Governance

GDPR & UK GDPR

How StoryHelm meets its obligations to EU and UK authors: the lawful bases we rely on, your data subject rights, our subprocessors and international transfer safeguards, and how to exercise control over your data.

Effective: July 5, 2026 · Last updated: October 28, 2026This document's own dates. No other paper moves them.

In force

Contents

10 sections · about 8 min read

Your data rights at a glance

A courtesy, not the contract

This page explains how the GDPR and UK GDPR apply to StoryHelm. In short, you have the right to access, correct, export, delete, restrict, and object to the processing of your personal data, and to complain to a supervisory authority. StoryHelm is the controller for your account data and a processor for the manuscript content you submit, we rely on clearly stated lawful bases, and we protect EU and UK transfers to our US infrastructure with Standard Contractual Clauses and the UK IDTA.

Where this note and the sections below disagree, the sections govern.

Your rights

Your data and your rights

Section 1

Who controls your data, and how to reach us

For personal data processed through your StoryHelm account, StoryHelm is the data controller. When you run analysis or translation, StoryHelm also acts as a processor of the manuscript content you submit, and we engage the subprocessors listed below to deliver the service.

You can reach our privacy team at [email protected]. Our registered mailing address is PO Box 352, Grantsville, UT 84029.

Where our processing requires one, we will designate an EU representative under Article 27 of the GDPR. Until then, you may direct EU-related requests to our privacy team. Where required, we will designate a UK representative under Article 27 of the UK GDPR. Until then, UK-related requests can also go to our privacy team.

Section 2

The lawful bases we rely on

The GDPR and UK GDPR require a lawful basis for every purpose for which we process your personal data. We rely on the following.

Performance of a contract (Art. 6(1)(b)). To create and operate your account, deliver manuscript analysis and translation, store your projects and canon, and provide support. Running analysis necessarily sends your prose to our servers on DigitalOcean and onward to Anthropic, PBC to be analyzed by Claude; that processing is part of providing the service you ask for.
Legitimate interests (Art. 6(1)(f)). To secure our systems and prevent abuse, to keep the product reliable, and to improve StoryHelm using de-identified, aggregated product signals. Product improvement never uses your manuscript prose to train any model. We balance these interests against your rights and you can object at any time (see your rights below).
Consent (Art. 6(1)(a)). For non-essential cookies, analytics, session replay, and marketing communications. These load only after you opt in, and you can withdraw consent at any time without affecting your account.
Legal obligation (Art. 6(1)(c)). To meet tax, accounting, and other legal and regulatory requirements, for example retaining billing and payment records.

Section 3

Your rights, and how to exercise them

If you are in the EU, the UK, or another region with comparable law, you have the following rights over your personal data.

Access. Obtain confirmation that we process your data and a copy of it.
Rectification. Correct inaccurate or incomplete data.
Erasure. Have your data deleted where there is no overriding lawful reason to keep it.
Restriction. Limit how we process your data in certain circumstances.
Portability. Receive data you provided in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.
Objection. Object to processing based on our legitimate interests, and to direct marketing at any time.
Rights related to automated decision-making. StoryHelm reads and analyzes your manuscript and never writes your prose. We do not make decisions producing legal or similarly significant effects about you by solely automated means. If that ever changes, you will have the right not to be subject to such a decision, and to obtain human review.
Withdraw consent. Where we rely on consent, withdraw it at any time. Withdrawal does not affect processing already carried out.

To exercise any of these rights, email [email protected]. For access and portability you can also download an export of your account data yourself from Settings under Data & export. It holds your profile, your books and what you wrote in them, your settings, your usage and purchases, and your review records. It leaves out StoryHelm's own analyses of your books and its machine translations, and it lists the files you uploaded rather than attaching them. For a copy of anything it leaves out, email the same address. We may ask you to verify your identity before we act, to protect your account. We respond within approximately 30 days, and will tell you if we need a permitted extension for complex requests. Exercising your rights is free in ordinary cases.

Section 4

Your right to complain

We would like the chance to resolve any concern first, so please contact us at [email protected]. You also have the right to lodge a complaint with a supervisory authority. In the EU, that is the authority in your country of residence, place of work, or where the issue arose. In the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk.

