Privacy Notice

1. Who we are

Quillvein is operated by Samantha Silva, trading as Quillvein. We are the data controller for the personal data described here: we decide what data is collected and why. Contact: quillveinadmin@gmail.com.

2. What we collect and why

• Account data (email address, name if given, login credentials or Google sign-in identifier) — to create and secure your account. Legal basis: performance of our contract with you.
• Your content (manuscripts, chapters, characters, places, canon entries, sparks, prompts, uploaded and generated images, voice dictation transcripts) — to provide the writing workspace and the AI features you invoke. Legal basis: performance of our contract.
• Subscription and entitlement status (plan, trial dates, renewal date, payment state received from Paddle) — to give you access to what you have paid for. Legal basis: contract and legal obligation.
• Support and feedback messages — to answer you and improve the product. Legal basis: legitimate interests.
• Usage and technical data (device and browser type, IP address, log and error data, feature usage) — for security, fraud prevention, debugging and product improvement. Legal basis: legitimate interests.
• Marketing emails, if you opt in — legal basis: consent, withdrawable at any time.

We do not use your manuscripts to train AI models, and we do not sell your personal data or your writing.

3. Who we share it with

• Merchant of Record — Paddle.com, who handles the sale, subscription management, payments, tax compliance, invoicing and refunds. Paddle collects your payment details directly; we never see or store your card number.
• Service providers / subprocessors: our hosting and database provider, AI model providers (for the text and images you send to AI features), email delivery and error-monitoring tools.
• Professional advisers (legal, accounting) where necessary.
• Authorities where we are legally required to disclose.

Nothing you write is exported anywhere else without an explicit action by you — exports go only to the destination and format you choose.

4. International transfers

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account and content data for as long as your account exists. If you delete your data from the settings menu, your content and generated images are erased from our systems promptly. Billing and tax records are kept as long as the law requires (typically 6–7 years) by us and by Paddle. Log data is kept for a short period and then deleted or anonymised.

6. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and complain to your data protection supervisory authority. UK/EEA users can exercise GDPR rights and we will respond within one month. Email quillveinadmin@gmail.com — you can also export and delete your own data at any time from inside the app.

7. Security

We apply appropriate technical and organisational measures: encryption in transit, encryption at rest with our hosting provider, row-level access controls so a user can only reach their own work, and least-privilege access to production systems. No system is perfectly secure, but protecting unpublished manuscripts is treated as a first-order concern.

8. Cookies and local storage

We use essential cookies and browser storage only — to keep you signed in and remember workspace preferences such as mood and brightness. We do not run advertising or cross-site tracking cookies. You can clear or block them in your browser, though sign-in will not work without the essential ones.

9. Children

Quillvein is not intended for children under 16.

10. Changes

We will update this notice when our practices change and revise the date at the top. Material changes will be flagged in the app.