Skip to content
    Storyloom

    Legal

    Privacy policy

    GDPR-compliant · EU AI Act-compliant
    Last updated: November 2026
    Applies to: storyloom.app and all subpages

    This is a convenience translation. Only the German version is legally binding.

    1. Controller

    Richi AI
    Owner: Yves-Marcel Richel
    Homburger Landstr. 851
    60437 Frankfurt am Main, Germany
    Email: info@richi.solutions
    Website: storyloom.app

    2. Data protection contact

    For data protection enquiries: info@richi.solutions. No data protection officer has been appointed (no legal obligation).

    3. Use of AI (EU AI Act)

    Storyloom uses AI systems in accordance with Regulation (EU) 2024/1689 (EU AI Act) and the GDPR.

    Areas of use:

    • Text generation: project planning, story structure, scene writing (co-author with contextual understanding), storyboard and narrator prompts
    • Image generation (storyboard frames)
    • Video generation (image-to-video)
    • Speech synthesis (text-to-speech) and music generation
    • Semantic context search (embeddings / RAG) across Worldbook content

    Risk category: Low risk (transparency obligations under Art. 50 EU AI Act)

    Compliance notes:

    • No fully automated decision-making with legal or similarly significant effects (Art. 22 GDPR, Art. 86 EU AI Act)
    • AI-generated content is visibly labelled in the application; exported videos carry a machine-readable label in the file metadata and an accompanying file stating the models used (Art. 50 EU AI Act)
    • User data is not used to train external AI models; we use the providers' API access, under which inputs are not used for training
    • Models/providers used: Google LLC (Gemini — text, image, embeddings), fal.ai (image-to-video: Kling, Veo, Wan and others; speech, music and sound effects with ElevenLabs models)

    Only the content required for the respective generation is transmitted to the AI providers (prompts, scene texts, relevant Worldbook excerpts, reference images). Account data is not transmitted.

    Your AI-related rights:

    • Right to human review of automated decisions
    • Right to an explanation of the logic behind AI suggestions
    • Right to object to AI-based processing (Art. 21 GDPR)

    4. Categories of data

    • Account data (email address, password hash, display name, avatar)
    • Technical data (IP address, browser, device, operating system, time of access)
    • Project data (projects, scenes, structure, Worldbook entries, storyboards, timeline)
    • Media (uploaded files, generated images, videos, audio, exports)
    • AI usage data (prompts, model choice, cost estimates, generation status)
    • Sharing data (share token, expiry time, view counter)
    • Reading profile (books from the catalog that you mark as “Want to read”, “Currently reading”, “Read” or “Not interested”, your rating from 1 to 10, and start and end dates) — visible only to you, deleted with your account
    • Payment data (only for future paid plans: Stripe customer ID, subscription status — no credit card data)

    5. Legal bases

    • Performance of a contract (Art. 6(1)(b) GDPR) — account, project management, AI generation, export, share links, reading profile
    • Legitimate interest (Art. 6(1)(f) GDPR) — security, abuse prevention, error analysis, rate limiting
    • Consent (Art. 6(1)(a) GDPR) — where obtained in individual cases
    • Legal obligation (Art. 6(1)(c) GDPR) — retention for tax purposes

    6. Hosting

    The web application is delivered by Vercel Inc.; this involves processing technically necessary connection data (e.g. IP address, time, requested page). Database, authentication, file storage and serverless functions are operated by Supabase, Inc. with servers located in the EU (Ireland). Video export (rendering) runs on a render worker operated by Richi AI on the infrastructure of Railway Corp.; the worker accesses only the media required for the respective job and deletes temporary files on completion. Security measures: TLS encryption, row-level security (RLS), signed access URLs with limited validity.

    7. Processors (Art. 28 GDPR)

    • Vercel Inc. — hosting of the web application (SCC pursuant to Art. 46 GDPR / EU-US Data Privacy Framework)
    • Supabase, Inc. — database, authentication, file storage, serverless functions; servers located in the EU (SCC pursuant to Art. 46 GDPR)
    • Resend, Inc. – sending account emails (sign-up confirmation, sign-in links, email address changes); processes email address and language (SCC pursuant to Art. 46 GDPR / EU-US Data Privacy Framework)
    • Railway Corp. — hosting of the render worker for video export (SCC pursuant to Art. 46 GDPR)
    • Google LLC — Gemini models, text embeddings (SCC pursuant to Art. 46 GDPR / EU-US Data Privacy Framework)
    • Features and Labels, Inc. (fal.ai) — video, speech, music and sound effect generation (SCC pursuant to Art. 46 GDPR)
    • Stripe Payments Europe Ltd. — payment processing (only for future paid plans; EU, PCI DSS-certified)

    All processors are contractually bound to comply with the GDPR. Transfers to third countries are based on standard contractual clauses (SCC) and/or adequacy decisions (EU-US Data Privacy Framework).

    8. Cookies and local storage

    Storyloom uses no tracking cookies and no third-party analytics tools. We use the browser's local storage in two categories.

    Necessary (always active):

    • Sign-in session (auth token of the Supabase authentication)
    • Theme preference (light/dark)
    • Your cookie choice

    Legal basis: Art. 6(1)(f) GDPR, § 25(2) no. 2 TDDDG (strictly necessary for the service requested by the user).

    Statistics (only with consent): A random identifier and a session identifier in the browser. We use them to count which pages and features are used (e.g. page views, sign-ups, projects created). The page path without parameters, referrer, browser identifier and device type are transmitted to our own server at Supabase (EU) and from there to Richi AI's analytics database; if you are signed in, the event is linked to your account. No data is passed on to third parties.

