PRIVACY & GDPR

Privacy Policy

Storyprint is a trading name of Nomis IT. This policy explains which personal data we process when you use Storyprint, why we process it, who may receive it and which rights you have.

1. Data we process

Depending on how you use the website, we process information you enter or upload, including trip title and description, travel dates, locations and route points, memory text and photos. When you order, we may process the order reference, name and email address where provided by Stripe, selected format, total amount, payment status and records of your acceptance of terms and any express request for immediate digital delivery. We may also process technical data such as IP address, browser information, error logs and security logs.

2. Purposes and legal bases

We process data to create and display your design, perform the contract, enable payment and digital delivery, record contractual and consent choices, handle customer service and withdrawal requests, prevent fraud and abuse, keep legally required records and maintain a secure and reliable service. Depending on the processing, the legal basis is performance of a contract, a legal obligation, our legitimate interests in security and operations, or your consent where required.

3. Designs, photos and local storage

The editor may store parts of your design locally in your browser to provide the requested design functionality. When you begin checkout, generated artwork may be uploaded to our server so it can be securely delivered after successful payment. You retain ownership of your photos and text.

4. AI features

If you actively choose the feature that creates a short poster text, your memory text and limited trip context required for that request may be sent through our server to OpenAI. Do not use this feature for sensitive personal data that is not necessary. AI output can contain errors; you remain responsible for reviewing and choosing the text you use.

Help assistant (chat). When you use the chat on the website, we send your messages through our server to OpenAI, together with the context needed to help you: in the editor your current design (texts, stops, dates, chosen size and price, without photos), and for questions about an order the status of that order. We only look up an order when you are signed in or give your order number and the matching e-mail address. OpenAI keeps the conversation for at most 30 days to continue it and to prevent abuse, and does not use it to train models. If you ask the assistant to forward something, we e-mail your message and e-mail address to info@storyprint.nl. The assistant only changes your design when you click “Apply”. Please do not share sensitive data in the chat. The legal basis is our legitimate interest in helping customers quickly.

5. Maps and location services

For maps and location search, your browser may connect to OpenStreetMap-related services. Those providers receive normal technical connection data such as your IP address. The map used in the final artwork is generated through our server using a map service. Route points and map framing are processed only as needed for that function.

6. Country suggestions and newsletter

If you suggest a country through the "Which country are you missing?" form, we process the country you name and, if you enter it, your e-mail address. We use that address to let you know the map is available. You receive at most a one-off e-mail about this; it does not subscribe you to the newsletter. The legal basis is your consent. We delete the address no later than 12 months after your suggestion.

For the newsletter we process your e-mail address, language, the time you signed up and confirmed, and the page you signed up on. You are only subscribed after clicking the confirmation link in your e-mail (double opt-in). The legal basis is your consent; you can unsubscribe at any time via the link at the bottom of every newsletter or by e-mailing info@storyprint.nl. After unsubscribing we only keep the fact that you unsubscribed, so we don't e-mail you again; unconfirmed sign-ups are deleted after 30 days.

Account. You can sign in to your account with a sign-in link we send to your e-mail address (valid for 15 minutes). For this we process your e-mail address and, while you are signed in, a session (at most 30 days). Your account shows the orders and invoices linked to that e-mail address. The legal basis is the performance of the contract. Orders and invoices are kept for as long as the tax retention obligation applies (7 years).

Saved designs. When you save a design, we store your design data (texts, stops, dates and settings) and the photos you added, resized to at most 3000 pixels, in your account. A design is deleted automatically 12 months after its last change. You can also delete a design yourself at any time; its photos and data are then erased immediately. Your account keeps a short history (date, design name and whether it was saved, updated or deleted), so you can see later what happened to a design. If you save without being signed in, we keep the design for at most 48 hours until you confirm the link in your e-mail. The legal basis is providing the service you asked for.

7. Recipients and service providers

We use specialised providers including Netlify for hosting, server functions and temporary storage, Stripe for payments, Resend for sending e-mails (order confirmations, map notifications and the newsletter), OpenStreetMap-related services for maps and location search, a map provider for server-side poster maps, OpenAI for the optional AI text feature and external CDNs such as unpkg and jsDelivr for web libraries. With your consent, Google Analytics 4 may be used for analytics and the Meta pixel for advertising measurement and conversion tracking.

8. Transfers outside the EEA

Some service providers may process data outside the European Economic Area. Where this occurs, we rely on a valid transfer mechanism under the GDPR, such as an adequacy decision or European Commission standard contractual clauses, supplemented by appropriate safeguards where required.

9. Retention

We do not keep personal data longer than necessary. As a general rule: unpaid and temporary artwork files are retained for up to 30 days; paid download files for up to 90 days; fiscal order and payment records generally for 7 years; evidence of acceptance of terms and immediate digital delivery choices for up to 7 years; customer service, withdrawal and privacy request correspondence generally for up to 2 years after completion; and technical/security logs generally for up to 90 days, unless a longer period is required for a specific incident, dispute or legal obligation.

10. Security

We take appropriate technical and organisational measures to protect personal data. Full card details are not processed by Storyprint itself but in Stripe's payment environment. Digital downloads are made available only after the server verifies a valid paid Stripe session.

11. Your rights

Where provided by the GDPR, you can request access, correction, deletion, restriction or portability of your personal data, object to certain processing and withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of earlier processing. Requests can be sent to info@storyprint.nl.

12. Complaints

If you have a privacy complaint, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority or, where applicable, another competent European supervisory authority.

13. Minors and other people

Storyprint is not specifically directed at children. If you add photos or information about other people, make sure you do so lawfully and respect their privacy.

14. Cookies and external scripts

More information about local storage, external libraries, Google Analytics 4, the Meta pixel and consent choices is available in our Cookie Policy.

15. Changes

We may update this policy when our service, providers or applicable law changes. Last updated: 11 October 2026.