Privacy Policy | Live Story

1. Who operates Live Story and how to contact us

Live Story is operated by Marcin Czepiela, a sole trader trading as Marcin Czepiela Software Development, ul. Zofii Gumińskiej 16/1, 51-215 Wrocław, Poland, tax identification number (NIP): PL8952254462, business register number (REGON): 524700720. In this policy, “Live Story”, “we” and “us” refer to this business.

For privacy enquiries, exercising your rights, reports about materials and appeals, contact us directly at contact@live-story.eu. You can also write to the address above. No data protection officer has been appointed; these matters are handled by the owner.

2. Services covered by this policy

This policy covers the website and visitor service (Site), the content management panel (Studio) and the use of Live Story services through the mobile application. The API is the technical backend for these services, supporting accounts, materials, access to routes and saving progress, among other functions.

The data involved depends on the function you use. Simply browsing public materials does not require registration. Managing content, following venues and using account-related functions require appropriate access. Using Live Story alone does not grant the mobile application additional permissions to access contacts, the microphone, photos or location. Any functions requiring such permissions need separate information when they become available.

This policy explains data processing and does not replace the Terms of Service. Reading it does not constitute consent to all the operations described.

3. Live Story and venues

Live Story is the data controller for purposes it determines independently, in particular managing platform accounts, handling enquiries, system security and its own website analytics.

A venue decides on its materials and communications. A museum, institution or other entity using Studio selects content for publication, gives its employees and editors access and initiates messages to followers. For these purposes, it may be a separate controller, with Live Story processing data on its behalf. The role follows the actual allocation of decisions and responsibilities, not simply ownership of the system.

This does not mean that every venue operation has the same legal basis as managing your Live Story account. If data concerns a venue’s materials, staff or messages it initiates, you can also direct your enquiry to that venue. We will help identify the appropriate recipient of your request. A venue’s responsibility for the lawfulness of its materials does not remove Live Story’s obligations.

Venues have access to their own content and the data of people managing it. Venue functions provide visitor statistics, not lists of visitors’ email addresses or individual tourist profiles. However, source data in the Live Story database may remain linked to an account. Aggregating data into statistics alone does not guarantee anonymity, particularly where few people are involved.

4. What data we receive and where it comes from

We receive data from you, from the organisation or venue that adds you to its team or uploads materials, and through the operation of your device and technical services. A person may have more than one role, for example as a visitor and a venue editor.

Account and profile: User identifier, email address, credentials handled by Firebase Authentication, email verification status, account-related dates, account status, display name and profile data: language, country, first and last name, date of birth, gender selection and preferred venue types. Date of birth and interests are optional; the gender options include “Prefer not to say”. We also record profile completion status. Named accounts currently use email and password to sign in.
Organisation and team: Organisation and venue membership, role, permissions, membership status and information needed to invite someone or manage access. A team administrator may provide this data.
Materials and their authors: Texts, photos, recordings, media names and descriptions, contact details in a venue profile and other information entered into Studio. These may include the image, voice, biography or data of people described in the materials. This applies to public content and to unpublished or access-restricted content. The scope depends on the material supplied by the venue.
Routes, access and quizzes: Granted and revoked route permissions, access grant and expiry times, route library, visited points, current stage, route starts and completions, numbers of starts and completions, time spent on a route, selected quiz answers and answer times. For functions saving progress on the server, this information is linked to an account identifier.
Following and notifications: Followed venues, separate email and push settings, records of communication choices, the version of the consent notice, device identifiers and notification tokens, delivery attempts, delivery statuses, unsubscribes and non-delivery reports.
Contact and requests: Correspondence and data provided in the form: first and last name, email, telephone number, contact language, venue information, subject and consent to contact. A request may concern an offer, assistance, a violation or exercising rights. Do not send other people’s data or particularly sensitive data unless needed to explain the matter.
Technical data: IP addresses and browser information processed by infrastructure providers, session and authentication status, and request and error logs. API logs include the request method and path, its identifier, processing time and response code. The path may contain a resource identifier. With consent, we also collect the analytics data described in section 8.

Public materials are available to others and may be indexed by search engines or copied outside Live Story. Removing a material from our service does not automatically remove a copy made by another entity. Non-public materials do not become public simply because we store them on the platform.

