Legal
Privacy Policy
1. Who We Are
Fictorium (“we”, “us”, “our”) is a web-based writing tool for fiction authors, operated under the trading name Fictorium and based in Ireland. Our service is available at fictorium.net and at your personal subdomain (e.g. yourworld.fictorium.net).
We are committed to protecting your personal data and processing it in accordance with the General Data Protection Regulation (GDPR) and applicable Irish data-protection law. The Irish Data Protection Commission (DPC) is our lead supervisory authority.
2. What Data We Collect
We collect only the data necessary to provide and improve the service.
Account and identity data
When you join the waitlist or create an account, we collect your email address. We use this to communicate with you about your account, send transactional emails (e.g. password resets, billing receipts), and notify you of important service changes.
Your creative content
Everything you write, upload, or organise inside Fictorium — stories, chapters, character profiles, world-building notes, lore entries, timelines, research files, images, and PDFs — is stored in your private instance. This content is yours. We do not read it, analyse it, or use it for any purpose other than delivering the service to you.
Usage metadata
We collect technical metadata about how you use the service, including login timestamps, feature interactions (e.g. which tools you open), session duration, and error logs. This data does not include the content of your writing; it is used solely to monitor service health and improve the product.
Payment data
If you subscribe to a paid plan, payments are processed entirely by Stripe. Fictorium never receives or stores your full card number, CVV, or bank account details. We retain a record of your subscription status, billing period, and Stripe customer ID for account management purposes.
Your data is stored in a dedicated, isolated database instance. No other Fictorium user has access to your content, and your data is never pooled with other users' data.
3. Lawful Basis for Processing
We process your personal data on the following legal bases under GDPR Article 6:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract (Article 6(1)(b)) |
| Providing the writing tool service | Performance of a contract (Article 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Article 6(1)(b)) |
| Sending service and security notifications | Legitimate interests (Article 6(1)(f)) — keeping you informed of changes affecting your account |
| Improving the product using aggregated usage metadata | Legitimate interests (Article 6(1)(f)) — developing and improving the service |
4. How We Use Your Data
We use the data we collect for the following purposes:
- To provision and operate your private Fictorium instance
- To authenticate your account and keep it secure
- To process subscription payments and issue billing receipts via Stripe
- To send transactional emails (account creation, password reset, billing events) via Resend
- To monitor service reliability, diagnose technical issues, and improve the product using aggregated, anonymised usage metadata
Fictorium does not generate content using AI on your behalf. When you use MCP-compatible AI tools (such as Claude) within Fictorium, those interactions are governed solely by your agreement with the AI provider. Fictorium does not receive, store, or train on the content exchanged between you and any third-party AI service.
5. Third-Party Data Processors
We share your data only with the following sub-processors, each under a Data Processing Agreement (DPA) with us. All processors handling personal data operate within the European Economic Area (EEA) or under EU-adequate transfer mechanisms.
| Processor | Purpose | Data location |
|---|---|---|
| Neon (neon.tech) | PostgreSQL database hosting for your private instance | EU region |
| Amazon Web Services (AWS S3) | File and media storage for uploaded research files, images, and PDFs | EU region |
| Resend | Transactional email delivery (account notifications, billing receipts) | EU (SCCs apply) |
| Stripe | Payment processing and subscription management | EU (SCCs apply) |
| Vercel | Application hosting and CDN (serves the web application; no user content is cached on Vercel) | EU region |
We do not sell your data to any third party. We do not share your content or personal data with advertisers, data brokers, or AI training operators.
6. Data Retention
We retain your data for as long as your account is active or as necessary to provide the service. Specifically:
- Account data (email address): retained for the lifetime of your account, then deleted within 30 days of account closure.
- Creative content (stories, characters, world-building, uploaded files): retained for the lifetime of your account. Upon deletion of your account, all content is permanently purged from our systems and sub-processors within 30 days.
- Usage metadata: retained in anonymised, aggregated form for up to 24 months.
- Billing records: retained for 7 years to comply with Irish tax and accounting obligations.
You may request deletion of your account and all associated data at any time by contacting us at [email protected]. We will action your request within 30 days.
7. International Data Transfers
Where any of our sub-processors transfer personal data outside the EEA (for example, Stripe or Resend may process some data in the United States), we ensure that adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. You may request a copy of the applicable transfer mechanism by contacting us at [email protected].
8. Your Rights Under GDPR
As a data subject in the EU/EEA, you have the following rights:
- Right of access — you can request a copy of all personal data we hold about you.
- Right to rectification — you can ask us to correct inaccurate or incomplete data.
- Right to erasure ('right to be forgotten') — you can ask us to delete your personal data, subject to legal retention obligations.
- Right to restriction of processing — you can ask us to limit how we use your data in certain circumstances.
- Right to data portability — you can request your content and account data in a machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please email [email protected]. We will respond within one month. There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive.
If you are not satisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission (DPC) at www.dataprotection.ie, or the supervisory authority in your country of residence.
9. Cookies
Fictorium uses a minimal number of cookies, all of which are strictly necessary for the service to function. We do not use advertising cookies, tracking pixels, or third-party analytics that profile your behaviour.
- Session cookie: maintains your authenticated session while you are logged in. Expires when you log out or close your browser.
- CSRF token: a security cookie that protects against cross-site request forgery attacks.
- Locale preference: stores your selected display language. Expires after 1 year.
Because we use only strictly necessary cookies, we do not require a cookie consent banner. If we introduce non-essential cookies in the future, we will update this policy and obtain your consent.
10. Security
We implement technical and organisational measures to protect your data, including encryption of data in transit (TLS) and at rest, isolated database instances per tenant, access controls limiting who within Fictorium can access infrastructure, and regular security reviews. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the DPC in accordance with our GDPR obligations.
11. Children
Fictorium is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and display a notice within the service at least 14 days before the changes take effect. The 'last updated' date at the top of this page will always reflect the current version. Continued use of the service after the effective date constitutes your acknowledgment of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: