Storyblok

Privacy Policy Overview

Policy date: October 6, 2025

Company: Storyblok GmbH

Scope: Storyblok’s website, application, services, communications, and interactions with users. The document provided appears incomplete—it ends during the section on “Special Category Data.” Some important provisions, including the full rights, retention, international-transfer, and possibly dispute sections, may be omitted.

1. Data Collection & Usage

Information collected

Depending on how you interact with Storyblok, it may collect:

• Website and app usage data: IP address, browser and operating system details, language, referring URL, requested pages/files, timestamps, HTTP status, data transferred, latency, caching and other log information.
• Cookies and tracking data: Cookies, pixels, web beacons, device identifiers and similar technologies.
• Contact and business information: Name, email, country, phone number, employer, industry, company size, job title and other contact details.
• Account information: Name, email, password, username, SSO identifier and, for two-factor authentication, telephone number.
• Communications and support data: Chat messages, support requests, surveys, feedback, feature requests and other information voluntarily submitted.
• Payment-related data: Billing address and transaction information. Storyblok states that credit-card numbers do not enter Storyblok systems and are handled by payment processors.
• Marketing and newsletter data: Email address, subscription/consent records, and potentially whether newsletters are opened or viewed through tracking pixels.
• Data from other sources: Publicly available information, LinkedIn or company websites, data-enrichment providers, event organizers, partners, advertising and market-research companies, other users, and linked third-party accounts.

Purposes

Storyblok uses data to provide and secure its services, operate accounts, process payments, respond to requests, provide support, troubleshoot, analyze usage, improve products, communicate with users, conduct marketing and advertising, and investigate security incidents.

Storyblok relies on several legal bases, including contract performance, pre-contractual steps, consent, and legitimate interests.

Customer Content

When Storyblok processes personal data contained in content uploaded by a Storyblok customer, it says it acts as the customer’s data processor, not as the controller. That processing is governed by the customer contract and Storyblok Data Processing Agreement. This distinction is important: users may need to exercise rights through the organization that controls the relevant content.

2. User Rights

The policy says Storyblok complies with GDPR, Austrian law, CCPA/CPRA and several U.S. state privacy laws. These laws may provide rights such as:

• Access to personal data
• Correction of inaccurate data
• Deletion
• Data portability
• Restriction or objection to processing
• Withdrawal of consent
• Opting out of certain marketing or targeted advertising
• Appeal or complaint rights where applicable

The excerpt does not provide the detailed procedure, verification requirements, response deadlines, or contact details for exercising these rights. Newsletter consent can be withdrawn at any time, although Storyblok may retain consent records to defend against claims.

3. Third-Party Sharing

Storyblok shares data with service providers supporting hosting, analytics, advertising, marketing, payments, accounting, support and communications. Named providers include:

• AWS, Vercel and Netlify
• Segment/Twilio
• Google Analytics and Google Ads
• LinkedIn, X/Twitter, Facebook, 6Sense, G2 and Capterra
• Hotjar
• Salesforce, Mailchimp and Zendesk
• Stripe and NetSuite
• Atlassian/Jira, Google Workspace and other linked services

With cookie consent, website or app usage data may be transmitted to multiple advertising and analytics providers, including providers in the United States. Opting out substantially limits this sharing, although essential cookies remain and anonymized data may still be sent to Google Analytics and AWS.

Social-media platforms may independently track users, particularly when users are logged in. Storyblok disclaims responsibility for those platforms’ separate processing.

4. AI/ML Training

The provided policy does not state that personal data or customer content is used to train AI or machine-learning models. It also does not expressly promise that such data will never be used for training. The document should therefore not be treated as a clear no-training commitment.

Customer Content is said to be processed under the customer agreement and Data Processing Agreement, so the relevant contract should be reviewed for AI, analytics, subprocessors and service-improvement permissions.

5. Key User Obligations

Users must:

• Safeguard account passwords and credentials.
• Notify Storyblok immediately if credentials are compromised or used without authorization.
• Manage cookie preferences and understand that disabling cookies may affect functionality.
• Avoid submitting unnecessary sensitive information through chats, forms or support channels.
• Review privacy settings when linking Google, social-media or other third-party services.
• Avoid using the services for individuals under 16; Storyblok says it does not knowingly collect their data.

6. Liability & Disputes

The privacy policy itself does not set out a dispute-resolution process, governing law, arbitration terms, caps on liability, or remedies. It refers to Storyblok’s separate General Terms and Conditions, which should be reviewed for those provisions.

Storyblok limits responsibility for processing performed independently by social-media and other third-party providers. Security safeguards and ISO 27001 certification are described, but they are not an absolute guarantee against breaches.

7. Changes

The excerpt gives an effective date but does not explain how policy changes will be announced or whether continued use constitutes acceptance. Users should monitor the policy, account communications and website notices for updates.