Privacy notice.
What Storio keeps, where it lives, who sees it, who we pass it to and how it is deleted. No “certain information”: the data, called by its name. It covers the Storio website (www.storio.ink), the app (app.storio.ink) and the stores (storio.ink).
Last updated: October 7, 2026Storio is still being built, so this will change: we'll add things, remove others and fine-tune how they work. We always tell you before a change applies, and we tell you what changed.
1. Who is responsible
Candhrly LLC, the US company that runs Storio, is the controller of the data in business accounts and of how Storio works. When you buy or book in a store, that store is the controller of your data as its client, and Storio processes it on the store's behalf and only to provide its service. For any question or to exercise your rights: [email protected].
2. If you run a store
We keep: · your email, and your encrypted password, which we never see, or your Google identifier if you sign in with Google; · your business name and your address on storio.ink, your line of business, country, city, description and, if you set it, your location on the map; · how people reach you: WhatsApp, Instagram, Telegram, phone or email; · your hours, breaks and closures, and what you sell with its price, duration, variants and photos; · your logo, cover, gallery and blocks; · the payment details you choose to show your clients, such as your account or key for transfers; · if you enter them, your ID or tax number and your business certificate, which is kept in a private space; · the name, photo and email of the people you add to your team; · your plan, your invoices and your Stripe customer identifier; · security records, such as open sessions.
3. If you verify your identity
It is optional. You photograph your ID and your face, and those images are processed by Didit, the provider that runs the check. A face is biometric data and therefore sensitive: it is only processed if you agree at that moment. We do not keep those photos. From the process we keep the result and its reason, the date, a reference to the case at Didit, the country and type of document, the country you connected from, whether you were using a VPN and how many attempts you made: we need this to grant or remove the badge and to prevent impersonation. You can ask us to remove the badge whenever you want.
4. If you buy or book in a store
We keep what you type so the store can serve you: · your name, phone, email and how you prefer to be contacted; · the service or products, the day and time, and your note; · for a home visit or a delivery, the address, its directions and the point you mark on the map; · the payment method you pick, the reference and the receipt screenshot if you upload one; · that you accepted the store's policy, with its wording at that moment; · your ratings, loyalty stamps, place in the waiting line and complaints with their photos. With this the store builds its client list: name, contact, visits and whether you agreed to receive its news. That box comes unticked; if you tick it, the store may write to you with news, and you can ask it or us to stop. If you also open a client account, we keep your email, encrypted password, name, phone, your photo if you upload one and, only if you enter them, your state, address and postal code.
5. WhatsApp, Instagram, Telegram and other channels
A store can connect WhatsApp, Instagram or Telegram to serve clients from Storio. If you write to it there, we receive and store your messages, the date, your public name, username and photo, and your number or identifier on that channel, to show them to the store in its inbox and to reply to you, whether by the person or their assistant. Photos and audio from chats are not copied to our database: we keep the reference the platform provides. We also send you the notices for your booking or order, such as the confirmation, the reminder, changes and the receipt, by email and, if the store turns it on, on that channel or by SMS. We only access the account the store deliberately connected and authorized, never any other one nor personal messages, and its credentials are stored encrypted. This data is used only for the inbox and for serving you: we do not sell it, we do not share it for advertising and we do not build profiles with it. If the store disconnects the channel, we stop receiving its messages at that moment; if it asks us to delete those conversations, we delete them within 30 days, and if it deletes its account, they go with it. On Instagram and WhatsApp all of this complies with the Meta Platform Terms and Meta's Developer Policies.
6. The AI assistant
If the store turns on its assistant, the messages in the conversation are sent to OpenAI to write the reply and, if you write in another language, to translate it. The model receives what the store already shows publicly, that conversation and, when needed, the bookings and orders of whoever is writing, never anyone else's. It can only act for whoever is writing: book, move or cancel their bookings, put their order together or add them to the waiting line. OpenAI processes this data as our provider and, under its business terms, does not use it to train its models. The AI makes no decisions about you with legal effects and does not validate payments or receipts. Every new use of AI with your data is named here before it starts.
