Privacy Policy

1. Information We Collect

Account Information:

• Email address and display name
• Authentication provider (email one-time code, Google sign-in)
• Subscription tier and billing status

Content You Create:

• Writing projects (novels, stories, drafts)
• Character sheets, outlines, and notes
• Custom writing styles and plugins
• Chat messages with AI characters
• AI-generated character portrait images

Usage Data:

• AI feature usage (which features you use, token consumption, model selection)
• Session data and interaction patterns
• Error logs and performance metrics

Payment Information:

• Payment processing is handled entirely by Stripe. We do not store credit card numbers, CVVs, or full card details on our servers.
• We retain your Stripe customer ID and subscription status for account management.

2. How We Use Your Information

• Service Delivery: To provide writing tools, AI generation, and account management.
• AI Processing: Your prompts and surrounding context are sent to AI providers to generate content. We send only the minimum context necessary for quality generation.
• Image Generation: Text prompts describing character appearance are sent to our image generation provider for portrait creation. No personal information is included in these prompts.
• Billing: To process payments, manage subscriptions, and track token usage.
• Security: To detect and prevent fraud, abuse, and unauthorized access.
• Communication: To send account-related and transactional emails (welcome, subscription confirmation, security alerts). We do not currently send marketing or promotional emails.
• Improvement: To analyze aggregated, anonymized usage patterns to improve the Service.

3. Legal Basis for Processing

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions that require a legal basis for processing personal data, we rely on the following grounds under GDPR Article 6:

• Contractual Necessity (Article 6(1)(b)): Processing your account data, content, and payment information is necessary to provide the Service as described in our Terms of Service.
• Consent (Article 6(1)(a)): Where we rely on your consent (for example, if we introduce optional marketing communications in the future), we obtain it beforehand, and you may withdraw it at any time.
• Legitimate Interest (Article 6(1)(f)): We process certain data for security monitoring, fraud prevention, service improvement (via aggregated analytics), and enforcing our terms. We have assessed these interests against the impact on your rights and freedoms.
• Legal Obligation (Article 6(1)(c)): We retain payment records and certain account data as required by tax, accounting, and other legal requirements.

4. Data Storage & Security

• Your data is stored on secure, industry-standard cloud infrastructure.
• All data is encrypted in transit (TLS/HTTPS) and at rest using strong, industry-standard encryption.
• Access to production data is restricted to authorized personnel only.
• Database security rules enforce that users can only read and modify their own data.
• We perform regular security reviews and maintain audit logs for administrative actions.

5. Third-Party Services & Subprocessors

We rely on the following categories of third-party service providers (subprocessors) to operate Genesis Writer. Each provider receives only the minimum data necessary for its function:

These categories are current as of the “Last Updated” date above. We may add, replace, or remove providers within these categories as our infrastructure evolves; material changes will be reflected here and communicated per Section 15. Some AI text features are accessed through a routing gateway whose upstream model providers may operate outside the United States. A list of the specific providers we use is available to customers and regulators on request. For that list, Standard Contractual Clauses (SCCs), Data Processing Addenda, or any other questions, contact support@genesiswriter.ai.

No-Training Commitment: We do not use your creative writing content to train or fine-tune AI models. Under the paid API agreements through which we access them, our AI providers likewise do not train their models on your content. Providers may temporarily retain prompts (typically up to 30 days) for abuse detection in accordance with their terms of service. We will update this commitment if a provider’s applicable terms change.

6. AI-Generated Content & Image Generation

• Prompts sent to AI providers may include relevant surrounding writing context, character information, and style preferences to improve generation quality.
• We do not send your email address, account details, or payment information to AI providers.
• For character portrait generation, only text prompts describing the character’s appearance are sent to our image generation provider. Generated images are stored securely in your account.
• We do not use your content to train or fine-tune AI models.
• Because you are writing creative fiction, your content is free text that may incidentally contain special categories of data (such as references to health, religion, ethnicity, or sexual orientation, whether fictional or about yourself). We do not solicit this information or use it to infer anything about you; it is processed only to deliver the Service and is sent to our AI subprocessors solely to generate the content you request.

