Privacy Policy

Effective Date: August 12, 2026
Version: 1.1

Article 1: Who We Are and Scope

1.1 Controller:

Stringtale is operated by De Monsters, registered in the Dutch Trade Register under Chamber of Commerce number 60227184, with its business address at KNSM-laan 137, 1019 LB Amsterdam, the Netherlands ("we", "us" or "our"). You can contact us at [email protected].

1.2 Service and Website:

In this Privacy Policy ("Policy"), "Service", "Customer", "Account", "Customer Content", "Subscription" and "Third-Party Service" have the meanings given in the Stringtale Terms of Service. "Website" means the Stringtale public website.

1.3 Business use:

The Service is intended for business and professional use. This Policy applies to natural persons whose personal data we process, including authorised users of a Customer, Website visitors, business contacts, support contacts and newsletter subscribers.

1.4 Controller and processor roles:

This Policy primarily describes processing for which we determine the purposes and means and therefore act as controller. Where we process personal data contained in Customer Content on behalf of a Customer, we may act as processor as described in Article 4.

1.5 Consent:

This Policy is provided for transparency and does not itself constitute consent. Where consent is required for a specific processing activity, we request it separately and it can be withdrawn as described below.

Article 2: Personal Data We Process

2.1 Account data:

When an Account is created or used, we process the user's name, business email address, company name and information needed to administer the Account.

2.2 Billing data:

Subscription and payment transactions are processed through Stripe. Stripe processes payment method details. We process billing, subscription and transaction information that is necessary to administer the Subscription, payments and our financial records.

2.3 Technical and security data:

The Service and its infrastructure may generate technical data such as IP addresses, browser or device information, request and access information, timestamps, error reports, diagnostic information and security events.

2.4 Support and contact data:

If you contact us, we process your name, email address, the content of the communication and any other information you choose to provide, to the extent needed to respond and maintain the relevant correspondence.

2.5 Newsletter data:

If you subscribe to the Stringtale newsletter, we process your email address and information about your subscription preferences.

2.6 Analytics data:

We may process information about use of our Website and Service, such as pages or features used, interactions, browser or device information, online identifiers and IP-related information. Non-essential analytics or tracking is used subject to consent where required by applicable law.

2.7 Customer Content:

Customer Content may contain personal data submitted, created or managed by a Customer or its authorised users. Our role in processing Customer Content is described in Article 4.

2.8 Sources of personal data:

We usually obtain personal data directly from you, through your use of the Service or through our service providers. For business communications, we may also obtain professional contact information from publicly accessible business sources, company websites or professional networks.

2.9 Required information:

Certain Account and billing information is required to create or administer an Account or Subscription. Without that information, we may be unable to provide the relevant part of the Service.

Article 3: Purposes and Legal Bases

3.1 Providing and administering the Service:

We process Account and related operational data to create and manage Accounts, authenticate users, provide the Service and administer Subscriptions. Where the individual is personally party to the relevant contract, this may be necessary to perform that contract. In other B2B situations, we rely on our legitimate interest in providing the Service to the Customer and its authorised users.

3.2 Billing and financial administration:

We process billing and transaction information to collect payments, administer Subscriptions and maintain financial records. We rely on performance of a contract where applicable, compliance with legal obligations and our legitimate interests in financial administration.

3.3 Security and technical operation:

We process technical, log, diagnostic and security data to operate, secure, troubleshoot and protect the Service, prevent abuse and investigate incidents. We rely on our legitimate interests in maintaining a secure and reliable Service and, where applicable, legal obligations.

3.4 Support and communications:

We process support and contact data to respond to questions, investigate issues and communicate about the Service. The legal basis is performance of a contract where applicable or our legitimate interest in providing support and managing business communications.

3.5 Analytics and improvement:

We use analytics to understand how the Website and Service are used and to improve usability, performance and product decisions. For non-essential cookies or similar tracking technologies, we rely on consent where required. Strictly necessary technical measurement and diagnostics may be processed on the basis of our legitimate interests where permitted by law.

3.6 Newsletter:

We send the newsletter to people who have subscribed. We rely on consent for this processing. You can unsubscribe at any time using the unsubscribe method in the newsletter or by contacting us.

