Your privacy under the UK GDPR.

StoryCheck is the controller of the personal data described in this notice. When a customer searches for someone, we are the controller for building and delivering the report, and the customer may be a separate controller for what they do with it.

• Privacy contact: support@storycheck.com
• Requests about your data: storycheck.com/data-request (customers) and storycheck.com/opt-out (people whose information appears in StoryCheck)

• Customers and visitors. Contact and account details, search inputs and answers, uploaded photos, purchase and payment records, acceptance records, communications, and device, usage, advertising, and email engagement data. We collect this from you, from your device, and from our payment processors and advertising partners. Details: information you give us and information we collect automatically.
• People who are searched. Names, usernames, contact details, age range and gender, approximate location, phone line details, employment details, online accounts and public profile information, images, web mentions, data breach information, risk signals, and scores and summaries we generate. We obtain this from the customer who searched, from licensed data and technology providers, from public websites, search engines, and online platforms, and from our own automated checks. You can ask us which specific sources provided information about you. Details: information about people who are searched.

Whether you have to give us data. You need to give us your email address to see the results of a search and to have an account, and payment details to make a purchase. If you do not, we cannot provide those parts of StoryCheck. Everything else you give us is optional.

Under the UK GDPR, we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b)): to create and run your account, run the searches you request, deliver reports, take payment, manage trials, renewals, credits, and cancellations, and answer your support requests.

Legitimate interests (Art. 6(1)(f)):

• building reports about people who are searched and publishing public phone number pages, in our interest and our customers’ interest in identifying unknown callers and contacts, avoiding scams and fraud, and checking who they are dealing with online. We weigh this against the interests of the people searched: we do not show home street addresses, we delete reports after 12 months and breach information after 90 days, our Terms prohibit harmful uses, and we honor removal requests;
• sending marketing emails about your search and our services to people who have given us their email address (direct marketing);
• setting prices, currency, and language by location, and testing prices, trial lengths, designs, emails, and features;
• keeping StoryCheck secure, preventing fraud, scraping, and misuse, and enforcing our Terms;
• measuring how StoryCheck is used and improving it, including with automated and AI tools; and
• responding to chargebacks and payment disputes, and establishing, exercising, or defending legal claims.

Consent (Art. 6(1)(a)): for analytics and advertising cookies and similar technologies, session recordings, and sending information about your actions to advertising partners from our servers. You can withdraw consent at any time with Cookie settings in the footer, without affecting processing that took place before.

Legal obligation (Art. 6(1)(c)): to keep tax and accounting records, respond to lawful requests from authorities, and handle requests to exercise your rights.

Some information in reports can reveal special categories of personal data, such as information about a person’s sex life or sexual orientation (for example, an account on a dating or adult website), or information about alleged criminal offences in web mentions. Reports can also show partially masked password fragments from data breaches. If you are the person concerned, you can object to this processing or ask us to erase this information at any time, as described in Your rights.

We disclose personal data to customers who request a report (report contents only), to service providers acting as our processors (including hosting, database, email, AI, data, and search providers), to payment processors, to advertising partners (Meta, Google, TikTok, and AppLovin, which may act as separate controllers and, in your region, receive data for advertising only after you consent, apart from limited technical data such as your IP address when the Meta and Google tags load in their restricted mode), to our review provider if you choose to leave a review, to card issuers and payment networks in a dispute, to professional advisers, to authorities where the law requires, and to a buyer or successor of our business. The full list is in how we disclose personal information.

We are based outside the UK, and personal data is transferred to and processed in the United States and other countries whose laws may give less protection. Where required, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations where they apply. You can ask us for a copy of the relevant safeguards at support@storycheck.com.

• Reports, including data about the person searched: deleted 12 months after creation; breach information inside a report is removed after 90 days.
• Search records, including the preview shown before purchase: if they did not lead to a report, deleted after 90 days.
• Cached partner results: up to 90 days, or 14 days when nothing was found.
• Uploaded photos: deleted when the image search finishes, and in any case within 7 hours.
• Images and page screenshots found about people: not saved in our database or file storage; they load from their original source when a report is viewed, and our hosting network may cache an image for up to 7 days.
• Session recordings: deleted after 14 days; report pages are never recorded.
• Account and contact details: while you have an account or we are in contact with you, and afterwards only as long as needed, for example to handle a dispute or legal claim.
• Payment, acceptance, and dispute records: as long as tax and accounting law requires and as needed to handle disputes and legal claims.
• Unsubscribe and removal records: as long as needed to keep honoring your choice.

If you ask us to delete your data, we act on your request without waiting for these periods to end, except for data we must keep by law or to honor your choices.

Reports contain automatically generated confidence scores, risk signals, and summaries about the person searched, which is profiling. We do not use them to make decisions that produce legal or similarly significant effects about anyone. Routine support requests, such as cancellation or refund requests, may be handled by automated systems that apply our policies, as explained in our Privacy Policy. You can ask how a result was produced, give your point of view, and contest an outcome by replying to the message or contacting support@storycheck.com.

Subject to the conditions in the UK GDPR, you also have the right to:

• access your personal data and receive a copy of it;
• have inaccurate personal data corrected and incomplete data completed;
• have your personal data erased;
• restrict how we use your personal data;
• receive personal data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller;
• withdraw consent at any time, where we rely on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise your rights, use storycheck.com/data-request or storycheck.com/opt-out, or email support@storycheck.com. We verify requests before acting on them and respond within one month, which we may extend by up to two further months for complex or numerous requests, telling you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

If you are concerned about how we handle your personal data, please contact us first at support@storycheck.com so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).

We use appropriate technical and organizational measures to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

StoryCheck is only for adults aged 18 and over. We do not knowingly process the personal data of children as customers, and our Terms prohibit searching for minors. If you believe a child’s data is in StoryCheck, contact support@storycheck.com and we will delete it.

We may update this notice. We will post the updated version with a new “Last updated” date, and if we make a material change we will take reasonable steps to tell you in advance.

StoryCheck is operated by Magna Growth Partners LLC, 1021 E Lincolnway Ste 9489, Cheyenne, WY 82001, USA.