Privacy Policy

1. Who we are

Our Story Vault is operated by Ourstoryvault - FZCO, based in Dubai, United Arab Emirates. Although our company is based outside the EU, we serve customers within the EU and EEA and are therefore fully committed to compliance with the EU General Data Protection Regulation (GDPR).

We provide a private digital archive service for families to store and share their family history, photographs, documents and memories.

Contact: privacy@ourstoryvault.net

2. What data we collect

When you use Our Story Vault, we collect:

• Account data: Your name, email address, username and password (stored as a secure hash — we never see your actual password).
• Archive content: Photos, videos, documents, audio recordings, written stories, and any other files you or your family members upload to your vault.
• People data: Names, birth dates, death dates, family relationships and biographical information about family members you add to your archive, including deceased relatives.
• Usage data: Pages visited, login times, device type, browser, and IP address. This is used to maintain security, improve the service, and understand how the website and vaults are used (including via analytics tools such as Google Analytics). Analytics does not include your vault’s photos, videos, documents, stories, or other personally identifiable archive content.
• Payment data: Payments are handled by Stripe. We do not store your card number — Stripe processes payment details directly.

3. Why we collect it and our legal basis

4. Who we share your data with

We do not sell your data. We share it only with:

• DigitalOcean — our hosting provider. Data for EU and EEA customers is stored on servers located within the European Union. Data for customers outside the EU is stored on servers in the United States of America. EU/EEA customer data therefore does not leave the EEA, meaning no international transfer safeguards are required for EU customers.
• Google Analytics / Google LLC — website and product usage analytics. Google may process analytics data (such as anonymised or pseudonymised identifiers, pages viewed, device/browser information, and approximate location) in accordance with Google's privacy policy. We do not send your vault’s personally identifiable archive content (photos, videos, documents, stories, or family records) into analytics, and we do not sell analytics data.
• Stripe — payment processing for paid subscriptions. Stripe is GDPR-compliant. We do not store your full card number.
• Postmark / Mailgun — transactional email delivery. Only your email address and the content of emails are shared.

We do not share your archive content — your photos, videos, family records or stories — with any third party, ever.

5. How long we keep your data

Your data is kept for as long as your vault subscription is active. When your subscription ends and is not renewed, your vault and all its contents are permanently deleted from our servers within 30 days. You will be notified by email before deletion occurs.

You may request deletion of your account at any time — see Section 8.

Activity logs and error logs are kept for a maximum of 90 days.

6. Cookies

We use cookies and similar technologies as follows:

We use analytics tools, including Google Analytics (and similar services), to measure how visitors and members use our marketing site and product. This helps us understand traffic, popular pages, and overall usage patterns so we can improve Our Story Vault.

We do not collect personally identifiable vault content into analytics. Your family photos, videos, documents, stories and similar archive content are not sent to Google Analytics or other analytics providers. We do not sell analytics data.

We do not use advertising cookies or Facebook Pixel for marketing ads. Analytics cookies are only set after you accept them via our cookie banner (where shown). You can withdraw consent by clearing your browser cookies and site data, or by contacting us at privacy@ourstoryvault.net.

7. Children and living people

Our Story Vault is intended for users aged 18 and over. We do not knowingly collect data from children under 13.

Your archive may contain information about living family members, including children. As the archive administrator, you are responsible for ensuring that family members whose data is stored in your vault have consented to this, or that you have a legitimate family reason for holding this information.

Do not upload intimate, sensitive, or embarrassing content about any living person without their consent.

8. Your rights under GDPR

As an EU/EEA resident, you have the following rights:

• Right to access — request a copy of all personal data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your account and all associated data. We will process this within 30 days.
• Right to data portability — request your data in a machine-readable format (JSON or CSV).
• Right to object — object to processing based on legitimate interest.
• Right to restrict processing — ask us to pause processing your data while a complaint is resolved.
• Right to withdraw consent — you can unsubscribe from digest and anniversary emails at any time from My Account.

To exercise any of these rights, email: privacy@ourstoryvault.net

You also have the right to lodge a complaint with the Data Protection Commission (Ireland): www.dataprotection.ie

9. Security

We take security seriously:

• All data is transmitted over HTTPS (encrypted)
• Passwords are hashed using bcrypt — we cannot recover your password
• Each family vault is completely isolated — no vault can access another's data
• Regular automated database backups
• Access to production systems is restricted to authorised personnel only

10. International data transfers

Our Story Vault is operated from Dubai, UAE.

EU and EEA customers: your data is stored exclusively on servers located within the European Union. Your data does not leave the EEA.

Customers outside the EU: your data is stored on servers in the United States of America. Where data is processed outside the EEA, we ensure appropriate safeguards are in place including Standard Contractual Clauses approved by the European Commission.

11. Changes to this policy

We will notify you by email if we make material changes to this policy. The “Last updated” date at the top of this page will always reflect the current version.