1. Information We Collect

1.1 Personal Data

• Account Information: Email address, username, hashed password
• Payment Details: Stripe transaction records (no card data stored)
• Communication Data: Support tickets, feedback submissions

1.2 Technical Data

• Device Information: Browser type, OS version, screen resolution
• Usage Analytics: Feature interactions, session duration
• Network Data: IP addresses, request timestamps

1.3 User Content

• Story drafts and character profiles
• Writing preferences and style patterns
• AI training feedback data (opt-in only)

2. How We Use Your Data

2.1 Primary Purposes

• Service delivery and account management
• AI model personalization and improvement
• Payment processing and fraud prevention

2.2 Legal Basis (GDPR)

• Contractual necessity for core services
• Legitimate interests for service optimization
• Explicit consent for optional features

3. Your Data Rights

3.1 Access & Control

• Right to access and data portability
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)

3.2 Restrictions & Objections

• Right to restrict processing
• Right to object to automated decisions
• Right to withdraw consent

4. Security Measures

4.1 Technical Safeguards

• AES-256 encryption for data at rest
• TLS 1.3 for data in transit
• Regular penetration testing

4.2 Organizational Measures

• Employee privacy training programs
• Data access audit trails
• Incident response protocol (ISO 27001 aligned)

5. Additional Provisions

5.1 Data Retention

• Account data: 3 years post-deletion
• Payment records: 7 years for tax compliance
• Backup rotation: 90-day cycle

5.2 International Transfers

• EU-US Data Privacy Framework certified
• Standard Contractual Clauses (SCCs)

5.3 Policy Updates

Significant changes will be notified via:

• In-app notification system
• Email to registered users
• Website banner announcement