Privacy policy

Who is responsible

Xquissive AI · Joubertstraat 15, Maassluis · KvK 68640463 · VAT NL002015071B39 · info@novelfarer.com is the controller of personal data in NovelFarer. Privacy questions: info@novelfarer.com.

What data and why

• Account: email address and, if you choose one, a display name. Needed to sign in and manage your plan.
• Your adventures: what you type, the stories, pictures and game progress. Needed to provide the game and keep your story.
• Usage: numbers of turns, adventures and pictures per period. Needed for your plan's limits.
• Payment: your subscription and customer number at Stripe. Only Stripe sees card and bank details, we do not.
• Security: your IP address, kept briefly, to prevent abuse and excessive requests.
• Content checks: what you type and what the storyteller writes is checked automatically against the content rules. When something is refused, we keep that text with your account's code for half a year, so an admin can review abuse and warn or block you.
• Play statistics: when you start a story, play a turn or ask for a picture, tied to a pseudonymous code, not to your name or email address. This shows us how the game is used. Erased after 90 days.
• Waitlist: your email address and language, to tell you when we open.
• Statistics: anonymous page views through Vercel Web Analytics (and Plausible when it is on), without cookies and without personal data. For a shared story we do not send its address.

Legal bases: performance of the contract (account, game, payment), legitimate interest (security, preventing abuse, anonymous statistics) and consent (waitlist). Payments are also subject to statutory retention.

AI and your stories

To write each turn we send your input and the story so far to a language model from OpenAI; for pictures a short scene description goes to KIE.ai. They process it only to produce the answer. Do not put sensitive personal data in your story.

Who we share data with

• Supabase: sign-in and database.
• Vercel: website hosting (servers in Frankfurt) and anonymous visitor statistics.
• Bunny.net: storing and delivering pictures (EU).
• OpenAI and KIE.ai: making text and pictures (may process outside the EU).
• Stripe: payments and invoices; for subscriptions Stripe may act as the seller and remit VAT.
• Namecheap Private Email: email.

Where data is processed outside the EU, this is based on the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not sell data or use it for advertising.

How long we keep it

Account and adventures: until you delete your account; then we erase them at once. Guest adventures without an account: until you delete them or your browser cookie expires (one year). Waitlist: until launch or until you unsubscribe. Payment records: seven years, by law. IP addresses for security: minutes to hours.

Your rights

You can access, correct or erase your data, object, restrict processing and take your data with you. You can delete your account yourself in your profile; for anything else email info@novelfarer.com. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

All connections are encrypted. The database cannot be read directly from the internet; only our server can reach it. Pictures get unguessable names.