No client content is ever sold or repurposed without consent. A full export is available anytime. What you record stays yours.
Transcription and search run on your content for your benefit only. Nothing you record is fed into third-party model training.
We maintain a clear incident-response commitment: if there’s an issue affecting your data, you hear it from us.
Our security program covers governance, vendor review, and ongoing monitoring. A SOC 2 program is active; certifications will be listed here when they are finalized.
Yes. Submissions are private by default. We don't use, publish, or share a recording beyond what's needed to provide the platform to you unless you choose to share it.
No. Transcription and search run on your content for your benefit only. Nothing you record is fed into third-party model training.
We recognize that we often serve institutions who intend to preserve information created through TheirStory in-perpetuity. As such, we endeavor to ensure we never lose customer data, your data is never locked into our platform, and should you choose to cancel your subscription, you have your data in hand before we delete any data from our servers. Ultimately, it is your responsibility to download your data, and, contractually, after canceling your subscription, we retain your data for 30 days before deletion to ensure you have time to download your data if you have not already done so during the time of your subscription. We endeavor to ensure all of your data -- video, audio, metadata, transcripts, indexes, annotations, documents, images -- can be downloaded in standard, interoperable, archival formats at all times both via our UI and API. We also recognize from time to time a customer may have have limited capaicty, and in the past, we have helped customers export their data as necessary upon canceling their subscription to ensure no data is lost.
Email privacy@theirstory.io. We verify your identity first, then respond within the time applicable law requires. You may also designate an authorized agent to make a request for you where the law permits it. Deletion or anonymization happens within 60 days, except where we're legally required to retain something.
You can request access, correction, restriction, or erasure of your personal data, receive a copy in a portable format, object to processing based on our legitimate interests or to direct marketing, and lodge a complaint with your local data protection authority. Where the GDPR applies, we process data on the basis of contract, legitimate interests, legal obligation, or your consent.
TheirStory is based in the United States, and the information we collect is generally stored and processed there. If you use the platform from outside the US, your information is transferred to and processed in the US. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.
If we confirm an incident involving unauthorized access to or disclosure of your personal data, we notify affected individuals and the relevant organization without undue delay, and no later than 72 hours after we become aware of it, to the extent applicable law requires.
We don't knowingly collect personal information from children under 13 without verifiable parental consent. For users aged 13 to 17, the subscribing organization is responsible for obtaining and retaining verifiable parental or guardian consent before those users record, and for providing copies to us on request.
The consent form provided below is a template for reference only and does not constitute legal advice. Please consult your own legal counsel to confirm the language is appropriate for your use case before adopting it.
TheirStory example consent form
We’re happy to walk your team, and your IT reviewers, through exactly how it works.
Contact us