GDPR & Data Protection

Last updated September 25, 2026

MakeStoryboard is operated by IMARA DIGITAL HOLDINGS LLC, a Florida limited liability company. This page provides a plain-language overview of how we approach the European Union General Data Protection Regulation ("GDPR") and related data-protection obligations when they apply to our processing.

This overview does not replace our Privacy Policy, Data Processing Agreement, or other contractual terms. Those documents provide the more detailed rules that apply to particular processing activities.

What is the GDPR?

The GDPR is the European Union's data-protection law governing the processing of personal data. It establishes requirements for organizations that process personal data and gives individuals rights over information relating to them.

Personal data can include information such as a name, email address, account identifier, IP address, online identifiers, photos, or other information that identifies or can reasonably be linked to an individual.

Our roles under data-protection law

Depending on the processing activity, MakeStoryboard may act as a controller or as a processor.

Controller processing: MakeStoryboard generally acts as a controller for activities such as account administration, billing administration, fraud prevention, service security, legal compliance, support, and business communications where we determine the purposes and means of processing.
Processor processing: For Customer Content and other personal data that a team or business customer submits for MakeStoryboard to process on that customer's behalf, MakeStoryboard generally acts as a processor or subprocessor. That processing is governed by our Data Processing Agreement where applicable.

How we support GDPR requirements

Our privacy program is designed around the following practices:

Transparency and purpose limitation. We explain the categories of personal data we process, why we process them, the legal bases we rely on where required, and the categories of recipients in our Privacy Policy.
Data minimization and retention. We aim to collect and retain personal data only as needed for legitimate service, security, contractual, and legal purposes, and we maintain retention and deletion processes for different categories of data.
Security. We use technical and organizational safeguards designed to protect personal data against accidental or unlawful loss, alteration, disclosure, or access.
Service providers and subprocessors. We use third-party providers to operate and support the Service and apply contractual and privacy safeguards appropriate to the processing. Business customers can request our current Subprocessor List.
International transfers. When personal data subject to European transfer restrictions is transferred to a country without an applicable adequacy decision, we use an approved transfer mechanism where required, such as the European Commission's Standard Contractual Clauses, together with appropriate supplementary measures.
Privacy by design and review. We review privacy implications when changing important service features, vendors, or data flows and work to limit unnecessary collection and access.

Legal bases for processing

Where the GDPR requires a legal basis, the basis depends on the activity. We may process personal data because it is necessary to perform a contract with you, because we have a legitimate interest that is not overridden by your rights, because you have given consent, or because processing is necessary to comply with a legal obligation. Our Privacy Policy provides more detail about the purposes and legal bases that apply.

Your GDPR rights

Subject to the conditions and exceptions in applicable law, individuals may have the following rights in relation to their personal data:

Right to be informed about how personal data is processed.
Right to request access to personal data and information about its processing.
Right to request correction of inaccurate or incomplete personal data.
Right to request deletion of personal data in circumstances where the right to erasure applies.
Right to request restriction of processing in certain circumstances.
Right to receive eligible personal data in a structured, commonly used, machine-readable format and, where applicable, transmit it to another controller.
Right to object to certain processing, including direct marketing.
Right to withdraw consent at any time where processing is based on consent, without affecting processing that was lawful before withdrawal.
Right to lodge a complaint with the competent data-protection authority.

Exercising your rights

To submit a privacy request, contact us at donovan@makestoryboard.com. Please describe the request and identify the account or email address involved. We may request information reasonably necessary to verify your identity or authority before completing a request.

We respond to valid requests within the time required by applicable law. Some rights are subject to legal limitations, and we may retain certain information where retention is required or permitted by law.

Business customers and Customer Content

When a customer uses MakeStoryboard to process personal data contained in storyboards, images, comments, project data, or other Customer Content on behalf of that customer's organization, the customer is responsible for determining whether it has a lawful basis and appropriate authority to submit that data to the Service.

Our Data Processing Agreement includes processor obligations, confidentiality and security commitments, subprocessor terms, assistance with data-subject requests, deletion provisions, and international-transfer mechanisms for covered processing.

Contact

IMARA DIGITAL HOLDINGS LLC
2850 University Square Dr
Tampa, FL 33612
United States
donovan@makestoryboard.com

If you are in the EEA and believe your data-protection rights have been infringed, you may also lodge a complaint with the supervisory authority responsible for your location or the relevant processing.