Privacy

What you write in Quillsmith stays yours. We never use your writing to train a model, never sell it and never show it to another account. When you ask the AI assistant for something, only the part of your manuscript the request needs goes to the model provider that answers it; which providers those are is stated below. You can export your manuscript at any time. Delete your account and your worlds are deleted with it.

Moltera Software OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, email: support@quillsmith.studio.

No data protection officer is appointed; the conditions of Art. 37 GDPR are not met.

Your account: username, email address, password hash, language, time of registration. Purpose: providing the account and signing in. Basis: Art. 6(1)(b) GDPR.

Your worlds: chapters, characters, places, notes, plans and the version history behind them. Purpose: the service itself. Basis: Art. 6(1)(b) GDPR.

Requests to the assistant: when you ask the assistant to write, review or answer, the part of your manuscript that the request needs is sent to a language model. Our processor for this is OpenRouter, Inc. (USA). OpenRouter relays the request to the provider of the model in question; which providers those currently are, with their seat and transfer basis, is listed at /privacy/providers, generated from our model configuration. We route requests only to providers that do not use inputs and outputs for training; how long a provider keeps them follows its own policy, linked per provider at /privacy/providers. If you choose a model yourself, the choice shows its provider. Purpose: the service. Basis: Art. 6(1)(b) GDPR. Transfers to the USA rest on the recipient’s certification under the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), stated per provider at /privacy/providers.

Your own model: if you connect Quillsmith to your own Claude or ChatGPT, that program fetches the parts of your book it needs from us and sends them to its provider. That transfer is yours, under the contract you have with that provider; we receive back only what the program writes into the world.

Request log: for every request to a model we store the content sent and received, the time, the model and the cost. Purpose: operating and counting the usage limits, troubleshooting, evidence. Basis: Art. 6(1)(b) and (f) GDPR. Retention: the content for twelve months; after that the time, model and cost remain until the account is deleted.

Usage figures: the number of requests and the budget used per day and month. Purpose: counting the plan’s limits. Basis: Art. 6(1)(b) GDPR.

Sessions and access tokens: so you stay signed in and can revoke a device. Basis: Art. 6(1)(b) and (f) GDPR.

Payment: your name, email address, billing address and payment method go to our payment provider Stripe Payments Europe, Ltd., Ireland (privacy notice: stripe.com/privacy); Quillsmith itself never sees the payment method and stores only the customer id, the subscription id, the plan, the term and the status. Basis: Art. 6(1)(b) and (c) GDPR. We keep invoice data for seven years from the end of the financial year (Section 12 of the Estonian Accounting Act).

Transactional email: confirmations about registration, passwords, the subscription, cancellation and withdrawal are sent on our behalf by Resend, Inc. (USA), processed in the eu-west-1 region (Ireland); Resend is certified under the EU-US Data Privacy Framework. Delivery and bounce status is stored so that we do not keep sending to an address that refuses us. Basis: Art. 6(1)(b) and (f) GDPR.

Cancellation and withdrawal declarations: the email address, the time and the IP address of a declaration made through the buttons “Verträge hier kündigen” and “Verträge hier widerrufen”. Purpose: evidence of the declaration. Basis: Art. 6(1)(c) GDPR (Sections 312k, 356a BGB).

Codes and referrals: with your account we store the date of your first paid subscription and, if you typed a code at that first purchase, the code. If it was a creator’s code, we also store which creator referred you and when that was recorded. For each paid invoice in your first twelve months we then keep a commission entry: the creator, the invoice number, the currency, the amount excluding VAT, the rate, the commission and its status (open or reversed, with the reason and date of a reversal). The creator receives a monthly statement of counts and amounts only, never your name, your email address or anything else about you. Purpose: granting the discount and paying the creator correctly. Basis: Art. 6(1)(b) GDPR for the code and the first subscription, Art. 6(1)(f) for the referral and the commission (our interest in paying creators correctly), Art. 6(1)(c) for keeping the commission entries.

The providers, with their seat and transfer basis

Two cookies, both for the session: an HttpOnly cookie for signing in and the short-lived access token it mints. Besides them a cookie for your language and a local storage entry for the colour theme. There is no tracking cookie, no analytics service and no third-party script setting one.

The processors named above: the model providers for requests to the assistant, Stripe for payments, Resend for email and Hostinger for hosting, with servers in Germany. Nobody else. No advertising network, no data broker.

Account and worlds: until the account is deleted; after that they are removed from our systems within 30 days and from backups within 90 days.

Unconfirmed accounts: after seven days.

Billing data: seven years from the end of the financial year.

Request log: the content for twelve months, the counts until the account is deleted.

Cancellation and withdrawal declarations: three years after the contract ends, as evidence.

Code and referral on the account: until the account is deleted.

Commission entries: seven years from the invoice date, like the invoices they are computed from. If you delete your account, the entry stays but its link to your account is removed.

You have the right of access, rectification, erasure, restriction of processing, data portability (your manuscript export) and objection to processing based on Art. 6(1)(f) GDPR. You delete your account yourself in the settings; for everything else write to support@quillsmith.studio.

You have the right to lodge a complaint with a supervisory authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tallinn) or the authority at your place of residence.

If we change this notice, we state the date of the change here. Material changes are announced by email.