5. Purposes and legal bases for processing

Below we distinguish the bases in Article 6(1) GDPR. Point (b) means performing a contract or taking steps at your request before entering into one, point (c) a legal obligation, point (f) a legitimate interest and point (a) consent. The basis must match the specific operation and does not automatically cover all data that can be entered in a form.

Processing purposes and legal bases
Operation	Purpose and basis
Account, login, route access, progress and quizzes	Providing the selected service, recognising permissions and enabling you to continue your visit: Article 6(1)(b), to the extent necessary for performance. This also applies to the technical identity of an anonymous account.
Team and Studio management	Performing a contract with a person who is party to it: point (b). Contacting organisation representatives and managing their roles: point (f), the interest in carrying out the cooperation and controlling permissions. Data processed on a venue’s instructions requires a legal basis on its side.
Service enquiries, assistance and correspondence	Responding to a request before a contract or delivering the service: point (b). Other correspondence and handling reports: point (f), the interest in responding and clarifying the matter. The contact consent required by the form concerns the indicated contact, not unrestricted marketing.
Optional venue messages	Sending through the selected channel according to the user’s choice: point (a), together with electronic communications requirements. The venue determines the purpose of its message; following alone does not replace separate channel settings.
Website analytics	Analysing website use with Firebase Analytics: point (a). Analytics starts according to the choice made in analytics settings.
Security, logs, moderation and abuse	Protecting accounts and the system, diagnosing errors, handling violations and establishing, exercising or defending legal claims: point (f). This interest requires consideration of the data subject’s rights and circumstances.
Legal obligations	Honouring individuals’ rights, complying with a lawful request from a competent authority and documentation obligations where applicable: point (c). The scope follows the specific obligation, not a general desire to retain data.

Voluntary provision and consequences. Without data necessary for login or granting access, we cannot provide the relevant function. Omitting optional profile data does not prevent browsing public content. Refusing analytics and optional notifications does not disable the core service.

Date of birth and gender. These data are currently stored in profiles with the intention of using them for demographic statistics. Those reports have not yet been launched. Entering data or accepting this policy does not constitute consent to any future use. We do not present age or gender analysis as necessary to provide the core service.

If materials contain special categories of data, such as health data, citing one of the above bases is not sufficient: the additional conditions in Article 9 GDPR apply. A venue’s inclusion of such data does not relieve either party of establishing the appropriate grounds for processing.

6. Anonymous accounts and route access

When you use a function requiring user recognition, particularly when claiming access to a private route from a QR code, a Firebase Authentication anonymous account may be created. It does not require an email address but receives a persistent identifier. The associated permissions, progress and answers are therefore not anonymous data within the meaning of the GDPR.

In a browser, login is retained locally and may survive closing the window. Signing out, clearing site data, changing devices or losing local state may prevent access to that identity. Without first linking the account to an email address and a sign-in method, there is no standard way to recover access. Once linked, you can use named-account recovery.

Route access expires according to its settings or may be revoked. This is not the same as signing out, deleting an account or erasing history. We do not use automatic deletion of anonymous accounts after 30 days. You can write to us about such an account’s data; fulfilling the request depends, among other things, on safely identifying the account concerned.

7. Email, push and following venues

You can follow venues and separately choose whether to receive their emails and push notifications. A venue may initiate notifications about a publication, while the platform handles delivery without giving the venue a list of visitors’ addresses.

We use Resend for email and Firebase Cloud Messaging for push notifications. Delivery requires recipient details or a device token. Push also depends on permission granted in the browser or device operating system. We record communication choices and delivery data to implement settings and handle errors, unsubscribes and complaints.

You can withdraw consent in the settings for a followed venue, through the unsubscribe mechanism in a message or by contacting us. You can also block push notifications in your device settings. Withdrawal applies going forward and does not affect the lawfulness of earlier processing. Changing one channel does not automatically change the other.

Messages necessary to operate an account, such as email verification, access recovery or a response to your request, serve to deliver the service and are separate from optional content notifications.

