Privacy Policy

Story Maker Technologies Private Limited ("Company," "we," "us," or "our") operates The Story Maker platform (the "Service"). This Privacy Policy describes how we collect, use, store, and protect your information when you access or use our Service. We process your information on the legal bases described in Section 4.4 below — primarily to perform our contract with you, not blanket consent — and we ask for your separate, revocable consent only for optional processing such as analytics cookies and marketing emails.

Quick Privacy Summary

We value your privacy and creative ownership. Here is a brief summary of how we handle your data:

No Training: Your creative screenplays, story beats, and files are never used to train AI models.
Data Security: We use industry-standard encryption to protect your account data and project files.
Third Parties: Your content is sent to AI models (via OpenRouter) only for real-time generation and is not stored or shared for advertising.
Your Control: You own all AI outputs and can delete your account and files at any time.

1.0 Definitions

1.1 User Materials

"User Materials" means any content you create, upload, or input into the Service, including but not limited to screenplays, story beats, character profiles, dialogue, plot outlines, scene descriptions, production notes, and any other creative works.

1.2 AI-Generated Outputs

"AI-Generated Outputs" means any content produced by our AI engines (the "Cinema Context Engine") in response to your prompts, inputs, and User Materials.

1.3 Personal Data

"Personal Data" means information that identifies, relates to, or could reasonably be linked to you as an individual, as defined under the EU General Data Protection Regulation ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), California Consumer Privacy Act as amended by CPRA ("CCPA"), and India's Digital Personal Data Protection Act, 2023 ("DPDPA").

2.0 Information We Collect

2.1 Account Information

When you register, we collect:

Full name and email address
Authentication credentials (hashed; we never store plaintext passwords)
OAuth profile data (name, avatar URL) if you sign in via Google
Referral or promotional code, if provided at signup

2.2 Usage & Telemetry Data

We automatically collect:

Browser type, operating system, device identifiers, and screen resolution
IP address, approximate geolocation (country/region level only)
Session duration, page views, feature usage frequency
Credit consumption logs, AI quality tier selections, and feature usage across our 35 AI tools
Error reports and performance metrics (via Sentry)

2.3 Creative Metadata & Cinema Context Engine

To power our AI features, we collect and process scene metadata (scene headings, locations, time-of-day tags), character relationship tags, genre classifications, budget estimates, scheduling data, and prompt history. This metadata enables the Cinema Context Engine to provide contextually relevant suggestions across your project.

2.3.1 Scope of Metadata Processing

Metadata is derived exclusively from your User Materials and is processed solely within the scope of your individual project workspace. We do not aggregate metadata across different users' projects.

3.0 AI Data Usage & Model Training

3.1 No Foundation Model Training

Your User Materials are NOT used to train, fine-tune, or improve any foundation AI model. We process your inputs only to generate outputs for you in real time. Prompts and outputs are transmitted to third-party AI providers via OpenRouter under data processing agreements that prohibit the use of your data for model training.

3.2 Opt-In Only for Research

We will never use your User Materials or AI-Generated Outputs for research, benchmarking, or product improvement purposes without your explicit, informed, and revocable opt-in consent. Any such program will be presented separately and will not be a condition of Service access.

3.3 Prompt & Output Retention

AI prompts and outputs are cached for up to 72 hours to enable regeneration and error recovery. After this window, they are permanently deleted from our processing infrastructure. Project-level content you explicitly save is retained according to Section 7.0.

4.0 How We Use Your Information

4.1 Service Delivery

Authenticate your identity and maintain account security
Process AI generation requests and deliver outputs
Manage credit balances and process one-time credit purchases
Provide customer support and respond to inquiries

4.2 Service Improvement (Aggregated Only)

Analyze aggregated, anonymized usage patterns to improve feature design
Monitor system performance, uptime, and error rates
Detect and prevent fraud, abuse, and security incidents

4.3 Communications

Send transactional emails (verification, payment receipts, credit alerts)
Send product announcements and feature updates (opt-out available)
Respond to support tickets and contact form submissions

4.4 Legal Basis for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies to you, we rely on the following legal bases for processing — not a single blanket consent — depending on the purpose:

Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, delivering the AI generations you request (Section 4.1), processing credit purchases and billing, and responding to account or billing support requests.
Legitimate interests (Art. 6(1)(f)): the aggregated, anonymized service-improvement analysis, uptime/error monitoring, and fraud/abuse detection described in Section 4.2, and sending the essential transactional emails in Section 4.3 — balanced against your rights, and you may object at any time (Section 6.2).
Consent (Art. 6(1)(a)): optional processing only — analytics cookies (see the Cookie Policy) and marketing/product-update emails (Section 4.3). Declining or withdrawing this consent never affects your access to the core Service.
Legal obligation (Art. 6(1)(c)): retaining payment records for tax and financial compliance (Section 7.0).

