Storyworld — Privacy Policy

Version: 2026-09-18 · Last updated / Effective date: 2026-10-27 · Change log: /privacy/history

This Privacy Policy explains how Storyworld AI Private Limited (UEN 202626500W), a company incorporated in Singapore ("Storyworld", "we", "us"), collects, uses, discloses, and protects personal data when you use Storyworld — the studio, the generation engine behind it, and the MCP connectors that let an AI client drive it (together, the "Service"). It is incorporated into our Terms of Service.

We serve users globally, including in the United States and the European Union, and comply with the Singapore Personal Data Protection Act ("PDPA") and, where they apply, the EU/UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended ("CCPA/CPRA"), and US state biometric-privacy laws.

One contact for everything in this Policy: support@storyworld.ai (this reaches our Data Protection Officer).

1. Controller & Data Protection Officer

1.1 Data controller: Storyworld AI Private Limited, 410 Ang Mo Kio Avenue 10, #01-851, Singapore 560410 (UEN 202626500W).

1.2 Data Protection Officer (DPO). As required by the PDPA, we have appointed a DPO. You can contact our DPO about this Policy, your personal data, or any privacy concern at: - DPO: Khok Hong Jing - Email: support@storyworld.ai (subject line: "Privacy")

2. Scope & Definitions

"Personal data" means data about an identifiable individual. "Inputs", "Outputs", "Your Content", "Likeness Data", "Provenance Marks", and "Third-Party AI Models" have the meanings given in the Terms of Service. "Biometric data" means personal data resulting from specific technical processing of a person's face, voice, or other physical characteristics which allows or confirms their unique identification, including facial-geometry templates and voiceprints; it is a form of Likeness Data and is described in Section 11.

3. Data We Collect

• Account data: name, email address, password (hashed), and profile details you provide.
• Acceptance records: the version of the Terms and this Policy you accepted, the timestamp, your IP address, and device information at the time of acceptance, and records of any consents you give.
• Billing data: subscription/plan, transaction records, and limited payment metadata. Card details are handled by our payment processor, not stored by us.
• Your Inputs: prompts, text, scripts, reference images, reference audio/video, characters, camera/scene parameters, and other creative material you submit.
• Reference material depicting a person: the reference images, audio, and video you upload, which may show or record a real person. We hold this as you uploaded it. We do not derive facial-geometry templates, voiceprints, or other biometric identifiers from it — see Section 11.
• Your Outputs: the video, image, and audio content generated for you, including Provenance Marks.
• Usage, device & log data: IP address, device/browser information, actions in the Service, timestamps, and diagnostic logs.
• Support and report data: messages you send us, and information in copyright, removal, or abuse reports.
• Cookies & similar technologies: see Section 10.

We do not intentionally collect special-category / sensitive data other than what is in the reference material you choose to submit (Section 11).

4. How We Use Data & Legal Bases

We use personal data to:

Under the PDPA, we collect, use, and disclose personal data for purposes a reasonable person would consider appropriate in the circumstances, with your consent (including deemed consent) or as otherwise permitted by law. Where we rely on deemed consent by notification for a new purpose, we first assess the likely adverse effect on you, notify you of the purpose, and give you a reasonable period to opt out.

We do not use your Outputs to train, fine-tune, or improve Storyworld's own AI models. We never use reference images, audio, video, or Likeness Data to train any model. (See Section 5 for how Third-Party AI Models process your Inputs.)

5. AI Processing & Third-Party AI Model Providers (Please Read)

5.1 Your Inputs are sent to third-party AI providers. To generate your Outputs, the generation engine transmits your Inputs to Third-Party AI Models operated by other companies — currently ByteDance (video, via ByteDance's Volcano Engine (Volcengine) Ark API, Beijing region), Alibaba Cloud Model Studio (video, China region), MiniMax (video), OpenAI (image), Google (Gemini, image), and Google Gemini text models (text). This includes text: where the Service drafts, rewrites, or analyses a script or a prompt for you, that text goes to a third-party language model in the same way your reference images go to an image model.

5.1a Reference material and likeness. The reference images, audio, and video you upload are sent to these providers only to generate your Outputs. Likeness Data itself (facial-geometry templates and voiceprints) is not created by Storyworld today — we hold your reference material as you uploaded it and send it to the providers above only to generate your Outputs.

5.1b Where the full list lives. The current list, with each provider's role, is at /trust.

5.2 Their role and terms. These providers process your Inputs under their own terms and privacy policies. Depending on the provider and configuration, they may act as our processors or as independent controllers. Storyworld does not control their independent practices.

