Privacy Policy

1. Who is responsible for your data

The data controller is RENVAR INC. (the “Operator”, “we”): registration number (OCN) 1001508737; address: 350 Bay Street, Suite 1300b, Toronto, ON M5H 2S6, Canada; email: renvar.inc@proton.me.

This Policy covers the website storygraph.online and the app app.storygraph.online. If you are in the European Economic Area (EEA) or the United Kingdom, see also sections 5–8.

2. What data we collect

• Account data: email, name or nickname, and a one-way hash of your password (we never store the password itself).
• Region: estimated from your IP address at registration (country and city).
• Content: screenplay and scene texts, photos, video and audio you upload, voice samples, the material created from them, and messages in the support chat. A voice sample is a recording of a human voice: upload only your own voice or the voice of a person who has agreed.
• Technical data: your IP address at registration and when you accept the terms, date and time, the version of the terms you accepted, and server logs.
• Payments: roubles are taken by YooKassa, dollars and euros by Stripe; card numbers are not passed to us. We receive the fact, amount, currency and date of a payment and, from Stripe, the payer's country and the tax details needed to work out tax. The currency you choose is stored in your account.
• Requests from the website: name, email, role, message text and the page language. The IP address is used only to prevent spam and is stored as a one-way hash.
• Visit statistics for the website and the app: the page, where the visitor came from, and time on the page. We use no cookies and write nothing to your browser for this: a visitor is told apart by a daily hash of the IP address and browser details that cannot be linked across days and from which the IP address cannot be recovered.

3. Why we use data

• To provide the Service: your account, storing and editing screenplays, analysis, creating material, collaboration, payment. Basis: performance of our contract with you.
• To pass text and material to AI providers to perform an operation you requested. Basis: performance of the contract.
• Security, protection from spam and abuse, rate limiting. Basis: legitimate interests.
• Aggregate statistics for the website and the app without cookies. Basis: legitimate interests.
• Replying to requests and enquiries. Basis: legitimate interests and, at your request, performance of a contract.
• Service emails: telling our team about a request or message, and telling you that support has replied. We send no marketing emails. Basis: performance of the contract and legitimate interests.
• Recording acceptance of the terms and keeping accounts. Basis: a legal obligation or legitimate interests.
• Voice samples and images of people are used only when you tell us to and only for the operation requested. Basis: the consent of the owner of the voice or image, which you confirm when you upload it.

4. Who receives your data

We do not sell personal data. We pass it to processors only to the extent a feature needs:

• OpenAI and Anthropic — analysing and creating text and images.
• Replicate — creating video and voice-over (third-party models run on its platform).
• YooKassa — taking payments.
• Stripe — taking payments in dollars and euros, subscriptions that renew automatically, and working out tax (Stripe Payments Company and its affiliates, USA and EU).
• Railway — hosting and the database.
• Resend — sending service emails (servers in the EU): about new requests and support replies.
• We do not use your material to train models of our own. The providers process data under their own privacy policies.

5. Where data is processed and international transfers

The Operator is based in Canada. Data is stored and processed on the servers of our providers, which may be outside your country, including outside the EEA and the Russian Federation.

For users in the EEA and the United Kingdom, transfers outside those areas rely on the mechanisms provided by the GDPR, such as adequacy decisions or standard contractual clauses offered by the providers concerned.

6. How long we keep data

• Account and project data is kept while the account exists.
• On your request we delete the account and its projects and files within 30 days; backups are overwritten in the normal cycle.
• Requests from the website are kept no longer than needed to handle the enquiry.
• Records of accepting the terms are kept for as long as they are needed to show your consent.
• Payment records (amounts, dates, tax details) are kept for as long as accounting and tax law requires, in Canada generally six years; this does not stop an account from being deleted.

7. Your rights

You can ask for access to your data, or for it to be corrected or deleted, by writing to the Operator. We reply within the time set by the applicable law (for the EEA, generally within one month).

If you are in the EEA or the United Kingdom you may also restrict or object to processing, receive your data in a portable format, withdraw consent (which does not affect the lawfulness of earlier processing) and lodge a complaint with the supervisory authority where you live, work or where you believe an infringement took place.

If you are in the Russian Federation you may obtain information about the processing of your data, ask for it to be updated, blocked or deleted, and withdraw consent.

8. Cookies and browser storage

We use no cookies for analytics or advertising. In the app the browser keeps only the sign-in token (localStorage): it is needed for sign-in to work and is removed when you sign out. On the website a dismissed language hint is remembered only until the tab is closed (sessionStorage). For this reason no cookie consent banner is needed.

9. Security

Passwords are stored as one-way hashes, connections are protected by TLS, and access to projects is limited by member roles. No system is completely secure.

10. Children

The Service is not intended for anyone under 16. If we learn that data of a child under 16 was obtained without a lawful basis, we will delete it.

11. Changes to this Policy

For material changes you will be asked to confirm that you accept the new version.

12. Contact

For questions about personal data: RENVAR INC. (the “Operator”, “we”): registration number (OCN) 1001508737; address: 350 Bay Street, Suite 1300b, Toronto, ON M5H 2S6, Canada; email: renvar.inc@proton.me.