Privacy Policy

We collect the following categories of information:

Information you provide

• Account information: your full name, email address, and password (stored as a secure hash) when you register.
• Payment information: billing details are entered directly into Stripe's secure form. We receive only a tokenised payment reference and high-level billing status — never your full card number.
• Communications: messages you send us by email or through feedback forms.

Information generated when you use the Service

• Voice and audio data: audio captured from your microphone during a storytelling session. See Section 2 for details specific to voice data.
• Session data: story transcripts, session duration, engine mode used, and in-session choices.
• Usage data: features accessed, pages viewed, stories played, and session timestamps.
• Device and technical data: IP address, browser type and version, operating system, device type, and coarse geographic location (city/country level, derived from IP).
• Log data: server logs recording requests to our infrastructure, error reports, and performance metrics.

Because our Service is voice-driven, audio data is central to how it works. We handle it carefully:

• Real-time processing only: audio from your microphone is streamed in real time over an encrypted WebRTC connection to our servers and to our speech-to-text providers (Deepgram or AssemblyAI). Raw audio is processed immediately and is not stored on our servers after the session ends.
• Transcripts: the text transcription of your spoken words may be stored as part of your story history so you can review it later. You can delete transcripts from your dashboard at any time.
• No AI training without consent: we do not use your voice recordings or transcripts to train AI models without your explicit, opt-in consent.
• Third-party AI processing: your voice is also transmitted to third-party AI providers (Anthropic, Inworld, OpenAI) for story generation and narration. Each provider processes audio/text under their own privacy policies and data processing agreements.

[ATTORNEY: In some US states (e.g., Illinois under BIPA, Texas under CUBI) voice data may qualify as "biometric information." Please assess whether consent disclosures or a biometric-specific data retention policy are required before this policy is published.]

We use the information we collect to:

• Provide, personalise, and improve the storytelling service.
• Authenticate your identity and manage your account and subscription.
• Process payments and manage your billing relationship through Stripe.
• Send transactional emails such as account confirmation, password reset, and billing notifications.
• Enforce our Terms of Service and Acceptable Use policy.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Analyse aggregate, anonymised usage patterns to improve story quality, response times, and feature design.
• Comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal data to third parties. We do not use your voice recordings or story transcripts for advertising targeting.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract performance: processing your account information, voice data, and payment data is necessary to provide the Service you have signed up for.
• Legitimate interests: we process usage data, log data, and device data to maintain security, prevent fraud, and improve the Service, where these interests are not overridden by your rights.
• Legal obligation: we may process data to comply with applicable laws.
• Consent: where we rely on consent (e.g., marketing communications or optional data uses), you may withdraw consent at any time without affecting the lawfulness of prior processing.

[ATTORNEY: Please confirm these legal bases and whether a Data Protection Officer appointment or Article 30 Records of Processing Activities are required.]

We share personal data only in the following limited circumstances:

• Service providers and sub-processors: Supabase (database and authentication), Stripe (payment processing), LiveKit (real-time audio infrastructure), Anthropic (Claude language model), Deepgram and AssemblyAI (speech-to-text), Inworld (voice AI), and OpenAI (text-to-speech). Each processes data only as needed to deliver their services to us and under contractual data protection obligations.
• Business transfers: if we are involved in a merger, acquisition, financing, or sale of all or a portion of our business, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Service at least 30 days before such a transfer.
• Legal requirements: we may disclose information if required by law, subpoena, or other legal process, or if we have a good-faith belief that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.
• With your consent: we may share information for other purposes with your explicit consent.

We do not sell personal data to data brokers or advertisers.

The Infinite Story Engine LLC operates primarily in the United States. If you are located outside the US, your personal data will be transferred to and processed in the US and potentially other countries where our sub-processors operate.

For users in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms to facilitate these transfers.

[ATTORNEY: Please confirm the appropriate transfer mechanism and whether any country-specific adequacy decisions apply.]

We retain personal data only as long as necessary for the purposes described in this policy or as required by law:

• Account data (name, email): retained while your account is active and for up to 30 days after deletion.
• Story transcripts: retained until you delete them from your dashboard, or when your account is deleted.
• Raw voice/audio: not stored after the session ends.
• Payment records: retained for up to 7 years as required for tax and accounting purposes.
• Server logs: retained for up to 90 days for security and debugging, then deleted.
• Aggregate, anonymised analytics: retained indefinitely (no personal data).

We use the following types of cookies and similar technologies:

• Strictly necessary cookies: session cookies set by Supabase to keep you authenticated. These are required for the Service to function and cannot be opted out of while using the Service.
• Preference cookies: cookies that remember settings such as your theme preference (light/dark mode).
• Analytics: we may use server-side analytics to understand aggregate usage patterns. We do not use Google Analytics or other client-side tracking scripts that load third-party code on our pages.

We do not use advertising cookies or cross-site tracking technologies. You can clear all cookies through your browser settings, but this will log you out of the Service.

Do Not Track: Some browsers send a "Do Not Track" signal. We currently do not respond to these signals because there is no industry-standard interpretation. If that changes, we will update this policy.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Restriction: request that we limit how we process your data in certain circumstances.
• Portability: receive your personal data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
• Lodge a complaint: file a complaint with your local data protection authority (e.g., in the EU, your national supervisory authority).

To exercise any of these rights, please email us at privacy@infinitestoryengine.com. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling your request.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete: you may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct: you may request correction of inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share your personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes beyond those necessary to provide the Service.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To submit a verifiable consumer request, please email us at privacy@infinitestoryengine.com. You may also designate an authorised agent to make requests on your behalf.

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: identifiers (name, email, IP address); commercial information (subscription status); audio/electronic information (voice sessions); and internet activity (usage data). We do not sell any of these categories.

[ATTORNEY: Please confirm CCPA coverage thresholds and whether a "Do Not Sell or Share My Personal Information" link is required on the footer or homepage.]

The Service is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child under 13 has used the Service, please contact us at privacy@infinitestoryengine.com.

Users between 13 and 17 may use the Service only with parental consent as described in our Terms of Service.

We implement and maintain commercially reasonable technical and organisational security measures to protect your personal data, including:

• Encrypted connections (TLS/HTTPS) for all data in transit.
• Passwords stored as secure hashes (via Supabase Auth — passwords are never stored in plain text).
• Role-based access controls limiting employee access to personal data.
• Regular review of our security practices and sub-processor agreements.

No method of transmission over the internet is completely secure. In the event of a data breach that affects your rights and freedoms, we will notify you and applicable authorities as required by law.

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you visit.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will notify you by email at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you must stop using the Service.

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact us at:

The Infinite Story Engine LLC
Email: privacy@infinitestoryengine.com

We aim to respond to all privacy requests within 30 days.