1. Who We Are

Youniverse-Maker (youniverse-maker.com) is an AI-powered interactive storytelling platform. For the purposes of UK and EU data protection law, Youniverse-Maker is the data controller responsible for your personal data.

If you have any questions about how we handle your data, you can contact us at [email protected].

2. What Data We Collect

2.1 Account Data

When you create an account, we collect:

Username — chosen by you, used to identify your account
Email address — used for account verification, notifications, and communication
Email preferences — your choice of which optional email categories to receive (e.g. product updates and offers)
Password — stored in securely hashed form (we never store or see your plain-text password)

2.2 Story and Gameplay Data

When you use the service, we collect:

Story setup data — genre selections, character names, character details, backstories, and goals you provide when creating a story
Gameplay inputs — the text you type during interactive story sessions
AI-generated responses — the narrative text and image descriptions generated by our AI systems
Story metadata — titles, descriptions, creation dates, and session timestamps

2.3 Payment and Subscription Data

When you subscribe to a paid plan, we collect and store:

Subscription details — your current plan, subscription status, and billing period dates
Stripe identifiers — a customer ID and subscription ID assigned by our payment processor, Stripe, to manage your subscription

We do not collect or store your credit card number, CVV, or full payment card details. All payment information is handled exclusively by Stripe. See Section 4 for more details.

2.4 Technical Data

When you use our website, we automatically collect:

Session data — Django session identifiers (essential for the service to function)
CSRF tokens — security tokens that protect against cross-site request forgery
Timestamps — when you created your account, when you last logged in, and when actions were performed

We may use analytics tools to understand how the service is used and to improve it. With your consent, we also use advertising measurement tools to evaluate our marketing campaigns. See our Cookie Policy for details on each tool and how to manage your preferences. We do not sell your data to third parties.

3. How We Use Your Data

We process your personal data on the following lawful bases under UK GDPR:

3.1 Contract (Article 6(1)(b))

We process your account data, story data, and gameplay inputs as necessary to provide the service you signed up for — creating and playing interactive AI-driven stories. We also process payment and subscription data as necessary to manage your paid subscription, process billing, and enforce usage limits associated with your plan.

3.2 Legitimate Interest (Article 6(1)(f))

We process technical data and usage patterns for:

Maintaining the security and integrity of the platform
Preventing abuse and enforcing our Terms of Service
Improving and developing the service

We have assessed that these interests do not override your rights and freedoms, particularly given the limited nature of the data processed.

3.3 Consent (Article 6(1)(a))

We rely on your explicit consent for optional marketing communications. During signup or in your account settings, you can choose to receive "Updates & Offers" emails covering product updates, new features, and special offers. This preference is opt-in (off by default) and you may withdraw consent at any time by toggling it off in your account preferences.

Certain emails are always sent regardless of your marketing preference, as they are necessary for us to fulfil our contract with you:

Account emails — security alerts, password changes, email verification, and account updates
Subscription emails — billing confirmations, renewal reminders, and plan changes

4. Third-Party Data Sharing

We share your data with trusted third-party service providers strictly as necessary to operate the Youniverse-Maker platform. These providers fall into the following categories:

AI service providers — to generate narrative text and images in response to your gameplay inputs
Cloud hosting providers — to host our application, database, and stored content
Email service providers — to send transactional emails (account verification, password resets, notifications) and, where you have opted in, marketing communications
Payment processing (Stripe) — when you subscribe to a paid plan, we share your email address and an account identifier with Stripe to create and manage your subscription. Stripe processes your payment details directly and acts as an independent data controller for the payment data it collects. See Stripe's Privacy Policy for details on how Stripe handles your information.
Security service providers — to protect against automated attacks on our registration process
Advertising and measurement providers — when you grant marketing cookie consent, we share limited data with advertising platforms (Meta, Reddit, Google) to measure the effectiveness of our campaigns. Meta receives a hashed (one-way encrypted) version of your email address and an anonymous identifier to improve ad measurement accuracy. This data is only shared when you have opted in to marketing cookies. See our Cookie Policy for the specific cookies involved and how to manage your preferences.

All third-party providers process your data under binding data processing agreements that include appropriate safeguards for your personal data. For more details on international data transfer protections, see Section 5 below.

We do not sell your personal data to anyone. We only share data with service providers to the extent necessary to operate the platform and measure our advertising.

5. International Data Transfers

Some of our third-party service providers are based outside the UK/EEA. When your data is transferred internationally, it is protected by:

Standard Contractual Clauses (SCCs) adopted by the relevant authorities
Binding data processing agreements with our providers that include appropriate safeguards
Our ongoing assessment of transfer mechanisms to ensure compliance with UK GDPR

6. Data Retention

Account data: Your personal account details (username, email address) are retained while your account is active. When you delete your account, there is a 14-day grace period, after which these details are permanently deleted.
Payment and subscription data: Your Stripe customer ID and subscription history are retained while your account is active. Upon account deletion, these identifiers are removed from our database. Transaction records may be retained as required for accounting, tax, and legal obligations. You may contact us to request deletion of your Stripe customer record.
Story and gameplay data: All stories, gameplay inputs, and related content are retained indefinitely by Youniverse-Maker as platform property, even after account deletion.
AI-generated content: All AI-generated text and images are retained indefinitely by Youniverse-Maker as platform property, even after account deletion.
Technical logs: Retained for a reasonable period for security and debugging purposes, then deleted.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate data. You can also update your username and email directly in your account settings.
Right to erasure: You can request deletion of your personal data by deleting your account, or by contacting us directly.
Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
Right to restriction: You can ask us to restrict processing of your data in certain circumstances.
Right to object: You can object to processing based on legitimate interests.
Right to complain: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month, as required by law.

8. Children's Privacy

Youniverse-Maker is not intended for anyone under 18. We do not knowingly collect personal data from individuals under 18.

If we become aware that we have collected personal data from an individual under 18, we will take steps to delete that data promptly. If you believe someone under 18 has created an account, please contact us at [email protected].

9. Security

We take reasonable measures to protect your personal data, including:

Passwords are stored using strong one-way hashing algorithms (never in plain text)
All data in transit is encrypted via HTTPS/TLS
CSRF protection is enabled on all forms
Access to production systems is restricted
Bot protection on registration to prevent automated attacks
Payment data is handled by PCI DSS-compliant payment processors and never touches our servers

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

10. Cookies

We use a small number of essential cookies to operate the service. For full details, please see our Cookie Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice on the platform. The "Effective Date" at the top of this policy will be updated accordingly.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at [email protected].