Last updated: September 26, 2026
This notice explains how Startories, operated by Nzoni App LLC ("Startories", "we", "us" or "our"), processes personal data under the EU General Data Protection Regulation (GDPR) and the UK GDPR. It completes our Privacy Policy.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (name, email, password hash or Google profile) | Create and secure your account | Contract (Art. 6(1)(b)) |
| Project data (website, product description, ideal customer profiles, sources, goal, competitors) | Analyze your product and run your acquisition engine | Contract |
| Billing data (plan, subscription status, payment history, cancellation reason) | Subscriptions, invoicing, accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Usage and device data, cookies | Operate, secure and improve the Service | Legitimate interests (Art. 6(1)(f)); consent where required for non-essential cookies |
| Prospect business data (name, job title, business email, company, public signal, location, time zone) | Identify companies showing buying intent and the right decision makers | Legitimate interests in B2B prospecting, balanced against the person's rights |
| Campaign data (emails sent, replies, reply intent, meetings) | Send the customer's campaigns, manage replies, stop outreach on opt-out | The customer's legitimate interests (we act as processor); legal obligation for opt-out records |
| Marketing emails to customers | Product news | Consent or legitimate interests, with an opt-out in every email |
We do not use sensitive categories of data (Art. 9) and we do not make decisions producing legal or similarly significant effects on people solely by automated means. AI is used to score leads and to classify and draft email replies; sensitive replies are reviewed by our team before they are sent.
If you received an email sent through Startories, or your business details appear in a customer's leads:
An up-to-date list is available on request. We require each provider to protect personal data under terms consistent with the GDPR.
Some providers process data outside the EEA and the UK, including in the United States. We rely on the EU-U.S. Data Privacy Framework where a provider is certified, or on the European Commission's Standard Contractual Clauses and the UK Addendum, with additional safeguards where needed.
Access to customer projects is restricted per account, sensitive settings (such as sender mailboxes) are limited to our administrators, connections are encrypted and mailbox passwords are encrypted at rest. We notify the supervisory authority and affected people of personal data breaches as required by Articles 33 and 34.
Contact us at click to show email. We answer within one month. When we process your data as a processor for a customer, we forward your request to that customer and help them answer it.
You also have the right to lodge a complaint with the data protection authority of the country where you live or work.
As controller of your campaigns, you confirm that your offer is relevant to the professionals targeted, that your messages identify your company and that you respect the opt-out rules of the countries you target. We handle unsubscribe requests for the campaigns we run for you.