⚠️ Informative translation only. The French version of this document is the legally authoritative one. If there is any discrepancy between this translation and the French version, the French version prevails.

Privacy Policy

Last updated: July 31, 2026

The website TrendStory.io is operated by TRENDSTORY LLC, a limited liability company organized under the laws of the State of Wyoming, United States, with its registered office at 30 N Gould St Ste R, Sheridan, WY 82801, United States. TRENDSTORY LLC is the data controller for your personal data. Contact: support@trendstory.io.

1. Data Collected

When you register on TrendStory, we collect the following data:

Your email address
A password (stored in encrypted form — we never have access to it in plain text)

Authentication on TrendStory is done by email and password, or via Google sign-in (Google OAuth), through Supabase Auth. If you use Google sign-in, we receive your email address and an account identifier from Google — never your Google password.

We also collect technical usage data (access logs, IP address, browser type) for security and debugging purposes.

2. How We Use Your Data

Your data is used exclusively for:

Creating and managing your user account
Authenticating you and securing your access to the platform
Sending you notifications relating to your subscription (renewal, expiry, invoices)
Processing your payments through our payment provider Whop
Ensuring the security and proper functioning of the service
Responding to your support requests

We do not use your data for unsolicited commercial prospecting. We do not sell or rent your data to third parties.

3. Storage and Security

Your data is hosted on Supabase and Railway servers, with communications encrypted by SSL/TLS protocol. Passwords are hashed with bcrypt and are never stored in plain text.

Upon deletion of your account, your personal data is deleted within a maximum of 30 days. Data required for legal obligations (accounting, billing) may be retained longer in accordance with applicable law.

4. Data Sharing

Your personal data is never sold to third parties. It may be shared only with the following technical service providers, strictly within the scope of service delivery:

Supabase — database hosting and authentication
Whop — Merchant of Record: payment processing, billing, VAT collection and subscription management. Whop directly collects your payment data (bank card, billing address) — this data does not pass through TrendStory.
Railway — application infrastructure hosting
Kie.ai — AI-powered video and image generation (your prompts may be transmitted to this service)
Cloudflare, Inc. — anti-bot protection via Cloudflare Turnstile on the sign-up form. Purpose: prevent automated account creation. Legal basis: legitimate interest (GDPR Art. 6.1.f). Cloudflare does not place any third-party cookies; technical data (IP address, user-agent) is processed only during verification then discarded. Privacy policy: cloudflare.com/privacypolicy.
DeepSeek — the TrendStory Agent conversational AI assistant is powered by DeepSeek (operated from China). When you use the Agent, the creative video ideas you type are sent to DeepSeek solely to provide AI-assisted creative suggestions. No personal or identifying data is transmitted (no name, email address, or account identifier) — only the prompt content you write. Legal basis: performance of the contract (GDPR Art. 6.1.b). This constitutes an international data transfer to a third country (China); it is governed by appropriate safeguards, including standard contractual clauses approved by the European Commission, in accordance with GDPR Art. 46.
Replicate, Inc. — fallback provider for AI image and video generation (your prompts may be transmitted to this service if the primary provider is unavailable)
Anthropic, PBC — AI video script generation (the topic you type is transmitted to this service)
OpenAI — automatic subtitle generation (the audio of generated videos is transmitted to this service)
Resend — transactional and, where applicable, marketing email delivery (your email address is transmitted to this service)
Amplitude, Inc. — product analytics and usage statistics (data hosted in the European Union)
Cloudflare, Inc. (R2) — storage of generated videos and character images
MoreThanPanel — only if you use the Boost feature: the public link of the social account to promote is transmitted to this service

These providers are subject to their own privacy policies and are required to process your data confidentially.

5. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

Right of access: obtain a copy of the data we hold about you.
Right of rectification: correct inaccurate or incomplete information.
Right to erasure: request the deletion of your data ("right to be forgotten").
Right to portability: receive your data in a structured, machine-readable format.
Right to object: object to the processing of your data in certain cases.

To exercise any of these rights, contact us at support@trendstory.io. We undertake to respond to your request within 30 days.

If you believe your rights are not being respected, you have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés — the French data protection authority) at cnil.fr, or with the supervisory authority in your country of residence.

6. Cookies

TrendStory uses two categories of cookies:

6.1 Essential cookies (always active)

Required for the service to function: authenticated Supabase session, language preference, shopping cart. These cookies cannot be disabled and do not send any data to third parties.

