Privacy Policy
Last updated 15 September 2026
On this page
1. Who we are
NovelCraft (“NovelCraft”, “we”) is the controller of personal data processed through https://www.novelcraft.ai, except for payment data on self-serve plans. Those purchases are sold through Stripe Managed Payments; Stripe and Link are the merchant of record and independent controllers of the payment, tax and receipt data they collect. Contact the NovelCraft privacy team at privacy@novelcraft.ai.
This policy explains what we collect, why, how long we keep it, and your rights under the GDPR, UK GDPR and similar laws, and under US state laws such as the CCPA/CPRA.
2. Information we collect
Account
- Email address, name, display name, username
- Password hash (we never store the plain password) or Google account identifiers if you use Google sign-in
- Plan, usage counters and billing dates
- Whether you opted in to product news emails, and when you last changed that choice
Payment
Card numbers and tax IDs entered at checkout are collected by Stripe and Link, not stored on our servers. We store Stripe customer and subscription IDs so we can apply your plan and handle support requests. Receipts come from Link.
Content
- Story prompts, outlines, chapters, characters, covers and related metadata
- Comments and ratings if you use the community library
Technical
- IP address, device and browser data, approximate location derived from IP
- Pages visited, feature use, generation counts
- Cookie identifiers described in the Cookie Policy
3. Why we use data (legal bases)
If the GDPR or UK GDPR applies, we rely on these bases:
- Contract — creating your account, generating content, billing, support
- Legal obligation — tax, accounting, responding to lawful requests
- Legitimate interests — securing the Service, preventing abuse, understanding aggregated usage (balanced against your rights)
- Consent — non-essential analytics cookies, and product news / writing-tips emails sent only after an explicit opt-in (the sign-up checkbox, never pre-ticked, or the toggle in Settings). You can withdraw consent at any time without affecting prior processing
4. Marketing email
We send product news and writing tips by email only with an explicit opt-in: the checkbox on sign-up (never pre-ticked) or the toggle in Settings. Google and other sign-in methods stay opted out unless you check that box. Existing accounts are not treated as consented. You can withdraw anytime in Settings; that does not affect transactional messages such as verification, password reset or receipts.
5. AI processing
Prompts and the surrounding story context are sent to third-party model providers so they can generate text or images. That is required to perform the contract. Those providers process data under their own terms and may operate outside your country.
We do not sell your manuscripts. We do not use your story content to train third-party foundation models unless you give a separate explicit consent.
6. Who we share data with
We share personal data with processors who help us run the Service:
- Stripe and Link — merchant of record for self-serve subscriptions (payments, invoices, tax, fraud, disputes, receipts). See Stripe’s and Link’s privacy notices
- OpenAI and Anthropic — text and image generation
- Vercel — hosting, edge network, optional analytics and speed insights
- Resend — transactional email
- Google — optional sign-in, and analytics only after you accept analytics cookies
- Database hosting — PostgreSQL for account and content storage
We may also disclose data if required by law or to protect the Service, users or the public. We do not sell personal information as that term is used in the CCPA.
7. International transfers
We and several processors are in the United States or other countries that may not have the same data protection laws as yours. Where the GDPR requires it, we rely on an adequacy decision or Standard Contractual Clauses (and supplementary measures where needed) for those transfers.
8. Retention
We keep data only as long as needed for the purposes above:
- Account and content: for the life of the account
- After you delete the account: personal data within 30 days; backups up to 90 days
- Invoices and tax records: as required by accounting law (often several years)
- Security logs: a limited period unless needed for an investigation
9. Your rights
Depending on your location you may have the right to:
- Access, correct or delete personal data
- Export content you created (portability)
- Object to or restrict certain processing
- Withdraw consent for analytics cookies and for marketing email (in Settings)
- Lodge a complaint with your data protection authority
US residents may also request to know, delete or correct personal information and to opt out of “sale” or “sharing” for cross-context advertising. We do not sell or share data for that purpose. We will not discriminate against you for exercising these rights.
To exercise rights, email privacy@novelcraft.ai or delete the account in Settings. We may need to verify the request. You may use an authorised agent where the law allows it.
Payment and receipt data for self-serve plans is held by Stripe and Link. You can request deletion of Managed Payments data through Link; Stripe may then cancel the related subscription and delete the Stripe Customer object. We drop to the Free plan when we receive that webhook.
11. Children
The Service is for users 18 or older. We do not knowingly collect personal information from children. Bedtime stories are created by adults. If you believe a child has given us data, contact privacy@novelcraft.ai and we will delete it.
12. Security
We use HTTPS, hashed passwords, access controls and Stripe-hosted card collection so card data never touches our servers. No method of transmission is perfectly secure. Tell us promptly at privacy@novelcraft.ai if you suspect unauthorised access.
13. Changes
We may update this policy and will change the date at the top. Material changes will be announced by email or in the Service.
14. Contact
Privacy questions: privacy@novelcraft.ai.