3.7 Legal compliance and claims:

We may process personal data where necessary to comply with law, respond to lawful requests, establish or defend legal claims or protect our rights and those of others.

3.8 Automated decision-making:

We do not use personal data for solely automated decision-making that produces legal effects or similarly significant effects on individuals.

Article 4: Controller and Processor Roles

4.1 Controller activities:

We generally act as controller for Account administration, billing, security, our own service operations, support, Website analytics, newsletter subscriptions and our business communications.

4.2 Processor activities:

We may act as processor where a Customer uses the Service to process personal data in Customer Content and we process that data only on the Customer's documented instructions and to provide the Service.

4.3 Customer responsibilities and DPA:

When a Customer is controller of personal data processed through the Service, the Customer is responsible for the lawfulness of that processing, providing required information to individuals and issuing lawful instructions. Where required by Article 28 GDPR or other applicable law, processing will be governed by an appropriate data processing agreement.

4.4 Customer-enabled integrations:

If a Customer connects the Service to a Third-Party Service, relevant data may be transmitted to that service as directed by the Customer. The third-party provider's own terms and privacy information may apply to its processing.

Article 5: Recipients and Service Providers

5.1 General:

We disclose personal data only where reasonably necessary to operate and support the Service, process payments, communicate, analyse use, meet legal obligations or protect legitimate interests. We do not sell or rent personal data. Service providers may process only the categories of data relevant to the function they perform.

5.2 TransIP:

Hosting and infrastructure services. Relevant data may include Customer Content, technical data, server logs and IP addresses where processed by the hosting environment.

5.3 Cloudflare:

Network traffic management, security, DDoS protection and object storage. Relevant data may include IP addresses, request and security data and data stored through applicable object-storage functionality.

5.4 Stripe:

Payment processing. Stripe processes payment method details and related payment information. We receive and retain the billing and transaction information needed to administer Subscriptions and financial records.

5.5 SendGrid:

Delivery of service-related email, such as account, security and system messages. Relevant data may include email address, name where available and message content.

5.6 Buttondown:

Newsletter management and delivery. Relevant data may include email address and subscription preferences.

5.7 Google Analytics:

Website analytics. Relevant data may include website usage, device or browser information, online identifiers and IP-related information where collected.

5.8 Sentry:

Error monitoring and diagnostics. Relevant data may include error reports, stack traces, technical diagnostics, device or browser information and other context captured when an error occurs.

5.9 CookieYes:

Cookie consent management. Relevant data may include consent choices, consent status and technical information necessary to store, apply and demonstrate cookie preferences.

5.10 Other recipients:

We may disclose personal data to professional advisers, authorities or other recipients where required by law, necessary to establish or defend legal claims, or otherwise permitted under applicable law.

Article 6: International Data Transfers

6.1 Transfers:

Some service providers may process personal data outside the European Economic Area (EEA). Where personal data is transferred internationally, we apply the safeguards required by applicable data protection law.

6.2 Safeguards:

Depending on the destination and provider, safeguards may include an adequacy decision of the European Commission, Standard Contractual Clauses or another recognised transfer mechanism, together with supplementary measures where appropriate.

6.3 Information:

You may contact us at [email protected] for more information about safeguards relevant to a particular international transfer.

Article 7: Retention and Deletion

7.1 General principle:

We retain personal data only for as long as reasonably necessary for the purpose for which it is processed, including legal, accounting, security and dispute-resolution requirements. We apply the following periods or criteria unless a longer period is required or permitted by law.

7.2 Account data:

Account data is retained while the Account is active and deleted or anonymised after closure when it is no longer reasonably necessary for account administration, security, dispute resolution or compliance with legal obligations.

7.3 Customer Content:

Customer Content is retained and made available for export or retrieval in accordance with the Terms of Service, any applicable data processing agreement and applicable law. After the applicable retrieval or retention period, Customer Content is deleted or anonymised, except where continued retention is required or permitted by applicable law.

7.4 Billing and accounting records:

Billing, invoice and other records that form part of our statutory business administration are generally retained for seven years where required by Dutch tax law.

7.5 Technical and security logs:

Technical, diagnostic and security logs are retained for a limited period appropriate to operational and security needs. Relevant data may be retained longer where necessary to investigate a specific incident, abuse, legal claim or security issue.

