Effective April 29, 2026

Privacy Policy

Bonfire Stories (“we”, “us”) takes your data seriously. This policy describes what we collect, how we use it, and the choices you have.

1. Information We Collect

Account data. Name, email, and authentication provider data we receive from Clerk when you sign up.
Workspace content. Properties, campaigns, contact lists, video submissions, transcripts, and AI-generated analyses you create or upload.
Recipient contact details. Email addresses and phone numbers you provide so we can deliver magic links on your behalf.
Usage data. Page views, server logs, and audit events used to operate, secure, and improve the Service.
Billing data. Stripe handles your payment method; we store only a customer reference and invoice metadata.

2. How We Use It

To provide the Service: render dashboards, deliver magic links, transcribe video, run AI analysis, issue rewards.
To keep the Service safe: detect abuse, prevent spam, and respond to incidents.
To communicate with you: support, billing notices, security alerts.

We do not sell your data, and we do not use your workspace content to train third-party foundation models.

3. Subprocessors

The Service relies on these processors:

Vercel — application hosting
Supabase — primary database
Clerk — authentication
Mux — video ingest, storage, and playback
OpenAI — transcript summarization and theming (with no-training opt-out)
Twilio / SendGrid — SMS and email delivery
Stripe — subscription billing and wallet top-ups
Tremendous — reward delivery

4. Recipient Recordings & Consent

Recipients confirm consent on the recording screen before submitting a video. We capture the consent version they accepted, the timestamp, and the IP address used. You as the workspace owner are responsible for ensuring you have a lawful basis to contact each recipient.

5. Data Retention & Deletion

We retain workspace data for as long as your workspace is active. You can request deletion of your workspace and all associated data (including video files in Mux and Storj) by emailing hello@bonfirestories.app. We will complete deletion within 30 days, except where we are required to keep records (e.g. invoices for tax purposes).

6. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. Email us to exercise any of those rights and we will respond within the timeframe required by applicable law.

7. Security

We use encryption in transit, role-based access controls, audit logging, and managed infrastructure to protect your data. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

8. International Transfers

Our subprocessors operate primarily in the United States. By using the Service you acknowledge that your data may be processed in the United States and other countries.

9. Changes

We may update this policy. The effective date at the top reflects the most recent change. Material changes will be communicated via the Service or email.

10. Contact

Reach us at hello@bonfirestories.app with any privacy questions or requests.