data; (b) request rectification of inaccurate data; (c) request erasure of data (the "right to be forgotten"), except where processing is necessary to comply with a legal obligation; (d) request restriction of processing; (e) object to processing based on legitimate interest or direct marketing; (f) request data portability to another controller, in a structured format; (g) withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. To exercise these rights, contact us at the address given in Section 13; we'll respond within a maximum of 30 days.

7. Automated decisions

The story content you receive is partly generated automatically, based on your choices; this process doesn't produce legal effects on you and doesn't constitute automated decision-making within the meaning of GDPR Article 22, since it doesn't affect rights, obligations, or access to essential services.

8. Data security

We implement appropriate technical and organizational measures to protect your data, including password encryption, encrypted transmissions (HTTPS/TLS), and access controls on internal systems. However, no system can guarantee absolute security; in the event of a security breach affecting your data, we'll notify you without undue delay, in accordance with GDPR Articles 33-34.

9. Children's data

The Service is not intended for individuals under 16. We don't knowingly collect data from children under this age. If we learn that we've collected such data by mistake, we'll delete it promptly.

10. Cookies and similar technologies

We use a single strictly necessary cookie for authentication, and, only with your explicit consent, local-storage identifiers for analytics and server-side calls for marketing — we don't load third-party tracking scripts in your browser. Full details, including what we don't use, are in the Cookie Policy. You can manage or withdraw consent at any time from the cookie banner shown on your first visit, from the permanently visible "Cookie preferences" button, or from your browser settings.

11. Supervisory authority

The data controller is registered in Romania. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro, or with the supervisory authority of the EU member state where you habitually reside.

12. Changes to this Policy

We may update this Policy periodically. We'll display the last-updated date at the top of this page and, for significant changes, notify you by email or through a visible notice on the platform.

13. Contact and the data controller

For questions about the processing of your data or to exercise the rights described above, you can contact us at privacy@getmestory.com or at the registered office listed in the company identification section.