8. Analytics and device storage

Website analytics

Firebase Analytics starts after consent in an environment supporting the function. It allows analysis of page use, events, sessions and device and browser information. It may use cookies and browser identifiers. We use the data for aggregate analysis and service improvement, not advertising or linking it to information in the contact form. This does not mean that the provider’s data contains no identifiers.

When available, google CMP collects choices for site analytics, our content usage measurement for venues and advertising in one panel. Site analytics helps improve Live Story and requires your consent for this site to store information and to “Develop and improve services”. Content statistics for venues require your consent for this site to store information and to “Measure content performance”. Advertising choices are separate; storage consent alone does not enable either type of analytics. We read the CMP decision on each visit. Earlier choices from the separate panel do not enable these features. Refusal, an unresolved choice or an error leaves the corresponding measurement disabled. Changing a choice does not automatically erase previously collected data or all provider files. If Google does not deliver its form, a Live Story fallback panel collects separate choices for site analytics and content statistics. We store the choice in localStorage for up to 180 days. This record does not grant advertising consent. Ads stay off until Google CMP collects consent. Privacy settings allow you to change or withdraw your choice.

Provider information is available in Google’s Privacy Policy.

Content usage statistics for the venue

Content usage statistics have a separate setting, off by default. Events may wait locally in IndexedDB for up to 7 days and tour state for up to 90 days. The API receives random view, session, run, playback and quiz-attempt identifiers, technical content, media, question and answer IDs, languages, entry source, cumulative active time and playback progress. Quiz correctness is resolved from the published version without sending answer text. It receives no account UID, contact details, URLs, text, titles or precise location. Details are retained for 90 days and aggregate reports for 24 months. Disabling clears the local queue and stops further collection, but does not automatically erase accepted data. We also measure private-content lock screens, successful access activation and subsequent views within the same session, using a random process ID without access codes, account UIDs or cross-device linking.

Storage needed for operation

The browser also stores Firebase login state, the selected language, offer display settings and local route progress. We use localStorage and storage mechanisms used by application libraries. AI model files are stored in the site’s storage on the device. Such data may remain until removed by the user, application or browser; closing a tab alone does not necessarily remove it.

You can manage cookies and site storage in browser settings. Clearing them may sign you out, remove local progress and require models to be downloaded again. It does not erase account data on the server. On shared devices, other people using the same browser profile may access the retained session and materials.

Platform statistics, progress records and security logs are separate from optional website analytics. Disabling Firebase Analytics does not stop data needed for the chosen function being saved, such as route progress.

If Google does not deliver its form, a Live Story fallback panel collects separate choices for site analytics and content statistics. We store the choice in localStorage for up to 180 days. This record does not grant advertising consent. Ads stay off until Google CMP collects consent. Privacy settings allow you to change or withdraw your choice. When available, google CMP is the shared privacy panel on mobile and on public pages without ads too. Loading the message sends Google technical connection data, including the IP address and browser information. Google AdSense ads appear only on selected public venue and resource details, on wide screens, without the No ads entitlement and after a permitting CMP decision. Advertising consent does not grant consent for our content statistics. Google and listed vendors may process identifiers, cookies, device data and ad interactions. Purposes and vendors are listed in the message. Privacy settings lets you change choices; withdrawal stops further corresponding measurement and ad requests without automatically erasing previously collected data.

9. Use by children

Live Story has no general age gate or mechanism verifying age or guardian consent. Children can browse public content without an account, while using a private route may create an anonymous account and record the activity described above.

Guardians and visit organisers should consider what data each function records. An anonymous account does not remove the need to protect a child’s data. Where an information society service is offered directly to a child and processing is based on consent, Article 8 GDPR provides special conditions for guardian consent below the relevant age; in Poland this is 16. This is not a general ban on younger people reading public content.

A parent or guardian can contact us about access to, correction or erasure of a child’s data. We may ask for information needed to confirm their authority to act and identify the account. We do not claim that current functions automatically verify these conditions.

10. Three ways of using AI

Prompt generator for external tools

Studio prepares a prompt from information selected by the user. The user copies it to their chosen tool and then pastes the response into Studio. The generator does not automatically send the prompt to external AI. Data is transferred when the user shares it with their chosen provider. That service’s terms also apply.

