Decision Story

Effective Date: 30 March 2026

Operated by Leadgend Web Design and Digital Marketing

United Arab Emirates

1. Introduction

Welcome to Decision Story (“we,” “us,” or “our”). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at decisionstory.com (the “Service”).

By accessing or using Decision Story, you agree to the terms of this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of the Service.

This policy is governed by the laws of the United Arab Emirates, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”). We also respect internationally recognised privacy principles.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account or use our Service, we may collect:

Full name and email address
Username and password (stored in encrypted form)
Any content or data you submit while using the Service
Communications you send us, such as support requests or feedback

2.2 Information Collected Automatically

When you use the Service, we automatically collect certain technical information, including:

IP address and approximate geographic location
Browser type, version, and operating system
Pages visited, features used, and time spent on the Service
Referring URLs and exit pages
Device identifiers and session data

2.3 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve your experience on the Service. Cookies are small text files stored on your device. We use the following types:

Essential cookies: Required for the Service to function correctly (e.g., authentication sessions).
Analytics cookies: Used to understand how users interact with the Service (e.g., Google Analytics).
Preference cookies: Used to remember your settings and preferences.

You may control or disable cookies through your browser settings. Please note that disabling essential cookies may affect the functionality of the Service.

For detailed information about the specific cookies we use, their duration, and how to manage them, please refer to our Cookie Policy, available on the Service.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the Service
To create and manage your account and authenticate your identity
To improve, personalise, and expand the features of the Service
To send you transactional emails (e.g., account confirmations, password resets)
To send you marketing or product update communications, where you have opted in — you may unsubscribe at any time via the unsubscribe link in any such email or by contacting us directly
To analyse usage trends and monitor the performance of the Service
To respond to your enquiries and provide customer support
To detect, prevent, and address technical issues or fraudulent activity
To comply with applicable laws and legal obligations

We will not use your personal data for purposes incompatible with those described above without first obtaining your consent or having a lawful basis to do so.

3.1 Aggregated and Anonymised Data

We may aggregate or anonymise personal data so that it no longer identifies you as an individual. Such data is used to analyse the performance of the Service, improve and expand its functionality, and conduct research. Aggregated or anonymised data will not be re-identified and is not subject to this Privacy Policy.

4. Third-Party Services

To deliver the Service, we rely on a number of trusted third-party providers. Each of these providers has their own privacy policy and data practices. We have listed them below for your transparency.

Provider	Purpose	Data Processed
Google Analytics	Usage analytics and performance monitoring	Anonymised usage data, IP address, cookies
OpenAI	AI-powered features and content generation	Input text submitted to AI features
Email Marketing Provider	Transactional and marketing email delivery	Name, email address, email engagement data

We do not sell your personal information to third parties. Third-party service providers are only permitted to use your data to perform services on our behalf, and are contractually obligated to keep it confidential.

5. Google User Data

This section specifically addresses how Decision Story handles data obtained through Google services, in accordance with Google’s API Services User Data Policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5.1 Data Accessed via Google Services

Decision Story integrates with the following Google services, each of which may involve access to Google user data:

Sign in with Google (OAuth 2.0): When you choose to authenticate using your Google account, we receive your Google account email address, full name, and profile picture URL. We do not access your Google contacts, Gmail, Drive, Calendar, or any other Google service beyond basic profile identity data.
Google Analytics: We use Google Analytics to collect anonymised usage data (pages visited, session duration, device type, approximate location). Google Analytics does not provide us with individually identifiable Google account information.
Google Tag Manager and Google Search Console: These tools are used for site performance monitoring and tag management. They do not provide us with access to individual Google user account data.

5.2 How We Use Google User Data

Google user data obtained through Sign in with Google is used exclusively for the following purposes:

Account creation and authentication: Your email address is used as a unique identifier to create and manage your Decision Story account.
Profile personalisation: Your name and profile picture are displayed within your Decision Story account to personalise your experience.
Service communications: Your email address may be used to send transactional messages (e.g., account confirmations, password resets, subscription notices).

We do not use Google user data to serve advertisements, to train AI models, or for any purpose not directly related to providing the Service to you.

5.3 Sharing of Google User Data

We do not sell, rent, or share Google user data with third parties, except in the following strictly limited circumstances:

Service infrastructure providers: Your email address may be processed by our email delivery provider solely to send you transactional messages. These providers act as data processors under our instruction and are contractually prohibited from using your data for any other purpose.
Legal obligations: We may disclose Google user data if required to do so by applicable law, a court order, or a lawful request from a competent authority.

We do not share Google user data with advertisers, analytics partners, or any other third party beyond those described above.

5.4 Storage and Protection of Google User Data

Google user data received via Sign in with Google is stored securely in our database using the following protections:

All data is encrypted in transit using TLS (HTTPS) and encrypted at rest.
Access to Google user data is restricted to authorised personnel who require it to operate and maintain the Service, and is governed by strict internal access controls.
We conduct periodic security reviews and technical audits to maintain the integrity of stored data.

