Data Transfers to the United States
Some of our sub-processors are based in the United States. We ensure that all transfers of personal data to these sub-processors comply with GDPR and EU data protection standards through one of the following legal mechanisms:
EU-U.S. Data Privacy Framework (DPF) Several of our US-based sub-processors are certified under the EU-U.S. Data Privacy Framework. The European Commission has determined that this framework provides a level of data protection comparable to EU standards, meaning personal data can be transferred to DPF-certified providers without the need for further transfer safeguards. For these providers, Standard Contractual Clauses are also in place as a fallback.
Standard Contractual Clauses (SCCs) For US-based sub-processors not certified under the DPF, we use the EU Standard Contractual Clauses — legal contracts approved by the European Commission that bind the receiving party to protect personal data in accordance with EU standards.
Following the "Schrems II" ruling by the Court of Justice of the EU, concerns were raised about whether SCCs alone could ensure adequate protection against US government surveillance. Since then, the United States has implemented significant legal reforms through Executive Order 14086, which limits intelligence activities to what is necessary and proportionate and establishes a Data Protection Review Court where EU citizens can seek redress. The European Commission has noted that these safeguards apply to all transfers of personal data to the United States, including transfers made under SCCs.
Regardless of the mechanism used, all our sub-processors are contractually bound to maintain strict security measures and technical safeguards to protect personal data.
AI Sub-Processors — Safety and Compliance
To power advanced automation and creative features, Storykit uses industry-leading AI models provided by third-party sub-processors through their enterprise API services.
How we protect your data
No model training. Your data is never used to train or improve AI models. Our AI sub-processors do not use Storykit API data to train or improve their models, as confirmed in each provider's enterprise API terms and Data Processing Agreement. Storykit itself does not build, train or fine-tune AI models.
Short-term retention only. Data sent to AI sub-processors is used solely to generate the requested output. AI sub-processors retain it only for short-term security and abuse monitoring under each provider's enterprise API terms, after which it is deleted. When an uploaded asset is analyzed to create its description, the asset file is deleted from the AI sub-processor as soon as the description has been returned.
Encryption. Data sent to and from AI sub-processors is encrypted in transit (TLS 1.2 or higher), and data stored in the Storykit platform is encrypted at rest.
GDPR compliance. All AI sub-processors are bound by Data Processing Agreements (DPAs) and operate under valid transfer mechanisms (DPF or SCCs) as described above.
Only what the feature needs. Only the content needed for the specific feature is sent to an AI sub-processor. Personal data about users and customer account data are never sent. Content you provide may itself contain personal data; for that content your organization is the controller, and it is processed only to deliver the requested feature.
What we use AI for
These services may process user-provided content to:
Rewrite inserted text into video scripts, including accompanying content insights generated from the same source material.
Analyze user-provided text or video scripts to suggest search terms for stock asset providers.
Transcribe uploaded audio in sound or video files.
Analyze inserted text to suggest types of videos to create.
Create text summaries and descriptive metadata for video or image assets uploaded by the customer.
Render script text as synthetic voiceover audio, using the AI providers' standard voices only.
Translate user-provided text.
AI processing is limited to the features listed above. It is not used for decision-making about individuals, profiling or scoring. No autonomous decisions are made by AI on behalf of users.
AI-generated output is presented as a suggestion that you review, edit and approve before any video is published. Descriptions of uploaded assets are the one exception: they are created automatically, are used only to help search for and select suitable assets, and never appear in video output.
Opting out
AI-powered features are enabled by default so that you have immediate access to Storykit's full feature set. No additional agreement is required to use them.
If you prefer not to use AI sub-processors, you can opt out at any time. Please note that opting out will disable the specific Storykit features that rely on these services. To request an opt-out, please contact the account manager responsible for your company.