Data flows

Where your data goes

Section 5

International transfers

StoryHelm is operated from the United States, and our infrastructure and AI provider are US-based. When your personal data and manuscript content are transferred from the EU, the UK, or Switzerland to the United States, we rely on appropriate safeguards.

The European Commission's Standard Contractual Clauses (SCCs) for transfers out of the EEA.
The UK International Data Transfer Addendum (IDTA), or the UK Addendum to the SCCs, for transfers out of the UK.

We pair these with supplementary technical and organizational measures, including encryption in transit and at rest and access controls.

Section 6

Subprocessors

We engage a small set of vetted subprocessors to host the service, process payments, deliver analytics you have consented to, and run AI analysis and translation through Anthropic, PBC's Claude API, and check grammar in the editor through LanguageTool when you run a check. The current list, with each provider's purpose, the categories of data involved, the processing location, and the transfer mechanism, is published at /subprocessors. Where a purchase is sold through Link, Stripe's reseller service, Link receives the billing and transaction details it needs to sell, invoice, and collect tax on that purchase, as the seller and an independent controller for those details. We give at least 30 days' notice before adding or replacing a subprocessor, so you have the opportunity to object.

Section 7

Data Processing Addendum

If you process personal data through StoryHelm on behalf of others, or you otherwise need a written processing agreement, our Data Processing Addendum (DPA) is available to any business or controller customer, including Studio teams. It incorporates the Standard Contractual Clauses and the UK IDTA for international transfers. Review it at /dpa, or request a countersigned copy from [email protected].

Retention

Retention and incidents

Section 8

How long we keep your data

We keep personal data only as long as needed for the purpose it was collected, or as required by law. A summary of our retention periods follows, and the full detail lives in our Privacy Policy.

Data category	Retention period
Account & identity	For the life of your account. When you ask us to delete your account, we delete it within 30 days of verifying the request
Manuscript content & generated findings	Until your account is deleted. Deleting a project removes it from your account at once; we erase it from our database when we delete your account
Preferences & settings	For the life of your account, then deleted with it
Collaboration data (collaborator emails, shared canon)	Until removed, or until your account is deleted
Usage & analytics	For the life of your account, then deleted with it
Payment & billing records	7 years (tax and accounting obligations)
Consent records	Kept as evidence of consent for the applicable limitation period
Account data export files	7 days after the export is created, then deleted
Database backups	Automatic daily backups are kept for 7 days, so deleted data can remain in a backup for up to 7 days

Section 9

Data breach notification

We maintain procedures to detect, investigate, and respond to personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, in line with Article 33. Where a breach is likely to result in a high risk to you, we will notify affected individuals without undue delay, as required by Article 34. You can report a suspected security issue to [email protected].

Section 10

Where your data is processed

Your account data, manuscript content, and operational data are hosted in the United States on DigitalOcean, in its New York (NYC3) region. When you run analysis or translation, your prose is sent from our servers to Anthropic, PBC in the United States for processing by Claude.

We disclose this AI processing because it is how the product works and because trust depends on candor. Neither StoryHelm nor Anthropic, PBC trains any model on your manuscripts. Anthropic, PBC's commercial API does not train on inputs or outputs by default. Note that training and retention are different. By default, Anthropic automatically deletes API inputs and outputs within 30 days of receiving or generating them. Some of our analysis runs through Anthropic's Message Batches API, which stores a batch's requests and results for up to 29 days after the batch is created. Prompt caching adds no stored copy of its own: Anthropic holds a temporary cache of repeated context in memory for five minutes, or up to one hour, and then deletes it. Anthropic may keep data longer where the law requires it, and if its automated safety systems flag content as violating its Usage Policy, it may keep those inputs and outputs for up to 2 years. We do not claim zero retention. You retain 100% of the copyright in your manuscripts. StoryHelm takes only the limited license needed to process, host, and transmit your work to the subprocessors above so the service can run, and we never sell your work.

For more on our security posture, see our Security page. For the terms governing your use of StoryHelm, see our Terms of Service.

Related policies

StoryHelm · PO Box 352, Grantsville, UT 84029

Privacy & data requests: [email protected] · Legal: [email protected]

Effective July 5, 2026 · Last updated October 28, 2026. We notify you of material changes in-app and by email; continued use after an update constitutes acceptance.