5.5 Retention and Deletion of Google User Data

Google user data obtained via Sign in with Google is retained for as long as your Decision Story account remains active. We do not retain Google user data beyond what is necessary to provide the Service.

You may request deletion of your Google user data at any time by:

Deleting your Decision Story account through your account settings, or
Contacting us directly at [email protected] with a deletion request.

We will process deletion requests within 30 days. Upon deletion, all Google user data associated with your account will be permanently removed from our active systems. Residual copies in backups will be deleted within a further 30 days in accordance with our standard backup rotation schedule.

6. International Data Transfers

As a UAE-based service, your personal data is primarily processed and stored within the United Arab Emirates. However, because we use third-party service providers including Google Analytics and OpenAI (both US-based) and email marketing tools, your data may be transferred to and processed in countries outside the UAE.

Where such transfers occur, we take steps to ensure your data receives an adequate level of protection consistent with this Privacy Policy and applicable UAE law. These steps include:

Ensuring third-party providers maintain appropriate technical and organisational security measures
Only engaging providers who are bound by contractual data protection obligations
Reviewing the privacy practices of all third-party partners before engagement

By using the Service, you acknowledge that your data may be processed in countries with data protection laws that differ from those in the UAE. If you have questions about international transfers, please contact us using the details in Section 14.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by applicable law. Specifically:

Account data is retained for the duration of your active account, and for up to 2 years following account deletion, unless a longer period is required by law.
If your account remains inactive for 30 consecutive calendar days, we reserve the right to anonymise or delete your personal data, unless retention is required by law or to protect our legitimate interests.
Analytics data collected through Google Analytics is retained in accordance with Google’s default data retention settings.
Email marketing data is retained until you unsubscribe or request deletion.

When data is no longer required, we securely delete or anonymise it in a manner that prevents restoration or re-identification.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

Encrypted data transmission via HTTPS/TLS
Secure storage of passwords using industry-standard hashing
Access controls limiting who within our organisation can access your data
Pseudonymisation and anonymisation of sensitive data where applicable
Regular monitoring and technical audits of our security practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in risk to your rights and interests, we will notify affected users as required by applicable UAE law.

9. Your Rights

Under the UAE Personal Data Protection Law and internationally recognised privacy principles, you have the following rights with respect to your personal data:

Right of Access — You may request a copy of the personal data we hold about you.
Right to Correction — You may request that we correct any inaccurate or incomplete data.
Right to Deletion — You may request that we delete your personal data, subject to legal retention requirements.
Right to Restrict Processing — You may ask us to limit how we use your data in certain circumstances.
Right to Data Portability — You may request a structured, machine-readable copy of your data.
Right to Object — You may object to the processing of your data for direct marketing purposes at any time.
Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Right to Non-Discrimination — We will not deny you access to the Service or penalise you in any way for exercising your privacy rights.

To exercise any of these rights, please contact us at the details listed in Section 14. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

Please note that these rights may be limited in certain circumstances — for example, where fulfilling your request would reveal the personal data of another person, or where we are legally required to retain the data.

10. Artificial Intelligence Features

Decision Story uses AI-powered features provided by OpenAI. When you interact with AI features, the text and content you submit may be processed by OpenAI’s systems to generate responses or recommendations.

Please be aware that:

You should not submit sensitive personal information (e.g., financial details, health data, government IDs) through AI-powered features.
We may use the content and information you provide through AI features to improve the Service, including to refine the models that underpin its operation. You may opt out of this use at any time by contacting our support team.
OpenAI may retain submitted content in accordance with their own data policies. We recommend reviewing OpenAI’s Privacy Policy at openai.com/privacy.
We do not use AI outputs to make solely automated decisions about you that produce significant legal or similar effects without human oversight.

11. Push Notifications

We may send you browser or in-app push notifications to inform you about important events related to your account and use of the Service (e.g., account confirmations, activity alerts, or Service updates). These notifications are part of the provision of our Service.

With your separate consent, we may also send you marketing or informational push notifications (e.g., product updates, tips, or promotional messages). You may withdraw this consent at any time through your browser or device settings, or by contacting us directly.

To deliver push notifications, we process technical device data (e.g., browser ID, push token). This data is used solely for notification delivery and is not shared with third parties, except for partner services that provide the technical delivery infrastructure.

12. Children’s Privacy

Decision Story is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately and we will take steps to delete such information from our systems.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you by updating the “Effective Date” at the top of this document and, where appropriate, by sending an email notification or displaying a notice on the Service.

We recommend periodically reviewing this Policy to stay informed about how we protect your personal data. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Leadgend Web Design and Digital Marketing

Operating: Decision Story

Email: [email protected]

Location: United Arab Emirates

Website: decisionstory.com

We will review your request and respond within 30 days of verifying your identity. If necessary, this period may be extended, and we will notify you accordingly.

This Privacy Policy was last reviewed on 30 March 2026.