5.3 What we can and cannot commit to. As at the effective date: - OpenAI (API): under OpenAI's business terms, API data is not used to train OpenAI's models; retention is up to 30 days for abuse monitoring; processing is in the United States. - Google (Gemini API): under Google's paid Gemini API terms, prompts and outputs are not used to improve Google's products; retention is for a limited abuse-monitoring period under Google's terms; processing is in the United States and other countries where Google operates. - ByteDance: we have not authorised the provider to use Your Content for training; content flagged by the provider's safety filters may be retained for up to 180 days; processing is in mainland China (see Section 7.2). - MiniMax: we have not authorised the provider to use Your Content for training; we have not agreed a specific retention period; processing location varies and may include mainland China. - Alibaba Cloud (Model Studio): we have not authorised the provider to use Your Content for training; we have not agreed a specific retention period; processing is in mainland China (the China-region endpoint).

We operate on these providers' standard commercial terms. Beyond the commitments above, we cannot guarantee how a provider processes, retains, or uses Your Content, including where processing occurs. We review provider terms at least quarterly, keep a current summary at /trust, and will notify you under Section 16 if a change materially affects you. If we move backends onto enterprise no-training or data-residency tiers, we will update this Policy.

6. Sharing & Disclosure

We share personal data with:

• Third-Party AI Model providers (Section 5) to generate your Outputs.
• Service providers / processors — cloud hosting and storage (Google Cloud, which runs the Service and its database — Google Cloud, Singapore region; Cloudflare R2, where your Inputs and Outputs are held — Cloudflare R2, in storage placed in the Asia-Pacific region (Cloudflare treats that placement as a preference, not a guarantee); Cloudflare, which carries and protects traffic to the Service and so sees your IP address and the requests you make; and Alibaba Cloud Object Storage, where a newly generated Output is first written before we copy it into Cloudflare R2 — Alibaba Cloud (Singapore) Private Limited, Singapore region), payment processing, analytics, email/communications, and customer support — acting on our instructions.
• Legal and safety disclosures — where required by law, legal process, or a direction of a competent authority (including the Singapore Online Safety Commission), or to protect the rights, safety, and security of Storyworld, our users, or the public (including reporting CSAM). This may include disclosing user identity information where lawfully required.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We do not sell your personal data and do not "share" it for cross-context behavioural advertising as those terms are defined under CCPA/CPRA. We never sell, lease, trade, or otherwise profit from biometric data.

7. International / Overseas Transfers

7.1 Your data may be processed outside Singapore. Because our infrastructure and the Third-Party AI Models operate in multiple countries, your personal data (including your Inputs) may be transferred to, processed, and stored outside Singapore and outside your own country, including in the United States and other jurisdictions listed in Section 5.3. Where your files are stored is a separate question from where a model processes them: your Inputs and Outputs are held in Cloudflare R2, as described in Section 6.

7.2 Honest note on data location. On our current provider tiers, we cannot guarantee the specific country in which a Third-Party AI Model processes your Inputs. Processing may occur in jurisdictions whose data-protection laws differ from your own, and — on current tiers — the infrastructure of certain providers may include processing in mainland China. Data processed on infrastructure in mainland China may be subject to access by PRC authorities under PRC law, and the provider may be restricted from disclosing such requests. We do not currently make a "your data never leaves China" or "processed only outside China" guarantee. If we adopt data-residency-guaranteed tiers, we will update this Policy.

7.3 PDPA (s.26). Where we transfer personal data overseas, we take reasonable steps so the recipient provides a standard of protection comparable to the PDPA, through contractual measures with our processors or another lawful mechanism.

7.4 GDPR transfers. For transfers of EU/UK personal data to countries without an adequacy decision (Singapore does not have an EU adequacy decision), we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and, where relevant, transfer-impact assessments.

8. Data Retention

8.1 We keep personal data only as long as needed for the purposes in this Policy or as required by law.

8.2 Account data is kept while your Account is active. Inputs and Outputs are kept to provide the Service to you and are deleted or de-identified when you delete them or your Account, subject to (a) routine backups cycled out in the ordinary course (target: purged within 30 days), (b) records we must retain by law (e.g., transaction records), and (c) copies retained under an active abuse investigation or legal hold.

8.3 Likeness Data / biometric data. We derive none, so there is nothing of this kind to retain or destroy (Section 11). The reference material you upload is retained under Section 8.2 like any other Input.

8.4 Acceptance and consent records are kept for as long as your Account exists and for 7 years after, as evidence of the terms and consents that applied.

8.5 Retention of any content-safety or abuse logs by Third-Party AI Model providers follows their own schedules: content flagged by a provider's safety filter may be retained by that provider for up to 30 days (OpenAI) or 180 days (ByteDance).

