Privacy policy for the MonstoryX website

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Personal data means any information relating to an identified or identifiable natural person.

We process personal data only on the basis of the law, in particular:

• Article 6(1)(a) GDPR (consent) and
• Article 6(1)(f) GDPR (legitimate interest).

This website is hosted by Vercel Inc., USA. To deliver a page, Vercel's servers receive your browser's request, including your IP address and the date and time of the visit. Vercel keeps logs of these requests for us for up to 30 days, to run the website and keep it secure. This is technically necessary and our legitimate interest under Article 6(1)(f) GDPR.

Vercel acts in two roles. It hosts the website for us as our processor. It also uses request metadata, such as your IP address and the approximate location derived from it, as a controller of its own, as its privacy notice describes: vercel.com/legal/privacy-policy

Vercel is certified under the EU‑U.S. Data Privacy Framework. Transfers to the USA rely on that certification and, for the hosting, also on the standard contractual clauses of the European Commission in Vercel's data processing agreement.

If you request a pilot on our pilot page, the form sends us what you enter: your school's name and, if you give it, its address, your name, your email address and, if you give it, your phone number. We use your details only to reply to your request.

Giving us your details is voluntary. Without your school's name, your name and your email address we cannot answer a pilot request.

The website does not store them. On their way, they pass through the website's server function at Vercel, which runs in Vercel's region in Washington, D.C., USA, and keeps nothing. It sends them as an email through our own mailbox at World4You Internet Services GmbH, Linz, Austria, to our studio inbox, with your email address as the address we reply to.

Our studio inbox is provided by Google Cloud EMEA Limited, Dublin, Ireland (Google Workspace). Google processes these emails for us as our processor under its Cloud Data Processing Addendum. Where data reaches Google LLC in the USA, the transfer relies on Google LLC's certification under the EU‑U.S. Data Privacy Framework or on the standard contractual clauses that addendum provides.

If the form cannot send your request, it opens your own mail program with the message ready, and you send it yourself.

The links “Talk to us” and “Request documents” on this website open your own mail program with a message to our studio inbox at Google, described above. The address on this page and on the imprint, info@monstory.eu, is our own mailbox at World4You, and emails to it are kept there. Whichever you write to, we receive your email address and what you write and use them to answer you.

We process the details of a pilot request or an email on the basis of your consent, Article 6(1)(a) GDPR. You can withdraw your consent at any time; an informal email is enough. The withdrawal does not affect the lawfulness of the processing before it.

We delete your details as soon as they are no longer needed for your request, when you withdraw your consent or when you ask us to delete them. Statutory retention obligations remain unaffected.

Some activities on this website let you answer aloud. The microphone is used only after you press its button and your browser asks for your permission, and it stops listening after a few seconds.

Turning your voice into text is done by your browser's own speech service, not by MonstoryX. Depending on your browser, that service may send the recording to its provider, for example Google in Chrome or Apple in Safari, which processes it under its own terms and privacy policy. The text comes back to the page and is compared with the answer in your browser.

MonstoryX receives nothing: no recording, no text and no result is sent to us or stored. If you prefer not to speak, every activity can be answered by tapping.

This website sets no cookies and stores nothing in your browser's storage. It uses no analytics, no tracking and no advertising.

Every page loads only from this website. The fonts are delivered by this website itself, not by Google, and no page embeds videos, maps or content from another provider.

As a data subject, you have the right to:

• obtain information as to whether and which personal data we process about you,
• request the rectification, completion or deletion of your personal data,
• request the restriction of the processing of your personal data,
• object to the processing of your personal data under certain circumstances or withdraw consent you have given,
• request data portability,
• obtain information about the recipients or categories of recipients to whom your personal data has been disclosed.

If you have any questions about this policy or believe that data protection law has been violated, please write to us at info@monstory.eu with the subject line “Data protection”. We will try to clear the matter up quickly and amicably.

You also have the right to lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority: www.dsb.gv.at

We may change this policy to meet current legal requirements or to reflect changes to the website. The version published at the time of your visit applies.