5.1 Sub-Processors

We share data only with the following categories of processors, under binding DPAs:

Processor Category	Provider(s)	Data Shared
AI Inference	OpenRouter (routing to OpenAI, Anthropic, Google, Meta, Mistral)	Prompts, User Materials (for output generation only)
Infrastructure	Vercel, Supabase	All Service data (hosting, database)
Payments	Razorpay	Name, email, payment instrument details
Email	Google Workspace (Gmail API)	Email address, message content
Error Monitoring	Sentry	Error traces, device info, IP
Analytics	Google Analytics (GA4)	Aggregate traffic and feature-usage analytics — only loaded after you accept analytics cookies (see Cookie Policy)

5.2 No Sale of Personal Data

We do notsell, rent, or trade your Personal Data to any third party for advertising, marketing, or any other commercial purpose. This commitment applies under all applicable privacy laws, including CCPA's definition of "sale."

6.0 Data Subject Rights

6.1 Universal Rights

Regardless of your jurisdiction, you may:

Access a copy of the Personal Data we hold about you
Rectify inaccurate or incomplete data
Delete your account and associated data ("Right to Erasure")
Export your User Materials in standard formats (PDF, DOCX, Fountain, Final Draft FDX, TXT)
Withdraw consent for optional data processing at any time

Right to restriction of processing
Right to data portability in machine-readable format
Right to object to processing based on legitimate interests
Right not to be subject to automated decision-making with legal effects
Right to lodge a complaint with your supervisory authority

6.3 Additional CCPA/CPRA Rights (California Residents)

Right to know what Personal Data is collected, used, and disclosed
Right to opt-out of the "sale" or "sharing" of Personal Data (N/A — we do not sell)
Right to limit use of sensitive Personal Data
Right to non-discrimination for exercising privacy rights

6.4 Rights Regarding AI-Generated Outputs

You may request deletion of all AI-Generated Outputs associated with your account. Upon deletion, cached prompts and outputs will be purged within 72 hours, and project-saved content will be deleted immediately. Note that outputs already exported or downloaded to your local device are outside our control.

6.5 How to Exercise Your Rights

Submit requests to contact@thestorymaker.appor use the "Delete Account" feature in your account settings. We will respond within 30 days (GDPR) or 45 days (CCPA), with extensions as permitted by law.

7.0 Data Retention

Data Type	Retention Period
Account information	Deleted/anonymized immediately when you request deletion (Settings → Delete Account) — no recovery grace period, so export anything you want to keep first
User Materials (projects)	Retained while your account is active; removed when your account is deleted. Accounts inactive for 730 days (2 years) are deleted automatically, regardless of plan. We send escalating notices 90, 30, 7 and 1 day before deletion, and a confirmation once it has happened. Any sign-in resets the clock
AI prompts & outputs (cache)	72 hours
Payment records	7 years (legal/tax compliance)
Usage analytics	26 months (anonymized after 12 months)
Error logs / Sentry	90 days

8.0 Security Measures

We implement industry-standard security controls including:

TLS 1.3 encryption in transit for all API and web traffic
AES-256 encryption at rest for database storage (via Supabase)
Bcrypt password hashing with per-user salts
Row Level Security (RLS) policies ensuring strict data isolation
CSRF protection, rate limiting, and Content Security Policy headers
Regular dependency audits and security patch management

9.0 International Data Transfers

Your data may be processed in the United States, European Union, or India. Where transfers occur outside your jurisdiction, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent safeguards recognized under applicable law.

10.0 Children's Privacy

The Service is not directed to individuals under the age of 16 (or the applicable age of consent in your jurisdiction). We do not knowingly collect Personal Data from children. If we learn that we have collected data from a child, we will delete it promptly.

11.0 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification and email at least 30 days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12.0 Contact Information

For privacy-related inquiries, data subject requests, or complaints:

Email: contact@thestorymaker.app
Postal Address: Story Maker Technologies Private Limited, India