9. Your Rights

Subject to applicable law, you have the following rights. To exercise them, contact support@storyworld.ai (subject line: "Privacy request"); we will verify your identity and respond within the time required by law.

• PDPA (Singapore): request access to and correction of your personal data, and withdraw consent for future processing (which may limit our ability to provide the Service). You may complain to the Personal Data Protection Commission (PDPC).
• GDPR (EU/UK): access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, and the right to withdraw consent at any time without affecting prior processing. You may also lodge a complaint with your supervisory authority.
• CCPA/CPRA (California): the right to know what we collect and how we use/disclose it, to delete, to correct, to opt out of sale/sharing (note: we do not sell or share as defined), to limit the use of sensitive personal information (including biometric data), and to non-discrimination for exercising your rights. We honour recognised opt-out preference signals (e.g., Global Privacy Control) where applicable.
• Illinois, Texas, Washington, and other US states with biometric-privacy laws: these give rights over biometric identifiers such as facial-geometry templates and voiceprints. We derive none from your reference material (Section 11), so there is no biometric data of yours to disclose, correct, or destroy. If that ever changes we will publish a new version of this Policy under Section 16 and ask for separate written consent before any such processing begins.

You will not be discriminated against for exercising any of these rights.

10. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand usage. You can control cookies through your browser settings; disabling some cookies may affect functionality. Where required by law, we obtain consent for non-essential cookies through a consent banner.

11. Likeness & Biometric Data (Please Read)

11.1 Consent-first rule. The Service lets you submit reference images, audio, or video, which may depict a real person. You must not upload or generate the face, voice, or likeness of a real, identifiable person without that person's consent. By submitting such material, you represent and warrant that you have that consent (see the Terms of Service, Sections 9.1 and 10).

11.2 What we create today: nothing biometric. Character consistency is achieved by sending your reference material to the model with each generation, not by measuring the person in it. We do not extract or store biometric identifiers or biometric information — no facial-geometry templates, no voiceprints, no comparable measurements — from the reference material you submit. We hold that material as you uploaded it, described in Section 3 and retained under Section 8. We do not use it to identify or track any person, to make decisions about you, or to train or improve any AI model.

12. Security

We use reasonable technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Data Breach Notification

13.1 Singapore PDPA. If a data breach is likely to result in significant harm to affected individuals or affects 500 or more individuals, we will notify the Personal Data Protection Commission (PDPC) no later than 3 calendar days after we assess the breach is notifiable, and notify affected individuals where required.

13.2 GDPR. Where GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a notifiable breach, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights.

13.3 US state laws. Where US state breach-notification laws apply (including to biometric data), we will notify affected individuals and regulators within the timeframes those laws require.

14. Children / 18+

The Service is for individuals 18 and older. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we will delete it. If you believe a minor has provided us data, contact support@storyworld.ai.

15. Complaints & Contact

For any privacy question, request, or complaint, contact our DPO at support@storyworld.ai (subject line: "Privacy"). If you are in the EU/UK, you may also complain to your local supervisory authority; in Singapore, to the PDPC; in California, to the California Privacy Protection Agency or Attorney General.

16. Changes to This Policy

16.1 Each version of this Policy shows its effective date. Prior versions are archived at /privacy/history.

16.2 Minor changes (clarifications, corrections, formatting, contact details) take effect when posted.

16.3 Material changes — any new purpose for which we use your data; any new category of recipient or new AI model provider; any new country to which your data is transferred; changes to your rights or how to exercise them; or any use of your Inputs, Outputs, or Likeness Data to train or improve AI models — are published as a new version of this Policy that shows its effective date and a summary of the change, and apply from that date. The next time you sign in on or after the effective date — or verify your email address, refresh your session, connect an MCP client, or authorise an application to act for you — you will be asked to review and accept the updated Policy, and you cannot get past any of those points until you do. A session or a connection that is already open may keep running under the version it last authenticated against until it next authenticates.

16.4 Fresh consent. Where a material change introduces a purpose that requires consent, new processing of biometric or other sensitive data, or training on Your Content, we will not process your data for that purpose until you opt in through a separate, un-ticked affirmative action. Declining will not affect features that do not depend on that processing.

16.5 No retroactive effect. A revised Policy will not be applied to personal data collected under an earlier version in a way that expands its use, sharing, or transfer beyond what that version disclosed, unless you have consented under Section 16.4.

16.6 If you do not accept a material change, you may stop using the Service and delete your Account and data (see Section 9).

Storyworld AI Private Limited (UEN 202626500W). This Privacy Policy (version 2026-09-18) is effective as of 2026-10-27. Previous versions: /privacy/history.