GStory

GDPR overview

The privacy policy is written on a GDPR frame without ever claiming compliance in so many words. It sets out legal bases (contract, consent, legitimate interest), grants the full set of data subject rights — access, correction, erasure, restriction, portability and objection — with a one-month response window, and covers non-EEA transfers under Articles 45 and 46 using European Commission standard contractual clauses. Article 77 is cited for complaints to the ICO or a local supervisory authority, and the minimum age is 16. Three gaps stand out: the only formal compliance statement commits to Hong Kong's Personal Data (Privacy) Ordinance rather than the GDPR, no DPO or Article 27 EU representative is named, and the policy still references the EU-US Privacy Shield, invalid since 2020. No effective date is shown.

Who owns the data?

The terms of service state plainly that users keep ownership of their User Content. What happens to the files is less consistent: the terms claim that anything you create is stored locally and is not uploaded to GStory's servers without permission, while the privacy policy describes uploads being stored on Amazon Web Services servers in the United States so a copy of a Stable Diffusion model can be retrained on them to personalise the output. Original files are said to be deleted immediately after a successful generation; purchased results stay on the servers until the user removes them. Deletion can also be requested by contacting the vendor. The two documents contradict each other on the upload question.

Reuse rights

Users retain ownership of what they upload and generate, and nothing in the terms restricts commercial reuse of their own output or requires permission from GStory to publish it. The terms do note that content generated autonomously by AI carries no human authorship, which affects what can be claimed as protected work. On GStory's side, the privacy policy describes a narrower set of personal data — approximate location and advertising identifiers where personalised ads are accepted, chat handles and messages, basic Facebook profile data on social login, and the email address of anyone contacting support. That data feeds advertising management, preference storage and support handling, and it is shared with named advertising and analytics providers including Admob, AppLovin, Facebook, Firebase, Google Analytics, Unity Ads and Tenjin. The policy states that personal information is never sold or rented without notice and, where required, consent. The watermark removal tools deserve a caveat of their own: the terms forbid uploading content that infringes anyone else's rights, and a DMCA process is published.

Data retention & training

Hosting summary

The privacy policy names Amazon Web Services in the United States as the host for uploaded photos and videos, and a provider called Webair as storing all of the company's data, with access for support and maintenance. Staff and suppliers outside the European Economic Area, including in the United States, may use and access personal data. Transfers are said to rely on European Commission approved standard contractual clauses under Articles 45 and 46 of the GDPR, though the policy also cites the EU-US Privacy Shield, which has been invalid since 2020. No regional hosting choice is offered and no data residency commitment is made. The compliance statement at the end of the policy commits instead to Hong Kong's Personal Data (Privacy) Ordinance, and the intellectual property policy points to Hong Kong jurisdiction. The site itself resolves to a Google anycast address, which reflects content delivery rather than where data is stored.