7.6 Support correspondence:

Support and business correspondence is generally retained for up to 24 months after the last substantive contact, unless a longer period is needed for an ongoing issue, contractual matter, legal claim or legal obligation.

7.7 Newsletter data:

Newsletter subscription data is retained until you unsubscribe. We may retain minimal suppression information afterwards where necessary to ensure that an unsubscribe request continues to be respected.

7.8 Analytics data:

Analytics data is retained according to the configured retention settings of the relevant analytics service and only for as long as reasonably necessary for the analytics purpose. Where we control those settings, we seek to use proportionate retention periods and periodically review them.

7.9 Backups:

Personal data removed from active systems may remain temporarily in protected backups until those backups are overwritten or deleted through the normal backup lifecycle. Backups are not used to restore deleted personal data except where necessary for disaster recovery, security or legal reasons.

Article 8: Security and Personal Data Breaches

8.1 Security:

We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure, taking into account the nature of the Service and the risks involved.

8.2 Access:

Access to personal data is limited to people and service providers who require access for their role or function and is subject to appropriate access controls and confidentiality requirements where applicable.

8.3 Personal data breaches:

We assess personal data breaches and notify the competent supervisory authority where required by applicable law. Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we also communicate the breach to affected individuals as required by law.

8.4 Customer data breaches:

Where we act as processor and become aware of a personal data breach affecting personal data processed on behalf of a Customer, we will inform the relevant Customer without undue delay in accordance with applicable law and any applicable data processing agreement.

Article 9: Your Privacy Rights

9.1 Rights:

Subject to the conditions and exceptions in applicable data protection law, you may have the right to access personal data about you, correct inaccurate data, request erasure, request restriction of processing, object to processing and receive information about how your personal data is used.

9.2 Data portability:

Where the legal requirements for data portability are met, including where processing is automated and based on consent or a contract, you may request to receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.

9.3 Withdrawal of consent:

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

9.4 Exercising rights:

To exercise a privacy right, contact [email protected]. We may ask for information reasonably necessary to verify your identity and the request. We normally respond within one month. Where permitted by law, this period may be extended by up to two additional months for complex or numerous requests, in which case we will inform you of the extension.

9.5 Limitations:

Privacy rights are not absolute. We may retain or continue to process information where applicable law allows or requires this, including to comply with legal obligations or establish, exercise or defend legal claims.

Article 10: Cookies and Analytics

10.1 Cookies:

The Website and Service may use cookies and similar technologies for essential functionality, security, preferences and analytics.

10.2 Consent:

Cookies and similar technologies that are not strictly necessary are used subject to consent where required by applicable law. Refusing or withdrawing consent to non-essential cookies does not prevent use of core Service functionality, although some optional functionality may be affected. Where processing is based on cookie consent, consent can be changed or withdrawn through the available cookie preferences. This does not affect processing that was lawful before withdrawal.

10.3 CookieYes:

We use CookieYes to manage cookie consent choices and preferences. You can use the consent controls made available through CookieYes to review or change your choices.

10.4 Cookie Policy:

More detailed and current information about cookies, categories, providers and available controls is provided in the Stringtale Cookie Policy at https://stringtale.com/cookies and through the cookie consent interface.

Article 11: Contact and Complaints

11.1 Contact:

Questions, requests or concerns about this Policy or our processing of personal data can be sent to [email protected].

11.2 Supervisory authority:

You have the right to lodge a complaint with a competent supervisory authority. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens. You may also be entitled to complain to another competent supervisory authority depending on your circumstances.

11.3 Resolving concerns:

We encourage you to contact us first if you have a privacy concern so that we can investigate and respond, but this does not limit your right to contact a supervisory authority.

Article 12: Changes to This Privacy Policy

12.1 Updates:

We may update this Policy to reflect changes in the Service, our processing activities, service providers or applicable law.

12.2 Notice:

The current version will be published through the Website. Where a change materially affects how we process personal data, we will provide additional notice where appropriate, for example through the Service or by email.

12.3 Effect of changes:

An updated Policy applies from the effective date stated in that version. Continued use of the Service is not treated as consent where consent is legally required for a processing activity.