Privacy Policy

Information We Collect

1.1 Information You Provide

Account information (email, username, password), payment information (tokenized via Stripe — we never see your full card number), writing preferences, communication preferences, and support communications.

1.2 Your Manuscripts & Story Data

Your manuscripts, characters, locations, timelines, world-building data, and all content you create within Clio are stored and processed solely to enable the platform's features — analysis, consistency checking, knowledge graph, and AI-powered tools. We do NOT sell, share, or use this data for any purpose other than providing the Service to you.

1.3 API Keys (BYOK)

Clio uses a Bring Your Own Keys model. Your AI API keys (Claude, Gemini, etc.) are stored encrypted and used exclusively to make API calls on your behalf. We never share your keys or use them for our own purposes.

1.4 Information Collected Automatically

Device information, usage analytics, log data, and essential cookies for operating the Service.

How We Use Your Information

• Provide the Service: Create and maintain your account, enable manuscript analysis, world-building tools, and AI features.
• Power Your Workspace: Process manuscripts to enable consistency checking, knowledge graphs, character tracking, timeline visualization, and all analytical features.
• Improve the Service: Understand usage patterns, identify issues, and develop new features. We use aggregated, anonymized data for this — never your actual manuscripts.
• Communicate with You: Send service-related notices, billing confirmations, and provide customer support.
• Ensure Safety: Protect users, detect fraud, enforce Terms of Service, and comply with legal obligations.

What We Will NEVER Do

• We will NEVER sell your personal information or manuscript data.
• We will NEVER share your writing with third parties for their purposes.
• We will NEVER use your manuscripts to train AI models.
• We will NEVER build advertising profiles from your content.
• We will NEVER sell or license your data to data brokers.
• We will NEVER target you with third-party advertising.

These are not just policies — they are fundamental commitments.

How We Share Information

4.1 Service Providers

Payment processors (Stripe), cloud infrastructure (Supabase), analytics, and customer support tools. All bound by strict confidentiality agreements.

4.2 AI Providers (BYOK)

When you use AI features, portions of your manuscript may be sent to the AI provider (Anthropic, Google) using your own API keys. These providers have their own privacy policies regarding data processing. Clio sends only the minimum data necessary for each request.

4.3 Legal Requirements

Only when required by valid legal process. We will notify you unless prohibited and challenge overbroad requests.

4.4 Business Transfers

If GalateaLabs is acquired, your data may transfer. You'll be notified. Any successor will be bound by this policy.

Cookies and Tracking

What We Use

• Essential cookies: Required for authentication and core functionality.
• Analytics cookies: To understand how the Service is used and improve it.
• Preference cookies: To remember your settings.

What We Don't Use

• NO advertising or targeting cookies.
• NO third-party tracking for advertising.
• NO cross-site tracking.

Data Security

• Encryption in Transit: All data transmitted uses TLS encryption.
• Encryption at Rest: Data stored on servers is encrypted using industry-standard methods.
• Access Controls: Restricted to authorized personnel. All access is logged and audited.
• API Key Security: Your BYOK API keys are stored encrypted and never exposed in logs or error reports.
• Password Security: Hashed using industry-standard algorithms. We cannot see your actual password.

Data Retention

• Account Data: Retained while your account is active and for a reasonable period afterward for legal compliance.
• Manuscripts & Story Data: Retained to enable your workspace. Deleted when you delete your account.
• Payment Records: Retained as required for financial, tax, and legal compliance.
• Usage Data: May be retained in aggregated, anonymized form for analytics.
• Deletion: Within 30 days of account deletion, except where legally required.

Your Rights and Choices

8.1 Access and Portability

Access your account information through settings. Request a full data export via privacy@galatealabs.ai.

8.2 Correction

Update your account information anytime through settings.

8.3 Deletion

Delete your account anytime. This removes all personal information, manuscripts, and story data.

8.4 Do Not Track

We don't respond to DNT signals. We don't track you across third-party sites for advertising.

International Users

GalateaLabs is based in the United States. Data is transferred, stored, and processed in the US.

European Users (GDPR)

Your rights include access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact privacy@galatealabs.ai or your local data protection authority.

California Users (CCPA)

Your rights include knowing what we collect, deletion, opting out of data sale (we don't sell), and non-discrimination. Contact privacy@galatealabs.ai.

Children's Privacy

Clio is designed for users 13 years and older. We do not knowingly collect information from anyone under 13. If we learn we have, we delete it immediately. If you believe we have information from someone under 13, contact privacy@galatealabs.ai.

Changes to This Policy

We may update this Privacy Policy. Material changes will be notified through the Service or by email. Review the policy whenever you use the Service. The "Last Updated" date indicates when it was last revised. Continued use after changes constitutes acceptance of the revised policy.