    Legal basis: consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer or the menu; the identifiers are then deleted from your browser. We treat a Global Privacy Control signal from your browser as a refusal.

    9. Authentication

    Storyloom uses Supabase Auth for sign-up and sign-in with email address and password. Passwords are stored only as a hash. When you sign in, your email address, the time and your IP address are processed to prevent abuse. We send the emails confirming your sign-up, signing you in and changing your email address through Resend, in the language you chose on Storyloom. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

    10. Public share links, reading pages and author profiles

    Users can publish books and chapters as a public reading page. The text, the chosen author name and the short description are displayed publicly; each reading page keeps a view counter without personal reference. Works published as “publicly listed” additionally appear at storyloom.app/works and can be indexed by search engines. Publication can be withdrawn at any time; the page is then no longer accessible after ten minutes at the latest.

    Users can create a public author profile at storyloom.app/@handle. A profile stays private until its owner switches it public. A public profile shows the name, handle, profile picture, description, website, social accounts and the publicly listed works of its owner; it can be indexed by search engines. The profile picture is reduced to 400 × 400 pixels in your browser before upload, so the original file and its metadata never reach us. Links to your website and social accounts are only displayed; no data is transmitted to those sites unless a visitor clicks a link. Switching the profile private or deleting the account removes it from public view within ten minutes. Legal basis: Art. 6(1)(b) GDPR.

    To verify an author's website, our server retrieves the page at the website address once per check and searches it for the verification tag or link; only the result is stored, not the page. Legal basis: Art. 6(1)(b) GDPR.

    Authors can link their published books to their profile: an entry from the book catalog, single books from it, or a book on Amazon (ASIN or ISBN and title). We store the link, the proof given voluntarily and our decision to check that the person wrote the book; the book only shows on the public profile once approved. The link can be removed at any time and is deleted with the account. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (protection against false attribution).

    Anyone can report a public profile or work as illegal or in breach of our terms (Art. 16 Digital Services Act). We store the report, the reason, the description and, if provided, the e-mail address of the reporter to review the report and inform them of our decision; for signed-in users, the account is linked to the report. Reports are deleted one year after the decision. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA, and Art. 6(1)(f) GDPR (abuse prevention).

    In the book catalog (storyloom.app/books) we link to offers on Amazon. These links are marked as advertising; as an Amazon Associate we earn from qualifying purchases. No data is transmitted to Amazon when you view the catalog pages. So that visitors from the US, the UK and Ireland are sent to their own Amazon store, we derive the country from the IP address when a book page is opened (via our hosting provider Vercel); the country is used only for that response and is neither stored nor passed on to Amazon. Only when you click such a link are you taken to Amazon (for amazon.de: Amazon EU S.à r.l., Luxembourg; for amazon.co.uk: Amazon UK Services Ltd., London; for amazon.com: Amazon.com Services LLC, Seattle, USA); Amazon's privacy policy applies there, and Amazon can record via cookies that you arrived through our link. Book covers are delivered via our own server, not directly from the data source (Open Library).

    Users can share exported videos via time-limited share links. Anyone holding the link can view the video without signing in. For each link we store the expiry time, revocation status and a view counter; when the video is viewed, technical data (IP address, browser) is processed. Links can be revoked by their creator at any time. Legal basis: Art. 6(1)(b) GDPR (creator) or Art. 6(1)(f) GDPR (viewers).

    11. Data storage and security

    Technical measures: TLS encryption, row-level security (RLS) on all user tables, server-side input validation, rate limiting, signed access URLs for media, regular backups, access based on the principle of least privilege.

    12. International data transfers

    Where data is transferred to processors in third countries (in particular the USA: Google, fal.ai, Vercel, Supabase, Railway, Resend), this is done on the basis of standard contractual clauses (SCC) pursuant to Art. 46 GDPR and/or the adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR).

    13. Data subject rights (GDPR)

    • Access (Art. 15)
    • Rectification (Art. 16)
    • Erasure / “right to be forgotten” (Art. 17) — self-service in your profile under “Delete account”
    • Restriction of processing (Art. 18)
    • Data portability (Art. 20)
    • Objection (Art. 21)
    • Right to human review of automated decisions (Art. 22 GDPR, Art. 86 EU AI Act)
    • Complaint to the competent supervisory authority

    Please send requests to info@richi.solutions. Competent supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI, Hessian Commissioner for Data Protection and Freedom of Information), Postfach 3163, 65021 Wiesbaden, Germany. datenschutz.hessen.de

    14. Retention periods

    • Account data, project data and media: deleted immediately when the account is deleted (self-service in your profile), within 30 days at the latest
    • Preview exports: deleted automatically 7 days after completion
    • Final exports: until deleted by the user or the account is deleted
    • Share links: until the chosen expiry time or revocation
    • Server and function logs: max. 90 days
    • Tax-relevant data: 10 years (§ 147 AO, § 257 HGB)

    15. Updates

    This privacy policy may be updated when services, service providers or legal requirements change. Material changes will be communicated by email. The current version is always available on this page.

    Change history: November 2026 — public author profiles with website verification and book links, and reports on public content, reading profile for books from the catalog, usage statistics only with consent (cookie banner), move of hosting and backend to Vercel and Supabase, AI requests sent directly to Google, audio generation via fal.ai. August 2026 — adaptation to our own authentication, update of AI providers (Lovable AI Gateway, fal.ai), addition of export, share links and retention periods. February 2026 — first version.