On-device generation and translation

After a model is downloaded, the local engine processes the selected texts on the device. Task text is not sent to an external provider to perform that generation or translation. Downloading the model requires a server connection, however, and logging in, fetching materials and saving results still use Live Story services. This does not mean the entire application works without external connections.

The result first goes to a preview and local draft. Changes are saved or published only through the relevant user actions. You can remove a model from the device’s library; deleting a model does not erase content saved in a venue’s resources.

Materials prepared by the owner of Live Story

When providing text preparation and recording creation services, the owner of Live Story uses ChatGPT (OpenAI), Claude (Anthropic) and ElevenLabs. Selected texts needed to perform the service, including non-public materials, are passed to these tools. If text contains personal data, that data also reaches the relevant provider. ElevenLabs is used to create audio from text.

This workflow is separate from local AI in Studio. Retention, further use and possible use of content to improve models depend on the provider, account plan and settings. We do not guarantee that training on submitted materials has been disabled in every service used. A material’s non-public status in Live Story does not itself exclude transfer as part of the commissioned service.

Provider information: OpenAI: data use, Anthropic: data and training, ElevenLabs Privacy Policy. Disclosure of AI use does not replace a legal basis for transferring data or the parties’ obligations when commissioning a service. The Terms of Service govern reviewing AI outputs and permitted materials.

11. Data recipients and transfers outside the EEA

Google Cloud and Firebase: application infrastructure, database, files, authentication, request protection, notifications and, with consent, analytics. The data involved depends on the service used.
Google Workspace: the contact mailbox and correspondence, including information in messages and attachments.
Resend: email delivery and handling recipient details, messages and delivery information.
OpenAI, Anthropic and ElevenLabs: selected texts within the services described in section 10. The provider independently selected by a prompt-generator user depends on that user’s choice.
Venues, their authorised editors and publication audiences: within the scope described in sections 3 and 4. This does not grant the public access to private account profiles.
Competent authorities: where disclosure is legally required in a specific matter.

Processing may take place outside the European Economic Area, particularly in the United States. Firebase Authentication processes data exclusively in US data centres, according to Firebase’s privacy documentation. Locating part of the infrastructure in Europe therefore does not mean all data remains in Europe.

Google describes using the EU–US Data Privacy Framework within the scope of its certification and standard contractual clauses in the relevant processing terms. Applicable documents include the Firebase terms and the Cloud Data Processing Addendum, also for Google Workspace. The Resend Data Processing Addendum provides standard contractual clauses for transfers it covers.

The applicable transfer basis depends on the service, recipient entity and terms applying to the account. We do not automatically attribute these safeguards to all AI tools or all their plans. You can ask us for information about the recipient of your data and a copy of applicable transfer safeguards, subject to protecting confidential information. Naming a provider document alone does not guarantee it covers every possible data flow.

12. Data retention and erasure

We do not apply one retention period to all data. There is currently no general automatic cleanup of inactive accounts and history. Below we describe storage and circumstances relevant to erasure. The absence of automatic cleanup does not itself justify indefinite retention.

Retention by data category
Data category	Period or criterion
Active account and profile	While the account is maintained and its functions are used. Deletion is available as a separate action; inactivity alone does not trigger erasure.
Anonymous account	There is no automatic deletion deadline after 30 days. The account remains on the server even after the device session is lost, until separately deleted. Route access expiry does not delete the account.
Route history, answers and permissions	These allow visits to continue and history to be retained; they currently have no general automatic cleanup deadline. They are stored separately from the profile. Erasure must address these separate records, including after account deletion.
Venue materials and team data	In connection with providing materials and managing cooperation. Deleting an editor’s account does not delete every venue material they edited. A request about data in such materials needs separate consideration.
Correspondence and requests	Until the matter is closed and while its documentation is needed to demonstrate arrangements or handle a specific claim. We consider the subject, the end of cooperation and the applicable limitation period. There is currently no uniform automatic deadline for erasing correspondence.
Consents, unsubscribes and delivery	Settings apply until changed, following ends or the account is deleted. Technical records support delivery and error handling; decision records also show which setting applied. Technical periods may differ; expiry of an unsubscribe token does not reverse an unsubscribe or erase the entire history.
Logs and analytics	According to the diagnostic, security or analytics purpose and the relevant service settings. We do not confirm one common period for all logs and Google Analytics data. Withdrawing consent disables further analytics collection by the application but is not an automatic request to erase earlier data.
Firestore database backups	Daily backups have a 30-day retention period. Separately, point-in-time recovery (PITR) operates with a window of up to 7 days. These periods concern Firestore, not all Storage files, email or backups held by other providers.

