Privacy notice

Who we are

Story Hub is built and run by Story Craft Agency — the business of Connecting Dots, MB, Kaunas, Lithuania, which is the controller responsible for your data. For anything about your data, write to hello@storycraft.agency.

Connecting Dots, MB decides how data is used for the website, early-access requests and Story Hub accounts. The projects, clients, people and files an agency keeps in its workspace belong to that agency: it decides what goes in, and we process it on its behalf to run the service.

What we collect

• Early-access requests: agency name, email address, team size and country — only to review and answer your request.
• Accounts: name, email address, a password (stored only as a hash by our authentication provider), two-factor settings and security events such as sign-ins.
• Workspace content added by an agency: projects, deadlines, tasks, clients and their contacts, team and crew details (for example phone numbers and email addresses used on call sheets), expenses and payouts, quotes, contracts and the legal details of the parties to them, calendar events and uploaded files.
• Google Calendar, only if you connect it: access to your calendar to show your busy time and send invitations. Titles of your own Google events are shown to you; everyone else in the workspace sees only “Busy”.
• Client portals and shared call sheets: the name a client types when giving feedback, and their approve / request-changes decisions. Shared call-sheet links are read-only and stop working the day after the shoot.

Why, and on what basis

To provide the service you or your agency signed up for (performance of a contract); to keep accounts and data secure and to prevent abuse (legitimate interest); to answer early-access requests (steps before a contract); and to meet legal obligations such as keeping invoices. We don't sell personal data, use it for advertising, or send marketing email you didn't ask for.

Who processes it for us

• Supabase — database, sign-in and file storage, hosted in the EU (Frankfurt).
• Vercel — hosting of the website and app; the app runs in its EU (Frankfurt) region.
• Resend — delivery of the emails Story Hub sends (sign-in links, invitations, notifications and the emails an agency sends its clients).
• Google — only for people who connect Google Calendar.

Some of these companies are based outside the EU. Where data leaves the European Economic Area, it relies on the transfer safeguards those providers offer under the GDPR. There is no online payment yet; if that changes, the payment provider will be added here first.

Cookies

Only the cookies the service needs to work: keeping you signed in, remembering which workspace you chose, and keeping a client signed in to their portal. No analytics or advertising cookies.

How long we keep it

Account and workspace data for as long as the account or workspace exists. Deleted projects and tasks can be restored for 30 days and are then removed for good. Invitation links expire after 7 days. Early-access requests are kept while we review them and for as long as the resulting workspace exists; ask us and we'll delete a request sooner.

Your rights

You can ask us for a copy of your data, to correct or delete it, to restrict or object to how we use it, or to receive it in a portable form. If your data is in an agency's workspace, you can also ask that agency directly. You can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).