7. Cookies & Tracking

For full details, see our Cookie Policy. In summary:

• Essential Cookies: We use cookies for authentication sessions and security. These are required for the Service to function.
• We do not use third-party advertising trackers or sell your data to advertisers.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate personal information.
• Deletion: Request deletion of your account and associated data. We will process deletion requests within 30 days, subject to legal retention requirements.
• Export / Data Portability: Download a complete archive of your account from your Account Settings page. The archive is a ZIP containing your writing as HTML and TXT files, your AI assistant conversations as Markdown transcripts, and your profile, preferences, characters, worldbuilding, comments, beta-reader feedback, saved library, generation feedback, usage history, and other account data (such as marketplace items you have published and saved media) as JSON.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing of your data based on legitimate interests.
• Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: EU/EEA users have the right to lodge a complaint with their local Data Protection Authority.

To exercise any of these rights, contact us at support@genesiswriter.ai. We will respond within one month of a verified request (extendable by up to two further months for complex or numerous requests, with notice), or within 45 days for requests under the CCPA/CPRA (extendable once by a further 45 days with notice).

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, security, completing transactions).
• Right to Opt-Out of Sale/Sharing: Genesis Writer does not sell or share your personal information with third parties for cross-context behavioral advertising. Because we do not engage in these practices, there is no need to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes other than providing the Service.

How to Exercise Your Rights: Contact us at support@genesiswriter.ai with the subject line “CCPA Request.” You may also designate an authorized agent to make a request on your behalf. We will verify your identity before processing your request. We will respond within 45 days, with one 45-day extension if needed with notification.

10. US State Privacy Rights

Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Oregon, Texas, Montana, Delaware, New Hampshire, New Jersey, Tennessee, Iowa, Indiana, Kentucky, Rhode Island, Minnesota, Maryland, Nebraska, and others) may have similar rights to those described in sections 8 and 9 above. To exercise any state-specific privacy rights, contact us at support@genesiswriter.ai. Genesis Writer does not sell or share personal information for cross-context behavioral advertising, so there is no sale or sharing for a Global Privacy Control (GPC) signal to opt out of. If we adopt practices that would qualify as a sale or share, we will treat a GPC signal as a valid opt-out where required by applicable law.

11. Children's Privacy

Genesis Writer is not intended for individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we discover that a person under 18 has created an account, we will promptly delete the account and all associated data. If you believe someone under 18 is using Genesis Writer, please contact us at support@genesiswriter.ai.

12. International Data Transfers

Your data is processed and stored in the United States. If you are accessing the Service from outside the United States, your data will be transferred to, stored, and processed in the US and potentially other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, together with supplementary measures where appropriate, to ensure an adequate level of protection for your personal data. Our infrastructure and payment providers maintain their own SCCs and adequacy mechanisms for international transfers.

13. Automated Decision-Making

Genesis Writer uses AI features to assist you with creative writing. These features are tools that you control and do not make automated decisions that produce legal or similarly significant effects on you. Our content moderation systems may use automated processes to detect prohibited content in material you publish or share (see our Acceptable Use Policy). If an automated system flags such content or your account, you may request human review, express your point of view, and contest the decision by contacting support@genesiswriter.ai.

14. Data Retention

• Active account data is retained for as long as your account exists.
• Usage history is retained for approximately 30 days. Administrative audit logs are retained for as long as necessary for security, fraud prevention, and dispute resolution.
• After account deletion, your content is permanently removed within 30 days. A minimal subset of records may be retained where required or permitted by law — for example, tax and payment records, and limited security or fraud-prevention logs; any account email kept in a deletion record is anonymized within 90 days.
• Payment records may be retained for up to 7 years for tax and accounting compliance. These records are held by our payment processor (Stripe), which is the system of record for transaction data; the billing identifiers we store are deleted with your account.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification at least 14 days before taking effect. The “Last Updated” date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically.

16. Contact Information

The Service is operated from the State of Illinois, United States, currently as a sole proprietorship, which is the controller responsible for your personal data. Our registered legal entity name and a postal address will be published here upon incorporation, before public launch. For privacy-related questions, data requests, or concerns about our data practices, contact us at: support@genesiswriter.ai

EU/UK Representative: If we are required to designate a representative under Article 27 of the EU or UK GDPR, we will appoint one and publish their name and contact details here before marketing the Service in those regions.