6.2 Marketing cookies (with consent only)

With your explicit consent, we use the following cookies:

Meta Pixel — Meta Platforms Ireland Ltd, Merrion Road, Dublin 4, D04X2K5, Ireland. Purpose: ad performance measurement and custom audience creation on Meta (Facebook, Instagram). Maximum duration: 90 days.
TikTok Pixel — TikTok Technology Ltd, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. Purpose: ad performance measurement on TikTok. Maximum duration: 13 months.
Snap Pixel — Snap Inc. (and Snap B.V., Amsterdam, Netherlands, for European users). Purpose: ad performance measurement on Snapchat. Maximum duration: 13 months.
FirstPromoter (fd_ref) — FirstPromoter SRL. Purpose: affiliate referral tracking. Duration: 60 days.

You can withdraw your consent at any time via the "Cookies" link in the footer or in Settings > Cookies & privacy. Withdrawing consent triggers effective deletion of the deposited marketing cookies.

Legal basis: consent (Art. 6.1.a GDPR).

6.3 Server-side conversion APIs — Meta, TikTok, Snapchat (transmission on payment)

Upon a validated payment (initial subscription purchase or credit pack purchase — not upon automatic renewals), we transmit transaction information to the following advertising platforms via their server-side conversion APIs: Meta Platforms Ireland Ltd (Conversions API), TikTok Technology Ltd (Events API) and Snap Inc. (Conversions API).

The data transmitted is:

Hashed email address (SHA-256 lowercase)
Pseudonymized and hashed internal user identifier
Hashed country code (SHA-256, ISO alpha-2)
Payment ID, amount, and currency
Depending on the platform: browser identifiers (_fbp/_fbc for Meta, click identifiers for TikTok and Snapchat, when available), IP address and user-agent captured at checkout

This transmission only occurs after your explicit consent via the cookie banner (marketing category). GDPR legal basis: article 6.1.a (consent) + article 49.1.a (cross-border transfer based on explicit consent).

You may withdraw your consent at any time via the footer ("Manage cookies"), which will immediately disable these transmissions for your future payments.

These platforms use this information to measure the effectiveness of our advertising campaigns. Privacy policies: Meta · TikTok · Snap.

6.4 Local storage (sessionStorage / localStorage)

In addition to cookies, a few technical keys are stored in your browser's sessionStorage or localStorage:

ts_click_fbclid / ts_click_ttclid / ts_click_sccid (sessionStorage) — ad click identifiers captured from the URL on landing, enabling ad measurement once you grant consent. Purged when the tab closes and on consent withdrawal.
ts_signup_event_id (sessionStorage) — internal technical identifier used to deduplicate signup events between the browser and our servers.
ts_consent_synced:<account identifier> (localStorage) — internal technical flag indicating your consent choice has already been synced to our database.
meta_event_id/meta_checkout_type/meta_checkout_plan_id/meta_checkout_value, tt_event_id/tt_checkout_type/tt_checkout_plan_id/tt_checkout_value, snap_event_id/snap_checkout_type/snap_checkout_plan_id/snap_checkout_value, and fd_checkout_currency (localStorage) — technical context for an in-progress payment (dedup identifier, purchase type, currency), written as soon as you pick a plan or pack, regardless of your marketing consent choice. Automatically purged once the payment is confirmed.
ts_checkout_return (sessionStorage) — technical path to resume after an external payment (Whop). Expires after 1 hour and is deleted as soon as it's read.

These keys aren't cookies in the strict sense, but local storage is subject to the same privacy rules under Article 5(3) of the ePrivacy Directive.

7. Minor Users

TrendStory is reserved for persons aged 18 and over. We do not knowingly collect personal data from minors. If you become aware that a minor has created an account on our platform, please notify us at support@trendstory.io so that we can take the necessary steps.

8. International Data Transfers

In the course of our business, your data may be processed in countries outside France or the European Union, in particular through our providers Supabase, Railway, Whop and Kie.ai, whose servers may be located in the United States or other third countries.

These transfers are governed by appropriate safeguards (standard contractual clauses, data processing agreements) in accordance with GDPR requirements.

9. Changes to This Policy

TrendStory reserves the right to amend this privacy policy at any time. In the event of a significant change affecting your rights or the nature of the data collected, you will be notified by email at the address associated with your account, with reasonable advance notice before the changes take effect.

The current version is always accessible on this page with the last updated date.

10. Contact

For any questions relating to this privacy policy or to exercise your rights, contact our team:

support@trendstory.io

Website: TrendStory.io