Privacy Notice

1. Who we are

The Story Assembly, trading as Yolect, is the data controller for the personal data described here. That means we decide what data is collected and why, and we are accountable for how it is handled. For any privacy question or request, contact us at support@yolect.com.

2. What we collect and why

• —Account data (name, email address, login credentials and authentication identifiers from Google sign-in) — to create and secure your account. Legal basis: performance of our contract with you.
• —Content you provide (voice recordings, transcripts, notes, imported or pasted posts, documents, generated drafts, edits) — to deliver the core service: building your writing profile and knowledge library and generating drafts. Legal basis: performance of our contract.
• —Usage and telemetry data (features used, generation counts, quality and edit signals, timestamps) — to enforce plan limits, improve output quality, and diagnose problems. Legal basis: performance of our contract and our legitimate interest in improving the product.
• —Device and technical data (IP address, browser and device identifiers, log data) — for security, abuse and fraud prevention, and service reliability. Legal basis: legitimate interests and legal obligation.
• —Support and feedback messages (bug reports, feature requests, thumbs up/down, cancellation reasons) — to answer you and improve the product. Legal basis: legitimate interests.
• —Marketing preferences and email delivery events — to send product and onboarding emails you have asked for and to detect delivery problems. Legal basis: consent, withdrawable at any time.

Payment card details are never collected or stored by us — they are handled by Paddle as Merchant of Record.

3. Who we share data with

• —Service providers and subprocessors: cloud hosting and database providers, AI model providers that process your prompts and content to generate drafts, email delivery providers, and analytics or error-monitoring tooling. They act on our instructions.
• —Paddle, our Merchant of Record: for the sale of subscriptions, checkout, subscription management, payments, invoicing and tax compliance. Paddle handles billing enquiries and refunds.
• —Professional advisers: legal, accounting and audit advisers where necessary.
• —Authorities: where we are legally required to disclose, or to protect our rights, users or the security of the service.

We do not sell your personal data, and we do not sell your content.

4. AI processing of your content

To generate drafts we send relevant parts of your captured content and writing profile to third-party AI model providers. We do not use your content to train our own public models, and we ask our providers not to train on data submitted through their business APIs. Your knowledge library, beliefs and stories stay scoped to your workspace.

5. International transfers

Our providers may process data outside your country, including in the United States and the European Economic Area. Where such transfers involve UK or EEA personal data, we rely on appropriate safeguards such as Standard Contractual Clauses or an applicable adequacy decision.

6. How long we keep data

We keep account and content data for as long as your account is active. If you delete specific content or your knowledge library, it is removed from the live service promptly and from backups within 30 days. If you close your account, we delete or anonymise your personal data within 90 days, except where we must keep records longer for tax, accounting or legal obligations.

7. Your rights

Subject to applicable law, you may request access to your data, correction of inaccurate data, deletion, restriction of processing, portability of your content, and you may object to processing based on legitimate interests. Where we rely on consent — for example marketing email — you can withdraw it at any time. You can export, delete or rebuild your knowledge library from within the product, or email us and we will respond within one month. If you are in the UK or EEA, you also have the right to complain to your local supervisory authority.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level access controls that scope data to your account and workspace, least-privilege access for our own systems, and monitoring for suspicious activity. No system is perfectly secure, so please use a strong, unique password and tell us immediately if something looks wrong.

9. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to remember interface preferences; these cannot be disabled without breaking the product. We use a small amount of privacy-respecting analytics to understand which features are used. We do not run advertising or cross-site tracking cookies. You can clear cookies and site data at any time in your browser settings.

10. Changes to this notice

We will update this notice as the product evolves and will notify you of material changes by email or in the app.