1 Introduction
Gobi Stories AS (“Gobi Stories”, “Gobi”, “we”, “us”) delivers services to create and distribute video in the story format. Our services comprise:
- Gobi Studio — for editing, managing and publishing content.
- Gobi Autopilot — for collecting video stories recorded by employees on behalf of our customers.
- Gobi Player — a video player for publishing content on websites, career pages and other integrated systems.
This Privacy Policy describes how Gobi collects your information whenever you use our services, what information we collect, how it is used and with whom it is shared. It applies to all users of our services anywhere in the world, including our websites, tools and other features that make up the Service.
Gobi acts as the data controller for personal data we collect directly — including from visitors to our websites, our prospects and leads, our customer contacts, and administrative data about users who access our platform.
For content and data processed through our services on behalf of others — including content uploaded to Gobi Studio and recordings submitted through Gobi Autopilot (on behalf of our customer), and End User connection data processed by Gobi Player (on behalf of the organization operating the website where the player is embedded) — Gobi acts as a data processor. The organization on whose behalf the data is processed is the data controller. That relationship is governed by our Data Processing Agreement (DPA).
Your information is stored and processed in accordance with the requirements set out in the General Data Protection Regulation (GDPR). We will only keep your information as long as necessary in accordance with the purposes described in this policy.
By using our services, you accept the terms and practices described in this Privacy Policy and our Terms of Service.
2 Collection and Use of Your Information and Data
When you use our services, there will be certain information and data (collectively “Data”) that you will send to us, or that we will collect from you. The following sections set out important details regarding the collection and use of your Data.
3 Data that we collect and why
3.1 Data we collect when you watch stories through Gobi Player
When stories are viewed through Gobi Player on a website that has embedded the player, we collect your Internet Protocol (IP) address, used by our sub-processor to deliver the video content to you. We also collect aggregated, non-personally-identifiable data about view time and engagement, so that the organization distributing the content can see how it performs. Viewing data is anonymous — we do not identify individual viewers.
Gobi acts as data processor for this processing, on behalf of the organization operating the website where the player is embedded. That organization is the data controller and determines the lawful basis for the processing.
3.2 Data we collect when you sign up
During registration of a user account in Gobi Studio, we collect your name, email address and password. This is used to give you a unique user ID, to let you access your account with your registered details, to reset a forgotten password, and to allow Gobi to contact you about your account. See the clause on “Communications between you and Gobi Stories AS” for more information.
The legal basis for this processing is the performance of the contract we enter into with you when you register an account (GDPR article 6 no. 1 letter b).
3.3 Data we collect when you use Gobi Studio
We receive and store all data you upload to Gobi Studio — such as videos, images, graphic elements, branding materials, interactive stickers, text, story names, company information, emails for members you invite, and billing details or similar. This is done to ensure our services are fully functional and to provide the services you request. Data is only kept for as long as required. For further information, please see the section on “Data Deletion”.
Where the data you upload includes personal data of third parties (for example employees appearing in the uploaded content), Gobi processes it on behalf of the customer as described in § 1.
We also collect information regarding use of the service, including session times, your behavior in and interaction with the service, timestamps for when certain events occur (such as when a story is created, content is posted, or an account is created), and information about the device on which you are using the service, such as device type, operating system, browser, language, time zone, unique device identifiers and crash data. We collect this information to provide the best possible user experience, to secure the service, and to improve it. The legal basis for this processing is legitimate interest (GDPR article 6 no. 1 letter f).
3.4 Data we collect through Gobi Autopilot
Gobi Autopilot is used by our customers to invite employees or other individuals to record and submit short video stories. When you record and submit a story through Gobi Autopilot, we collect:
- your name and email address
- the video you submit
- your acceptance of this Privacy Policy
- your consent to the inviting customer's use and publication of the recorded content
- technical metadata for error reporting purposes
Gobi acts as data processor for this processing, on behalf of the customer that invited you. That customer is the data controller and determines the lawful basis for the processing. You can withdraw your consent or request deletion at any time by contacting the inviting customer or by contacting us at contact@gobistories.com.
