Privacy Policy

1. Who we are

The controller for Markbound is Generative Studio (Ata Akıllıoğlu), KvK 42039817, VAT NL005448418B42, at Professor Cobbenhagenlaan 9, Room 7.03, 5037 DA Tilburg, Netherlands. For privacy questions or requests, email ataakillioglu@generative-studio.nl.

2. What we collect

• Account: email address, hashed password (or Google sign-in identifier).
• Game content: characters, sagas, journal entries, oracle pulls, dice rolls — everything you create in the app.
• Usage data: per-day counts of AI narration turns, used to enforce your tier's allowance.
• Saga checkpoints: AI-generated summaries of your saga progress, used to give the Narrator long-term memory across sessions.
• Billing: if you subscribe, Stripe stores your payment method, billing address and invoices. We never see or store your card number.
• Technical: standard server logs (IP address, user agent, timestamps) for security and debugging.
• Product analytics: product events such as sign-up, character creation, saga creation, narration turns and checkout steps. Analytics fields are intended for event names, your user ID and metadata such as tier, saga ID, model provider, token counts, latency and retry counts.
• Anonymous page counts: on our public pages we count which page was opened, a coarse device type (phone, tablet or desktop), known campaign tags and which main button was clicked, tied to a random browser ID that expires after 30 days. We do not store your IP address, the full web address or where you came from. If you sign up on that browser, these visits are linked to your account.

We do not run advertising trackers or social pixels. The app uses sign-in/session cookies and service-provider diagnostics needed to operate, secure and debug the service. Lovable platform services may process operational analytics and diagnostics for the hosted app.

3. Who processes your data

We use a small number of trusted sub-processors to run the service:

• Lovable Cloud and Supabase: database, authentication, file storage and app infrastructure.
• Stripe: payment processing for subscriptions.
• Moonshot AI / Kimi: narration, story summaries and helper processing send relevant messages, saga context and journal excerpts directly to Moonshot AI. See our AI Disclosure for the models and request contents.
• Email provider: for transactional emails (sign-up confirmation, password reset, billing receipts).
• Sentry: server error monitoring. The application sends selected diagnostic fields, excluding story text, request payloads and account details from outgoing error events. This does not describe separate hosting-provider logs.

Markbound does not sell story content or train AI models. Moonshot's API data-security help page says API inputs and outputs are not used to train or improve models or stored for training, while its July 2026 API terms retain broader content-improvement rights unless restricted by written policies or agreements. We are awaiting account-specific clarification and do not promise that this account has a contractual no-training guarantee.

We have requested a business agreement from Kimi. The applicable data-processing terms and additional privacy protections for our account are awaiting confirmation. That request was received on 15 September 2026; it is not an executed agreement, zero-retention activation or training waiver.

Moonshot may process AI requests outside the EEA, including in Singapore. We do not promise EU-only processing or zero retention. Lovable hosts the app and may process operational analytics and diagnostics for the hosted service, but the player-facing Kimi narration path described here is separate from Lovable's AI gateway.

An earlier statement that every provider would never train on sagas was too broad and is not supported across all standard provider terms. We cannot establish from the available records whether any specific story content was used for model training. Contact us about past requests or provider records.

4. Legal bases (GDPR)

• Contract: processing your account, sagas and subscription so we can deliver the service.
• Legitimate interest: proportionate security logging, abuse prevention, diagnostics and enforcing usage caps.
• Legal obligation: tax records for invoices.

5. How long we keep things

• Account and game content: until you delete your account.
• Usage counters: retained indefinitely so we can support billing disputes, enforce subscription tier limits, and detect abuse.
• Invoices: kept for the legally required period (typically 7 years in the Netherlands).
• Server and provider logs: retained according to provider or project settings, unless needed longer for security, support, legal claims or compliance.
• Quality-evaluation records may include saga excerpts and AI outputs used when testing narration. Contact us to include these records in an access or erasure request.
• Email delivery logs (recipient address, template name, send status) are retained for operational diagnostics and to comply with anti-spam obligations. Suppression records (bounces, unsubscribe requests, spam complaints) are kept indefinitely so we never re-email someone who has asked us to stop.
• Analytics events are retained for product diagnostics and handled as part of access, erasure or restriction requests where technically and legally applicable.

6. Your rights

Under the GDPR you have the right to access, correct, erase and, where applicable, export or restrict your data, or object to processing based on legitimate interests. Email ataakillioglu@generative-studio.nl and we normally respond within one calendar month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

The account download is a self-service export of account and gameplay records. It is not a complete response covering support correspondence, payment-provider material or provider archives. Ask us for those additional records when exercising access rights.

7. Account deletion

You can permanently delete your account from your account settings. We will process the deletion immediately for records controlled by the account-deletion workflow. You may also email us at ataakillioglu@generative-studio.nl if you prefer. Stripe billing records, provider logs, backups and records required for legal claims or tax compliance may have separate retention or deletion processes.

8. Children

Markbound is not directed at children under 16 and we do not knowingly collect data from them. We are awaiting provider confirmation on the conditions that apply to 16- and 17-year-old players.

9. Changes

If we change this policy in any material way we will update the date at the top and, where appropriate, notify you by email.