Deleting an account currently does not automatically erase every associated record. The procedure removes the authentication account, profile and data covered by communication cleanup. Route history, answers and permissions sit outside the profile and are not covered by the same automatic procedure. Send a request covering those data too to contact@live-story.eu. This technical limitation does not limit your GDPR rights.

Self-service account deletion requires sign-in confirmation. Active organisation or platform roles may require permissions to be resolved first; you can contact us in that case. We assess the right to erasure independently of this interface restriction. In justified cases, some data may remain necessary for a legal obligation or defending a specific claim; this does not justify keeping an entire account as a precaution.

Erased information may remain in existing backups until their retention cycle ends. Authentication data also has a deletion cycle on Google’s side: the provider describes removing account data from live systems and backups within 180 days after deletion is initiated. This should not be confused with the 30-day retention of our Firestore backups.

13. Administrative access and security

The owner of Live Story currently has administrative access. They may inspect data and materials, including non-public materials, for service operation, user support, error diagnosis, compliance checks and handling reports. Such access must relate to a specific purpose and is not an unrestricted right to use content for any purpose.

The system uses authentication, role and permission controls and Firebase infrastructure mechanisms. This does not guarantee an absence of incidents. If you suspect loss of access, disclosure of data or unauthorised publication, report it to our contact address. Obligations to report a breach to an authority and inform individuals depend on the circumstances and risk under the GDPR.

Protect your sign-in details and sign out on shared devices. Venues should give access to authorised people and check data included in materials. These steps do not replace Live Story’s security obligations.

14. Your rights

Subject to the conditions in the GDPR, you have the following rights:

Access: to receive information about processing and a copy of your data.
Rectification: to correct inaccurate data and complete incomplete data.
Erasure: including where data is no longer needed or there is no basis for further processing; exceptions apply, for example for legal obligations and claims.
Restriction of processing: in legally specified cases, for example while data accuracy or an objection is being assessed.
Portability: to receive data you provided in a structured format and, where technically feasible, transmit it to another controller, if processing is automated and based on consent or a contract.
Objection: to processing based on legitimate interests on grounds relating to your particular situation. You may object to processing for direct marketing at any time.
Withdrawal of consent: at any time, without affecting the lawfulness of processing before withdrawal.
Complaint: to the President of the Polish Personal Data Protection Office. Information and contact channels are on the UODO website. You do not have to exhaust contact with us first.

Email contact@live-story.eu, describe your request and provide information helping locate the data, such as the account email or material concerned. Do not send your password. Where there are reasonable doubts, we may ask for additional, proportionate information confirming identity or authority. We do not automatically require a scan of an identity document.

We inform you of action on a request without undue delay, generally within one month of receipt. In cases provided for by the GDPR, this may be extended by two further months; we explain the reason within the first month. Exercising rights is generally free of charge. Restrictions or refusal require a basis and explanation.

For an anonymous account or data in another entity’s material, identifying the appropriate record and controller may require additional information. Having no email address does not remove rights, but we cannot disclose account data if the account’s connection to the requester cannot be safely confirmed.

15. Decisions, appeals and changes to this policy

A human decides whether to block a user, venue or organisation for breaches of the rules. You can appeal at contact@live-story.eu. We do not make decisions about users based solely on automated processing that produce legal effects or similarly significantly affect them within Article 22 GDPR. Checking permissions or the expiry of previously granted access alone does not constitute user profiling.

The current policy is available on this page with its update date. We will inform you of significant changes to purposes, recipients or processing rules in a manner appropriate to the change, for example through a service notice or email. Where a new operation requires consent or separate information, changing the policy text alone does not replace it.

You can always contact us if anything is unclear. The main provisions on these rights and obligations are in the GDPR on EUR-Lex.

Back to contents ↑