Privacy Notice
Last updated: 27 August 2026
1. Who we are
StoryRoad is operated by The Hakso English School Ltd ("we", "us", "our"). We are the data controller for personal data processed through the StoryRoad app and website. If you have any questions about this notice or how we handle your data, please contact us through the support channel in the app.
2. Personal data we collect
- Account data: email address, display name, login credentials.
- Trip data: starting point, destination, language preference, and route information you enter to receive narration.
- Usage & telemetry: km narrated, wallet balance, feature usage, device type, browser, IP address.
- Support messages: anything you send us when contacting support.
- Payment data: handled entirely by our payment provider Paddle — we do not receive or store card details.
3. Why we use your data (purposes & legal bases)
- Provide the service (account creation, narration, km wallet) — performance of contract.
- Security & fraud prevention — legitimate interests.
- Product improvement and analytics — legitimate interests.
- Customer support — performance of contract / legitimate interests.
- Legal and tax compliance — legal obligation.
4. Who we share data with
We share personal data only with the following categories of recipients:
- Service providers / subprocessors: hosting (Lovable Cloud / Supabase), AI narration and text-to-speech providers, email delivery, and analytics tooling used to run the service.
- Merchant of Record: Paddle.com Market Ltd processes all sales of StoryRoad. Paddle acts as reseller and handles payments, subscription management, tax compliance, invoicing, refunds, and related customer service inquiries. See Paddle's privacy policy at paddle.com.
- Professional advisers (legal, accounting) where necessary.
- Authorities where required by law.
We do not sell your personal data.
5. International transfers
Some of our subprocessors may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or adequacy decisions.
6. Data retention
We keep personal data only for as long as needed to provide the service and to meet legal, accounting, and tax obligations. Account data is kept while your account is active and deleted or anonymised within a reasonable period after account closure. Payment records retained by Paddle are subject to Paddle's own retention rules.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. UK/EEA users have these rights under UK GDPR / GDPR and can also complain to their local supervisory authority. To exercise a right, contact us through the app support channel; we aim to respond within one month.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and separation of production credentials. No system is perfectly secure, but we work to reduce risk.
9. Cookies
StoryRoad uses strictly necessary cookies and local storage for authentication, session management, and remembering preferences. We may use limited analytics to understand how the service is used. You can control cookies through your browser settings.
10. Changes to this notice
We may update this notice from time to time. Material changes will be highlighted in the app or by email where appropriate.