3.5 Data we collect when you browse our websites
When you visit our websites, we use Plausible — a privacy-friendly analytics tool that does not use cookies or collect personally identifiable information. It records aggregated statistics about our visitors (such as country, device type and pages visited) using hashed, non-identifying signals that expire within 24 hours.
If you submit a contact form, book a demo or otherwise send us information, we process the information you provide in order to respond to you, follow up on your request and manage our commercial relationship. The legal basis for this processing is legitimate interest or, where relevant, steps taken prior to entering into a contract (GDPR article 6 no. 1 letter b and f).
3.6 Cookies
Gobi Player does not use cookies or third-party tracking. Our public websites do not set tracking cookies, with one exception: dedicated ad-campaign landing pages (currently /test-autopilot and /en/test-autopilot) load the Meta Pixel to measure ad performance. The Pixel is loaded only after you give explicit consent via the on-page banner; if you decline, no Pixel script is loaded and no related cookies are set. See our cookie policy for details.
When you use Gobi Studio, we use strictly necessary cookies for authentication, session management and platform functionality. These cookies are essential to the operation of the service and do not require separate consent.
3.7 Third parties
In order to deliver our services, we share data with third-party service providers (“sub-processors”) for functions such as hosting, storage, transcoding, email delivery, CRM, crash reporting and customer support. A complete and up-to-date list of sub-processors is available at gobistories.com/sub-processors.
We may also share the information we collect about you with third parties as described at the time of collection or sharing.
4 General information regarding your Data
Data — Data uploaded to Gobi Studio will be available to all members of the related organization with the relevant permissions. They will be able to see, edit or share whatever data is uploaded. Your data is not publicly available to other users and people outside of your organization, unless you or someone in your organization shares a key that provides access to view a story.
By sharing data with other members and users, you acknowledge that it is possible for other members and users who have access to your stories to take screenshots or use other image-capturing technologies to reproduce and store content externally, and without your consent. In such a case, you are aware that your data may be exploited by the members and users that have access to your stories, subject to their sole direction and responsibility.
We reserve the right to immediately remove, with no prior warning, any data or user generated content that violates our Terms of Service.
Compliance — We can share your data in response to an information request from a competent authority if we believe disclosure is required by applicable law, regulation or legal process; with police officers, government agencies or other third parties if we believe your actions are not in accordance with any applicable customer agreement, Terms of Service, Privacy Policy, code of conduct, or to protect the rights, property or security of Gobi or others. We will notify users of any such disclosure if such notice is not prohibited by law.
Automated decision-making — Gobi does not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing, including profiling (GDPR article 22).
5 How we process your data
5.1 Data processor and data controller
We have strict data processing agreements with all our providers and sub-processors with regard to all processing of personal data on behalf of Gobi, in order to ensure that all processing is conducted in compliance with applicable data protection legislation.
Gobi is the data controller for data we collect directly, as described in § 1. For data we process on behalf of our customers, Gobi is the data processor and the customer is the controller.
Gobi may engage sub-processors in other parts of the world. Where personal data is transferred outside the EU/EEA, such transfers take place in compliance with Chapter V of the GDPR — on the basis of the EU–U.S. Data Privacy Framework where applicable, and otherwise on Standard Contractual Clauses (Commission Decision (EU) 2021/914) with appropriate supplementary measures. Our sub-processors list indicates the location and transfer mechanism for each provider.
5.2 Purpose for processing your Data
Gobi may not use your Data for any purposes other than those stated in this Privacy Policy. We will only store your Data for as long as necessary in order to fulfil the specific purpose for the processing.
5.3 Securing your Data
A description of the information security measures implemented for the protection of your personal data follows below:
Personnel and access control — Only authorized staff with signed confidentiality agreements can grant, modify or revoke access to an information system that uses or houses Personal Information about our customers and users. Authorized personnel will only have access to data needed to provide and improve our service.
Data protection — All Personal Data is encrypted in transit using TLS. All Personal Data is encrypted at rest by our cloud providers using managed cryptographic keys. Passwords are hashed.
