Privacy Policy

01Introduction & Scope

This Privacy Policy applies to the Stori hardware device, its on-device AI software and brief-generation engine, the Stori website, any companion applications, and optional cloud services we may offer. It is operated by Stori Labs LLC ("we," "us," "our").

02Information We Collect

We collect information in the following categories:

• Account Data: Email address, name, business name, and (when applicable) shipping and payment information when you reserve, register an account, or purchase.
• Device Telemetry: Hardware health metrics (temperature, uptime, storage usage), firmware version, and error logs. This is opt-in and can be disabled entirely from the device dashboard.
• Usage Analytics: Aggregate statistics on feature usage (e.g., which vertical templates are active, brief delivery success rates) to improve the product. No video content, no identifying information about people in the footage, and no individual brief content is included.
• Payment Data: Processed by our payment provider (Stripe). We do not store credit card numbers.
• Website Analytics: Standard pixel and cookie data from the Stori website (page views, referrer, UTM parameters) to measure marketing effectiveness.

03On-Device vs. External Processing

What stays on your device (always):

• All video footage from the security cameras Stori reads
• All raw frames analyzed by the on-device vision-AI
• The intermediate observations Stori derives from those frames (timestamps, behavior counts, dwell durations)
• Your generated daily briefs and any clips you've saved or reviewed
• The vertical templates and any customizations you make to them
• Camera credentials and ONVIF/RTSP connection settings

What is sent outside the device (only in these specific cases):

• Your daily brief by email: The text of your daily brief is delivered to the email address you specify, via our email-delivery service. The brief contains the summary text only — never raw footage, never images of identifiable individuals, never biometric data.
• Firmware and template updates: The device periodically checks for software updates. Only version numbers and hardware identifiers are transmitted — no video, no brief content, no business data.
• Optional cloud-assisted tasks: If you explicitly enable cloud assistance for specific heavy tasks, only the specific task payload is sent to the provider you select. This is off by default.

What is never sent anywhere:

• Raw video footage from your cameras
• Frame-level data from your cameras
• Biometric data — because we do not capture, derive, or store any
• Identification of individuals in your footage — by design, the system does not produce this data

04What Stori Does Not Do

• Facial recognition or face-matching across cameras, days, or visits
• License-plate recognition (LPR)
• Biometric identification of any kind (gait, voice, ear shape, gestures used for ID)
• Linking observed individuals to identity data, accounts, prior visits, or other systems
• Automated weapons detection or active-threat scoring
• Building "profiles" of staff or customers

We will not add these capabilities at customer request. They are deliberately out of scope.

05AI Data Processing & Model Training

We do not use your video, your briefs, or your business data to train AI models. The video frames analyzed by your Stori device are processed locally and discarded after the brief generation cycle (default 14 days rolling, configurable). They are never copied to our servers. The brief text is delivered to your inbox; we do not retain copies for training.

If you explicitly enable optional cloud-assisted tasks routed to a third-party model provider, that provider's own data policies apply. We select providers whose API terms state they do not train on API inputs by default. You can review each provider's data policy in your device dashboard before enabling routing.

06How We Use Your Information

We use the limited account and telemetry data we collect to:

• Process reservations, orders, account management, and customer support
• Deliver firmware and template updates (over-the-air) and security patches
• Improve product performance based on aggregate, anonymized telemetry (if you opt in)
• Send product updates and security notifications (you can opt out of non-critical communications)
• Comply with legal obligations

07How We Share Your Information

We do not sell your personal data. We never have and never will.

We share data only with:

• Payment processor: To process reservations and purchases (Stripe)
• Email delivery provider: To deliver your daily brief and account communications
• Shipping and fulfillment partners: Name and shipping address only, for device delivery
• Cloud model providers (if you opt in): Only the specific task payload, only when you've enabled cloud routing, only to the provider you've configured
• Hosting and infrastructure: For the Stori website and account management — not for device data
• Legal compliance: If required by law, subpoena, or court order

08Workplace-Monitoring & Two-Party-Consent Notice

Stori reads from cameras that are typically installed in workplace and customer-facing areas. Many U.S. states (including California, Florida, Illinois, Massachusetts, Maryland, Montana, New Hampshire, Nevada, Oregon, Pennsylvania, and Washington) have specific consent and notice requirements that apply to recorded video and audio. Many other jurisdictions worldwide have analogous rules.

You — as the operator of the cameras and the device — are responsible for posting required notices and obtaining required consents. Stori provides a state-specific workplace-monitoring notice template with each device to support compliance, but the legal obligation is yours. If your installation includes audio capture, additional rules typically apply; configure with care.

09Data Retention & Deletion

On-device data: Stored on your device for as long as you choose. Default retention 14 days rolling, configurable up to 60 days based on storage. Factory reset erases everything.

Account data: Retained while your account is active. Upon account deletion, we remove your data within 30 days, except where legal retention is required (tax, warranty records).

Telemetry data: Anonymized and aggregated. Individual device telemetry is not retained beyond 90 days.

If you cancel and keep the box: Your existing video recordings remain on the device under your control. We have nothing to delete because we never had a copy.

10Data Security

Your Stori device encrypts stored video at rest. All network communications use TLS 1.3. The device sits on your network, behind your firewall, under your physical control. We cannot remotely access your device's video or briefs — not for support, not for diagnostics, not for any reason.

11Children's Privacy

Stori is a business tool not directed at children. We do not knowingly collect personal information from children under 13. If you operate a business in which minors are routinely present (e.g., a children's-services facility), additional consent and notice obligations may apply to your camera installation regardless of Stori's role.

12Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your account data
• Export your account data in a portable format
• Opt out of telemetry collection
• Withdraw consent for non-essential data processing
• Lodge a complaint with your local data protection authority

13U.S. State Privacy Rights

If you are a California resident (CCPA/CPRA), you have additional rights including the right to know what data we collect, request deletion, and opt out of data sales. We do not sell personal data. Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws have analogous rights. For requests, email hello@stori.app.

For Illinois residents: Stori does not collect, store, or process biometric identifiers or biometric information as defined by the Biometric Information Privacy Act (BIPA). The product is designed to operate without producing such data.

14EEA/UK Rights (GDPR)

If you are in the EEA or UK, our legal bases for processing are: contract performance (order fulfillment, delivery of the brief), legitimate interest (product improvement via anonymized telemetry), and consent (marketing communications). You may contact our Data Protection Officer at hello@stori.app.

15International Data Transfers

Your video data stays on your device — there is no international transfer of your video. Account and website data may be processed in the United States. We use Standard Contractual Clauses where required for cross-border transfers of account data.

16Changes to This Policy

We will notify you of material changes via email and a prominent notice on our website at least 30 days before they take effect.

17Contact

All inquiries: hello@stori.app