The short version
We do not sell your data, and we do not run ads.
We do not train models on your manuscripts for anyone else's benefit. Your work is used to serve your account.
The one thing worth reading properly is section 4. When you generate something, the text you supply is transmitted to a third-party model provider to be processed. That is how the Service works, and it means your prompts and manuscript context leave our systems in the ordinary course of use.
1. Who we are
Narrative Geometry is operated by Alalonde Corporation, of Ottawa, Ontario, Canada, which is the data controller for the personal information described here. We are subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and where it applies, the EU and UK General Data Protection Regulation.
2. What we collect
| Category | What it includes |
|---|---|
| Account | Email address, hashed password, and the sign-in provider you used. If you sign in with Google we receive your name and email address, nothing more. |
| Content | Manuscripts, prompts, personas, characters, ontology records, generated images and audio, and session ledgers. |
| Transactions | Token purchases and balance history, package purchased, amount, and date. Card numbers never reach our servers. |
| Usage | Pages visited, features used, generation counts, error and latency records, session identifiers, referring URL. |
| Technical | IP address, browser and device type, and timestamps, recorded in server logs. |
| Correspondence | Messages you send through the contact form or by email, and our replies. |
We do not intentionally collect special category data (health, biometrics, political or religious belief, sexual orientation). Fiction can contain anything, and we do not inspect your manuscripts for it — but please do not put real people's sensitive personal information into the Service.
3. Why we process it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Running your account and generating your work | Performance of our contract with you |
| Taking payment and maintaining your token balance | Performance of contract; legal obligation for tax records |
| Diagnosing faults, preventing abuse, securing the platform | Legitimate interests |
| Understanding which features are used, in aggregate | Legitimate interests |
| Replying to you | Legitimate interests; performance of contract |
| Product announcements by email | Consent, withdrawable at any time |
4. Model providers — read this one
To generate anything, the Service sends the relevant text — your prompt, plus the ontology and manuscript context needed for the request — to a third-party model provider. That content leaves our infrastructure and is processed on theirs.
Depending on which model is routed to, providers may include:
- OpenAI
- Anthropic
- Google (Gemini)
- Mistral AI
- DeepSeek
- xAI (Grok)
- ElevenLabs and other speech providers, for narration
- Image generation providers, including self-hosted diffusion models
Each provider handles that data under its own terms and privacy policy. We select providers and configure integrations to use API endpoints rather than consumer products, which for the major providers means the content is not used to train their models by default — but that is their commitment, governed by their terms, not ours to guarantee.
Some models run on hardware we operate ourselves. When work is routed to those, the content does not leave our infrastructure at all. The pricing page and the model configuration in the application indicate which provider serves which action.
If your work is confidential enough that transmission to a third party is unacceptable, talk to us before you upload it.
5. Training
We do not use your manuscripts, personas, characters, or ontology records to train models offered to other users. Your content trains your PACs, on your account, at your instruction.
We do use aggregate, de-identified operational data — how often a feature is used, where generations fail, how long they take — to improve the platform. That data does not contain your creative work.
If we ever want to use customer content for anything beyond serving that customer, we will ask for opt-in consent first. Not a policy update; an actual request you can decline.
6. Other processors
| Processor | What for |
|---|---|
| Microsoft Azure | Application hosting, database, and storage |
| Cloudflare | DNS, edge proxying, and denial-of-service protection |
| Stripe | Card payments. Card details go directly to Stripe. |
| PayPal | Alternative payment method |
| Google reCAPTCHA | Spam prevention on public forms |
| Email delivery provider | Transactional email: sign-in, confirmations, receipts |
We do not sell personal information, and we do not disclose it to third parties for their own marketing. We may disclose information where required by law, to enforce our terms, or to protect the rights and safety of users.
7. International transfers
We are based in Canada. Our processors and model providers operate in the United States, the European Union, and elsewhere. Using the Service means your information may be processed outside your country and may be accessible to courts and law enforcement in those jurisdictions under their local law.
Where required, transfers out of the EEA or UK are made under Standard Contractual Clauses or an adequacy decision. Canada holds a partial adequacy decision from the European Commission for commercial organisations.
8. How long we keep things
| What | How long |
|---|---|
| Account and content | While your account is open. Deleted within 30 days of account closure, subject to backups. |
| Transaction records | Seven years, as required for Canadian tax and accounting. |
| Server and security logs | Up to 12 months. |
| Correspondence | Up to 24 months after the matter is closed. |
| Backups | Rolling, overwritten within 90 days. |
9. Security
- Transport encryption (TLS) on all connections.
- Encryption at rest for databases and stored files.
- Passwords stored using a salted one-way hash. We never see them.
- Card details are never transmitted to or stored on our servers.
- Role-based access control, with administrative access limited to those who need it.
No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and the Office of the Privacy Commissioner of Canada as required by law.
If you believe you have found a vulnerability, please report it to security@narrativegeometry.com before disclosing it publicly. We will not pursue good-faith researchers.
10. Your rights
Depending on where you live, you may have the right to:
- ask what personal information we hold about you, and get a copy;
- have inaccurate information corrected;
- have your information deleted;
- export your content in a portable format;
- object to or restrict certain processing;
- withdraw consent where consent is the basis;
- complain to a regulator.
To exercise any of these, email privacy@narrativegeometry.com or use the contact form. We respond within 30 days. We may need to verify your identity first, which for account holders usually means replying from the address on the account.
In Canada you may complain to the Office of the Privacy Commissioner. In the EEA or UK, to your national supervisory authority.
12. Children
The Service is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy. The effective date and version at the top will change when we do, and material changes will be notified by email or in the application. We will not retroactively reduce your rights over information already collected without asking you first.
14. Contact
- Privacy enquiries
- privacy@narrativegeometry.com
- Security reports
- security@narrativegeometry.com
- General
- Contact form
- Post
-
Alalonde Corporation
Ottawa, Ontario, Canada