Contractual control — We enter into data processing agreements with third parties that process data on our behalf. Where we process data as a processor on behalf of a customer, such processing is conducted solely in accordance with the customer's instructions.
Logical access control — Your data is logically separated from other data. Databases are protected from unauthorized access using authentication and role-based access controls.
Business continuity — We ensure that Personal Information is protected against accidental destruction or loss (availability control) by performing backups ourselves or through some of our sub-processors.
6 Communications between you and Gobi Stories AS
Email — We may send you emails regarding your account, service or tool updates, the Service, or changes to the Terms of Service and Privacy Policy.
6.1 Marketing, market research and surveys
We send relevant product and service communications to our existing customers and to individuals who have signed up to receive them. The legal basis is our legitimate interest for existing customer relationships (GDPR article 6 no. 1 letter f), or your consent where you have signed up to receive such communications (GDPR article 6 no. 1 letter a). You can change your marketing choices at any time by clicking the unsubscribe link in the footer of any marketing email or by contacting us.
7 Data Deletion
Images and videos will be removed from our active systems once deleted from our tools, but they may remain in cache or backups for up to 30 days after deletion, or for up to 7 days for content stored within Gobi Autopilot, in line with our provider's backup retention.
We do not control what users do with the data received, and you confirm that you are aware it is possible to take screenshots or use other image-capturing technologies to reproduce and store content externally, and without consent. The use is at your own risk as mentioned in the Terms of Service. Gobi recommends not sharing content that you do not want someone to store.
We are not responsible for the content uploaded to our services or the actions of our users. If you see content that violates any of our terms, you can contact us at contact@gobistories.com, and we will use reasonable efforts to remove that information from our records.
If you want to delete your account in Gobi Studio, please contact us at contact@gobistories.com. Note that your account data may still be present in database backups for up to 30 days, until those backups are deleted.
With regards to analytical data, such as crash reporting, we will only retain it on our third-party servers for as long as it is required to fulfil the purposes set out above.
8 Your rights and how to exercise them
If you discover that any information about you in our tools and services is incorrect or missing, please use the applicable functions in the tools and services to change this information. If this is not possible, or you are unable to do so, please contact us at contact@gobistories.com.
Subject to any laws requiring confidentiality, you have the right under GDPR to:
- request access to the personal data we hold about you
- request correction of inaccurate data
- request deletion of your data (“right to be forgotten”)
- request restriction of, or object to, our processing
- request portability of your data
- withdraw your consent at any time, where consent is the legal basis
- lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet)
To exercise any of these rights, please contact us at contact@gobistories.com. Where we process your data on behalf of another organization (as described in § 1), you may need to direct your request to that organization as the data controller — we will help you reach them if needed.
9 Age requirement
Our services are intended for use by businesses and their users aged 18 or older. We do not knowingly collect or store personal data from anyone under the age of 18. If you become aware of users under the age of 18, please contact us and we will use reasonable efforts to remove that information from our records.
10 Notices and Updates
Gobi reserves the right to change or modify the Privacy Policy and Terms of Service at any time. Your continued use of our tools and services will constitute your acceptance of any revised agreements. If we make significant changes to this Privacy Policy we will notify you. We recommend that you periodically check these agreements for changes.
If you choose to use our services, then any dispute regarding privacy matters will be subject to this Privacy Policy and our Terms of Service. Unless stated otherwise, our current Privacy Policy applies to all information we collect about you and your account.
If you have any concerns about privacy at Gobi, please contact us.
11 Choice of Law and Jurisdiction
The laws of Norway shall govern the Terms of Service and this Privacy Policy. Should you have a dispute with Gobi, organization number 915 752 381, you will first contact us by sending an email to contact@gobistories.com.
Any disputes arising under the Terms of Service and this Privacy Policy shall be sought settled amicably. Unless an amicable solution can be obtained, the dispute shall be subject to ordinary court proceedings. The legal venue for disputes shall be Oslo District Court.
12 Contact us
If you have any questions or concerns regarding Gobi's services or agreements, don't hesitate to contact us by email at contact@gobistories.com, through our webpage, or visit us. You can find more information on our website under “Contact us”.