Privacy Policy

1. Who is responsible

Stormz SAS, France, operates Stormz. We are responsible for the personal data we use to manage accounts, our billing relationship, service security, and our communications. Our details are on the Legal Information page.

For workshop content processed on an organization's instructions, that organization is generally the data controller and Stormz acts as its processor. The organizer decides the workshop's purpose, participants, and sharing settings. If you attend someone else's workshop, contact the organizer about its use of your data. You can also contact us for help.

2. What we use and why

• Accounts and access: email, name, avatar, optional profile details, sign-in identities, and workspace roles. We use these to provide the service and manage access, on the basis of our contract and legitimate interest in secure access.
• Workshops: participant names, contributions, uploaded files, votes, classifications, presence, and session records. We process these to run the workshop under the organizer's instructions or our contract with you. Providing information needed for access and participation is necessary to use those features; optional profile details are not.
• Billing: customer and subscription identifiers, plan, seat quantity, payment status, billing periods, and usage records. We use these to deliver your subscription and meet legal obligations. Stripe/Link collects payment and billing details at checkout; Stormz does not receive your full card number.
• Communications: contact details, support messages, event registrations, email preferences, and subscription records. Service messages are needed to provide the service; optional marketing emails rely on your consent, which you can withdraw.
• Referrals: referral source, signup and purchase information, and related rewards or discounts. We use these to administer the program and prevent abuse, based on our legitimate interests. A referrer may see your name or account label, signup and purchase dates, and plan, but our referral list does not disclose your email address.
• Operations and security: IP addresses, browser/device information, access times, errors, and usage and security records. We use these for our legitimate interests in protecting and improving the service.

3. AI, meeting bots, and connected apps

Relevant prompts, workshop content, images, or transcript excerpts may be processed by AI providers when you request a feature or the organizer enables it. This includes automatic processing of participant contributions and content search. Organizers should explain enabled features to participants.

Meeting features may process meeting details, participant names, chat messages, audio, and transcripts. Meeting recordings are configured for 24-hour retention at our meeting provider; this does not delete workshop content created from them or set retention for other systems. Limited diagnostic records may also be used for troubleshooting.

If you connect an external app or AI assistant, it can receive data within the access you authorize. That provider's own terms and privacy policy also apply.

4. Who receives data

Workshop content is visible to people allowed by the organizer's access and sharing settings. Authorized workspace members may manage or export it.

We use providers for hosting and storage, sign-in and security, email and event registration, referrals, service analytics, AI and transcription, and location search. They receive the information needed for those functions, such as contact details for registration or location queries for a map feature. Event registration alone does not subscribe you to marketing emails.

Stripe/Link handles online purchases, billing, tax, fraud prevention, and transaction support. It acts as merchant of record for Managed Payments purchases and also processes data for its own legal and payment purposes. We may also disclose information where legally required or necessary to protect others' rights.

Some providers process data outside the European Economic Area. Where required, transfers must be covered by an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses. Contact us for the provider list and details of locations and applicable safeguards, including how to obtain a copy.

5. Cookies and email choices

Essential cookies support sign-in, security, and event participation. We remember your cookie preference for up to 180 days. We do not use advertising cookies or social-media tracking pixels.

With your permission, an optional cookie remembers who recommended Stormz for up to 60 days, without extending that period when you browse or click another referral link. Withdrawing permission removes the unbound referral cookie.

Even without the optional cookie, a referral link you use may be associated with your account when you sign up. Changing your cookie choice does not erase an already established account referral.

You can change optional email subscriptions in your account email preferences or through the unsubscribe link in our emails. Essential account, security, and billing messages are separate from marketing subscriptions.

6. Retention and deletion

We retain data according to its purpose: running your account and workshops, handling support and disputes, preventing abuse, and meeting legal recordkeeping requirements. Billing records, consent evidence, and unsubscribe suppression records may need to outlast your account. Backup and provider copies can have separate retention periods.

Canceling a subscription is not a deletion request. Workshop data may remain after a plan ends, but we do not promise a retention or recovery period for inactive workspaces. Export important content while available. Contact us to request erasure or information about the retention that applies to your data.

Deleting a login account does not necessarily remove contributions in other people's workshops, separate contact records, or records needed for legal purposes. Ask the organizer or contact us about these records. Selected security alerts, which can include an IP address, remain in a restricted internal history and currently have no automatic expiry.

7. Security and your rights

We use technical and organizational measures to help secure data. No service is risk-free. If a personal data breach occurs, we notify the relevant authority and affected people when required by law.

Under GDPR and applicable French law, you can request access, correction, erasure, restriction, or portability where applicable, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing. Email contact@stormz.me. We may need to verify your identity and normally respond within one month; lawful extensions may apply to complex requests.

You can complain to your local data-protection authority or France's CNIL. Stormz is not intended for children under 16. Contact us if you believe we have collected their data.

8. Changes to this notice

We update this page when our practices change and revise the date above. We will highlight significant changes by email or in the app. If a new use requires your consent, we will ask for it rather than treating a policy update as consent.