7. Cookies and what your browser keeps
Storio has two addresses kept apart on purpose: the stores live on storio.ink and the Storio website on www.storio.ink. The browser does not let one read what the other keeps. In the stores, where you book or buy, we only use our own cookies, never advertising or measurement ones: · gl_consent: your answer to “Shall we remember you here?”. Lasts 180 days. · gl_buyer: your name, phone, email, channel, address, directions and map point, so we don't ask for them again. Only if you accept. Lasts 180 days. · gl_citas: the keys to your bookings on this device, to show you your bookings and your place in line. Only if you accept. Lasts 180 days. They work across every Storio store on that device, are never read or stored by our server, and are removed if you choose “Not now” or clear your browser's cookies. The browser also keeps your cart and your language, so they aren't lost when the page reloads. And if you sign in to your account, business or client, it keeps your session and your basic profile details, which are removed when you sign out. On the Storio website (www.storio.ink), and never in the stores, we use the Google Ads tag and the TikTok pixel to measure our own ads, and only if you accept them in the notice shown when you arrive. If you accept, they set Google and TikTok cookies and receive data about your visit, such as your IP address and the page you saw. We pass them no data from any store or about your purchases. Your answer is kept in your browser, and you can change it whenever you want with the button below or with “Cookies” at the foot of the page; if you say no, they don't load and we delete the cookies they had set on this website. The pages also load fonts from Google Fonts and maps from Google Maps, and Google receives your IP address when showing them.
Change my cookie choice8. The providers that help us
To make Storio work we use these providers, each only for its own part: · Supabase: the database and files. · Railway: the Storio server. · Cloudflare: the website, the app and the network that delivers them. · Brevo: emails. · Stripe: Storio's plans and the stores' card payments. · Didit: identity verification. · OpenAI: the assistant and its translations. · Meta (WhatsApp and Instagram), Telegram and Bird: messages and notices. · Google: sign-in with Google, maps, fonts and Storio's ads. · TikTok: Storio's ads. · Geoapify and Photon (Komoot, on OpenStreetMap): finding addresses. · Sentry: server errors, with no user data. · Giphy and Pixabay: the images and videos from their catalog that you pick; our server requests them, so they receive none of your data. Every new provider that handles your data is named here before we start using it.
9. Your data leaves your country
Candhrly LLC is in the United States, and these providers have servers in the United States and other countries. So your data leaves your country, whether Colombia, Argentina, Mexico, Venezuela or another, for Storio to work. We choose providers with security measures and data protection commitments, and by using Storio you accept this transfer.
10. What we use it for
To give you the service you asked for: your store, your bookings, your orders, your messages and your notices. For security: preventing fraud, impersonation and abuse. To comply with the law: taxes, accounting and requests from an authority. And with your consent: remembering you in a store, verifying your identity and letting a store send you news. We do not sell or rent your data, we do not build advertising profiles, and we do not use the data of stores or their clients for our ads.
11. Who sees what
A store sees its bookings, orders, messages and client list, with the details you gave it: it needs them to serve you. Its team sees what the store allows. No store sees another's data. What a store publishes, such as its name, photos, prices and hours, is public on purpose: it is its shop window. At Storio, only the people who maintain the service access data, and only when needed for support, security or by law. We hand data to an authority only if a law or a valid order requires it.
12. How long we keep it
While your account is active. If you delete it, your store disappears at that moment: the link stops working, sessions are closed, it leaves the search, your channels are disconnected and your photo, cover and description are deleted. The rest is deleted after 60 days; that period exists so that nobody who took a deposit can vanish as if they had never existed. Store cookies last 180 days. A client's data stays with the store where they booked or bought while that store exists, unless they ask to delete it. Whatever a law requires us to keep, such as a payment record, is kept for as long as that law requires and only for that.
13. How we protect it
Everything travels encrypted. Passwords are stored so that nobody, not even us, can read them, and the credentials of the channels you connect are stored encrypted. The database cannot be read from outside our server, and documents go to a private space. No system is invulnerable: if something happens that affects your data, we tell you as soon as possible, and the authority when the law requires it.
14. Your rights
You can ask us to see your data, correct it, delete it, take a copy, object to a use or withdraw a consent you gave. Write to us at [email protected] from your account's email, or with the phone or email you booked with. We answer requests within 10 business days and complaints within 15, and we tell you if we need more time. If you are a store's client, you can ask the store or us, and we help it comply. If you are not satisfied, you can turn to the authority in your country: in Colombia, the Superintendencia de Industria y Comercio (Law 1581 of 2012); in Argentina, the Agencia de Acceso a la Información Pública (Law 25.326); in Mexico, the authority that oversees the Federal Law on the Protection of Personal Data Held by Private Parties (ARCO rights); in the United States, your state's. If you live in a state with its own privacy law, such as California, you also have the rights that law gives you, and we do not treat you differently for using them.
15. Minors
Storio is not made for children under 13 and we do not knowingly ask them for data. You must be of legal age to open a store. If you think a minor gave us their data, write to us and we delete it.
16. How to delete your data
If you run a store, go to Settings and tap “Delete my account”: before you confirm we show you what gets cancelled and what gets refunded. If you are a store's client, or would rather ask, write to us and we do it within 30 days. The period for each thing is in “How long we keep it”.
Ask to delete my data17. If this changes
This notice will change too, especially while we keep adding things: every new provider that handles your data is named here before we start using it. We tell you by email and in the app before a change applies, saying what changed. For any questions:
[email protected]