GDPR & UK GDPR

For personal data processed through your StoryHelm account, StoryHelm is the data controller. When you run analysis or translation, StoryHelm also acts as a processor of the manuscript content you submit, and we engage the subprocessors listed below to deliver the service.

You can reach our privacy team at privacy@storyhelm.com. Our registered mailing address is available on request.

Where our processing requires one, we will designate an EU representative under Article 27 of the GDPR. Until then, you may direct EU-related requests to our privacy team. Where required, we will designate a UK representative under Article 27 of the UK GDPR. Until then, UK-related requests can also go to our privacy team.

The GDPR and UK GDPR require a lawful basis for every purpose for which we process your personal data. We rely on the following.

• Performance of a contract (Art. 6(1)(b)). To create and operate your account, deliver manuscript analysis and translation, store your projects and canon, and provide support. Running analysis necessarily sends your prose to our servers on DigitalOcean and onward to Anthropic, PBC to be analyzed by Claude; that processing is part of providing the service you ask for.
• Legitimate interests (Art. 6(1)(f)). To secure our systems and prevent abuse, to keep the product reliable, and to improve StoryHelm using de-identified, aggregated product signals. Product improvement never uses your manuscript prose to train any model. We balance these interests against your rights and you can object at any time (see your rights below).
• Consent (Art. 6(1)(a)). For non-essential cookies, analytics, session replay, and marketing communications. These load only after you opt in, and you can withdraw consent at any time without affecting your account.
• Legal obligation (Art. 6(1)(c)). To meet tax, accounting, and other legal and regulatory requirements, for example retaining billing and payment records.

If you are in the EU, the UK, or another region with comparable law, you have the following rights over your personal data.

• Access. Obtain confirmation that we process your data and a copy of it.
• Rectification. Correct inaccurate or incomplete data.
• Erasure. Have your data deleted where there is no overriding lawful reason to keep it.
• Restriction. Limit how we process your data in certain circumstances.
• Portability. Receive data you provided in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection. Object to processing based on our legitimate interests, and to direct marketing at any time.
• Rights related to automated decision-making. StoryHelm reads and analyzes your manuscript and never writes your prose. We do not make decisions producing legal or similarly significant effects about you by solely automated means. If that ever changes, you will have the right not to be subject to such a decision, and to obtain human review.
• Withdraw consent. Where we rely on consent, withdraw it at any time. Withdrawal does not affect processing already carried out.

To exercise any of these rights, use the in-product Privacy Controls (Help then Privacy Controls), or email privacy@storyhelm.com. We may ask you to verify your identity before we act, to protect your account. We respond within approximately 30 days, and will tell you if we need a permitted extension for complex requests. Exercising your rights is free in ordinary cases.

StoryHelm is operated from the United States, and our infrastructure and AI provider are US-based. When your personal data and manuscript content are transferred from the EU, the UK, or Switzerland to the United States, we rely on appropriate safeguards.

• The European Commission's Standard Contractual Clauses (SCCs) for transfers out of the EEA.
• The UK International Data Transfer Addendum (IDTA), or the UK Addendum to the SCCs, for transfers out of the UK.

We pair these with supplementary technical and organizational measures, including encryption in transit and at rest and access controls.

We keep personal data only as long as needed for the purpose it was collected, or as required by law. A summary of our retention periods follows, and the full detail lives in our Privacy Policy.

Your account data, manuscript content, and operational data are hosted in the United States on DigitalOcean. When you run analysis or translation, your prose is sent from our servers to Anthropic, PBC in the United States for processing by Claude.

We disclose this AI processing because it is how the product works and because trust depends on candor. Neither StoryHelm nor Anthropic, PBC trains any model on your manuscripts. Anthropic, PBC's commercial API does not train on inputs or outputs by default. Note that training and retention are different: by default Anthropic, PBC may retain API data for a limited window for safety and abuse-prevention purposes, so we do not claim zero retention. You retain 100% of the copyright in your manuscripts. StoryHelm takes only the limited license needed to process, host, and transmit your work to the subprocessors above so the service can run, and we never sell your work.

For more on our security posture, see our Security page. For the terms governing your use of StoryHelm, see our Terms of Service.