Privacy note

Version 2026-11-07

Who runs Storylode. Utz Jörg Nisslmüller, Rudolf-Hausner-Gasse 4, 1220 Vienna, Austria. Contact: ai@nisslmueller.me.

What we store. Your account (name, email, a hash of your password), your profile and test scores, the documents and essays you upload or write, your notes and to-dos, the reviews the app makes, records of background jobs, the invite code you used, when you agreed to these texts, and the passes you bought (which pass, the price and the date).

Why. Only to review and organize your MBA application. The legal basis is our contract with you (GDPR Art. 6(1)(b)). Essays can hold sensitive details, for example about health, religion or ethnicity. We process those only because you agree to it at sign-up (GDPR Art. 9(2)(a)). You can withdraw this by deleting that text or your account.

Where. The app runs on a server of IONOS SE (Germany) in a data centre in Spain (EU). Encrypted nightly backups are kept in Microsoft Azure, Germany, for 14 days.

Outside services.

• OpenRouter (USA) sends your text to an AI model provider for each review (for example Anthropic, Google or OpenAI). Zero data retention is required for every request and every model: OpenRouter sends your text only to providers that do not store it and do not train on it. If no such provider is available, the review fails; it never goes to a provider that keeps data. The providers can process your text in the USA or in other countries outside the EU. The legal basis for this transfer is the EU Standard Contractual Clauses in OpenRouter's data processing agreement (GDPR Art. 46(2)(c)).
• GitHub (USA, a private repository) stores the feedback reports you send with the Feedback button. A report holds what you type, your user id and plan, and technical details: the page, the ids of the school and document versions on it, your browser, recent error messages and your last background jobs. It never contains your essay or document text. The transfer to the USA is covered by the EU-US Data Privacy Framework (GDPR Art. 45).
• Pangram (USA) checks a final essay for passages AI detectors might flag, only if you turn on the AI check in Settings. It gets the text of that essay version, once, and handles it under its own privacy policy (pangram.com/privacy-policy). Unlike the AI reviews, this check has no zero-data-retention promise. The legal basis is your consent when you turn the check on (GDPR Art. 6(1)(a), and Art. 49(1)(a) for the transfer to the USA). You can turn it off at any time in Settings.
• Brave Search gets only school names, for school research.
• Stripe sells the passes through its checkout Link, as the seller of record. Stripe gets your email and the payment details you enter in its checkout, and handles them under its own privacy policy (stripe.com/privacy). We never see your card. Stripe tells us only that a payment went through, for which pass and at which price. Stripe can process data in the USA; this transfer is covered by the EU-US Data Privacy Framework (GDPR Art. 45). The legal basis is our contract with you (GDPR Art. 6(1)(b)).
• Brevo (Brevo GmbH, Germany) sends the app's emails, for example your invite link. It gets only your email address and the email text. Brevo stores data in the EU, but its own service providers can be outside the EU; such transfers use the EU Standard Contractual Clauses (GDPR Art. 46(2)(c)).

We do not sell your data, show ads, or use your data to train AI models.

How long. Until you delete it or your account. The beta ends on 23 November 2026. You can then still sign in to read or delete your work, but not start new reviews. If you buy a pass, you keep working on the same account. We delete an account when nobody has signed in to it for 12 months. We email you 30 days before, so you can save your work or sign in to keep the account. Backups expire after 14 days. Records of payments that tax law requires us to keep stay for 7 years, without your work.

Waitlist. If you join the waitlist on storylode.com, we store what you enter in the form: your email, target schools and round, country, role, essay stage, how you heard of us, and, if you choose, what you want help with most. We use it only to email you once when Storylode launches and, if we pick you, to email you a beta invite. The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by email, and we then delete your entry. We keep your entry until we have sent you the launch email, and at the latest until 31 January 2027. An entry from before 4 November 2026 without the ticked box "email me once when Storylode launches" gets no launch email; we delete it at the latest on 23 November 2026, when the beta ends.

Usage statistics. To see how Storylode is used and what it costs, the app records events such as sign-up, sign-in, an upload, a sent essay, a finished review with its AI model, token count and cost, and a pass bought. Each event holds your random account id, your plan, the school and a time. Events also hold the answers from your applicant profile's lists (age range, region, experience, current industry, post-MBA direction) and your best score for each test you entered, never your goal text. A beta waitlist request is counted with its answers from the form's lists (number of schools, round, essay stage, country, industry, how you heard of us), without your email. An event never holds the text of your work, the reviews, your name, your email or your IP address. The events go over an encrypted connection to our analytics server in Austria. We keep them for 13 months. From the events we also keep daily totals without any account id, for example passes bought, income and AI cost per day. These totals are not personal data, and we keep them for 4 years. The legal basis is our legitimate interest in running and improving the service (GDPR Art. 6(1)(f)). You can object at any time by email. storylode.com counts visits from its server log with a shortened IP address (the last part removed) and sets no cookies; we keep these counts for 90 days.

Server security logs. To keep the service secure and running, our server's own system logs and technical numbers (for example CPU, memory and disk use) go over an encrypted connection to the same analytics server in Austria. The system logs record connections that our firewall or our attack protection blocked, with their IP address, and sign-ins to the server by our administrator. They never hold the text of your work, your name or your email. We keep them for 30 days. The legal basis is our legitimate interest in the security of our service (GDPR Art. 6(1)(f), Recital 49).

Delete everything. Settings → Delete my account removes your account and all your data at once, including your waitlist entry and emails not yet sent. Feedback reports on GitHub stay; email us and we delete them.

Your rights. You can ask to see, correct, delete or export your data, to limit or object to its use, and you can complain to a data protection authority (in Austria: the Datenschutzbehörde, dsb.gv.at). Email ai@nisslmueller.me.

Cookies. Only the cookies needed to sign in. No tracking.