Subprocessors

StoryHelm is an AI manuscript-intelligence platform. To deliver the service, we engage the third-party companies listed below as subprocessors. A subprocessor is a vendor that processes personal data or your manuscript content on our behalf, under our instructions and contract, so that we can host, secure, analyze, translate, and bill for StoryHelm.

We require every subprocessor to protect your data under written terms that are at least as protective as our own commitments to you. Before we add a new subprocessor or change the role of an existing one, we give you at least 30 days notice in advance, and you may object. If you have a reasonable, data-protection-based objection, you can raise it with us and we will work with you in good faith. If we cannot resolve it, you may terminate the affected service as set out in our agreement.

To receive advance notice of subprocessor changes, contact privacy@storyhelm.com and ask to be added to our subprocessor notification list.

The following subprocessors are engaged to provide the StoryHelm service. Processing locations and transfer mechanisms are listed for each. Where personal data leaves the United Kingdom or the European Economic Area, transfers are governed by the European Commission Standard Contractual Clauses (EU SCCs) and the UK International Data Transfer Addendum (UK IDTA), together with supplementary safeguards.

StoryHelm reads and analyzes your work. It never writes your prose. When you run an analysis or a translation, your manuscript text is sent from your browser to StoryHelm's servers and then on to our AI provider, Anthropic, PBC, which operates the Claude API that powers our 41-pass analysis, a multi-agent system. Your prose is processed only to generate your findings, canon, and translations, and to return them to you.

Your manuscript is not used to train any model. Neither StoryHelm nor Anthropic, PBC trains models on your inputs or outputs. Under the Anthropic Commercial Terms, the Claude API does not train on customer inputs or outputs by default. Training and retention are different things: by default the API provider may retain API data for a limited window for safety and abuse-prevention purposes. We disclose this flow plainly so you can make an informed choice, and we treat it as a trust commitment rather than fine print.

Before engaging a subprocessor, we assess whether the vendor is necessary to deliver the service and review its security and privacy posture. We look for encryption in transit and at rest, access controls, breach-notification commitments, and a data-protection agreement with appropriate transfer mechanisms for data that leaves the UK or EEA.

• We sign a data processing agreement, or rely on the vendor's equivalent terms, that binds the subprocessor to confidentiality, security, and purpose-limited processing.
• We limit each subprocessor to the specific data it needs for its stated purpose, and nothing more.
• We require EU SCCs and the UK IDTA, with supplementary safeguards, for transfers outside the UK and EEA.
• We periodically review whether each subprocessor is still required and still meeting our standards, and we remove vendors we no longer use.

This page is incorporated by reference into our Data Processing Addendum and our Privacy Policy. Together they describe how StoryHelm processes your data, the roles of our subprocessors, and the rights available to you and to your readers.

Questions about a specific subprocessor, or requests for a copy of the relevant transfer terms, can be sent to privacy@storyhelm.com. Legal notices can be sent to legal@storyhelm.com.