Nornveil

Skedio Artemis LLC, a Texas limited liability company, is the data controller responsible for your personal data.

• Contact: privacy@nornveil.com

2.1 Account Information

• Name and email address (provided at registration)
• Password (stored as a bcrypt hash — we never store your plain-text password)
• Subscription tier and billing status

2.2 Content You Create

• Manuscripts, story notes, and imported text
• World Codex entries (characters, locations, factions, magic systems, timelines)
• Scriptorium writing sessions and notes
• Uploaded images (character portraits, lore images)

2.3 Usage Data

• Feature usage (which tools you use and how often)
• Import and analysis activity logs
• Session timestamps and general usage patterns

2.4 Payment Data

Payment processing is handled by Stripe, our payment processor. We do not store full credit card numbers. We retain transaction records for tax and legal compliance.

2.5 Technical Data

• IP address and approximate location
• Browser type and device information
• Error logs and performance data

2.6 AI Processing Data

• Content you submit to AI features — manuscript text for Story Bible analysis and Scribe's Counsel, and prompts/style selections for Image Lab
• AI-generated output returned to you — extracted entities, writing suggestions, generated images

This data is processed only when you invoke an AI feature, and is transmitted to the third-party AI providers described in Section 4.1 and Section 11. See those sections for how those providers handle this data.

We do not use your manuscripts or creative content to train AI models. AI analysis is performed on demand when you invoke a feature — not automatically or in the background.

We share data only with trusted service providers necessary to operate the Service ("sub-processors"):

All sub-processors maintain their own data protection standards and Standard Contractual Clauses (SCCs) for international data transfers where required.

We do not sell your personal data. We do not share your data with advertisers.

4.1 AI Sub-Processor Data Handling

When you use an AI feature, the relevant content is sent to:

• Anthropic (Claude API) — for text analysis (Story Bible, Scribe's Counsel). As of this writing, Anthropic's commercial API terms state that customer content submitted via the API is not used to train Anthropic's models absent explicit opt-in.
• OpenAI (Image Generation API) — for Image Lab. As of this writing, OpenAI's API data usage policies state that data submitted via the API is not used to train OpenAI's models by default.

We do not control these providers' infrastructure or retention practices beyond what their published terms describe. All AI features are optional — if you prefer Your Content not be transmitted to these providers, simply do not use the corresponding AI features. Nornveil's manuscript editor, World Codex, and organizational tools function fully without them.

5.1 EEA, UK, and Switzerland. Nornveil is operated from the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your data is transferred to the United States under appropriate safeguards including Standard Contractual Clauses (SCCs) as adopted by the European Commission.

5.2 Asia-Pacific and Other Jurisdictions with Comprehensive Privacy Laws. If you are located in a jurisdiction with its own comprehensive data protection law — including but not limited to China (Personal Information Protection Law, "PIPL"), Japan (Act on the Protection of Personal Information, "APPI"), South Korea (Personal Information Protection Act, "PIPA"), or other jurisdictions in the Asia-Pacific region — your data is transferred to and processed in the United States. We aim to apply protections consistent with the principles found in these laws, including purpose limitation, data minimization, appropriate security safeguards, and the data subject rights described in Section 7.

Depending on your location, you may have the following rights:

All users:

• Access your data (available through account settings)
• Export your content (Export World feature)
• Delete your account and data (email privacy@nornveil.com)
• Correct inaccurate information
• Stop AI processing of your content at any time by not using AI features (Story Bible, Scribe's Counsel, Image Lab)

EEA / UK users (GDPR / UK GDPR):

• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with your local supervisory authority

California users (CCPA/CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information (subject to certain exceptions, e.g., billing records required by law)
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined under CCPA/CPRA
• Right to limit the use and disclosure of sensitive personal information — we do not use sensitive personal information for any purpose beyond providing the Service
• Right to non-discrimination for exercising any of these rights
• Right to designate an authorized agent to make a request on your behalf

Asia-Pacific users (PIPL, APPI, PIPA, and similar laws):

• Right to access, correct, and delete your personal information
• Right to be informed of the purpose, method, and scope of data processing
• Right to withdraw consent to AI processing of your content, including for cross-border transfer to AI sub-processors, by not using AI features
• Right to lodge a complaint with your local data protection authority

To exercise any of these rights, contact: privacy@nornveil.com

We will respond within 30 days (GDPR requires response within one month). We may need to verify your identity before fulfilling requests involving account data.

We protect your data using:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Bcrypt hashing for passwords
• JWT-based authentication with secure token handling
• Access controls limiting employee access to production data
• Regular database backups

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

Nornveil uses only functional cookies necessary to operate the Service (session authentication). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

The Service is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact privacy@nornveil.com and we will delete it promptly.

11.1 What AI We Use

Nornveil uses large language models (currently via Anthropic's API) to analyze manuscript text for the Story Bible and Scribe's Counsel features, and an image generation model (currently via OpenAI's API) for the Image Lab feature. Both are invoked only when you actively use the corresponding feature — never automatically or in the background.

11.2 No Automated Decision-Making With Legal Effect

We do not use AI to make decisions that produce legal effects concerning you, or that similarly significantly affect you. For example, account suspension and termination decisions are made by a human reviewing the relevant facts, not solely by automated analysis of your content.

11.3 No Training on Your Content

We do not use Your Content to train or fine-tune any AI model, whether ours or our providers'. See Section 4.1 for our AI sub-processors' own stated data-handling and training policies for content submitted via their APIs.

11.4 Transparency

Nornveil applies a layered approach to AI-generated content transparency, consistent with the EU AI Act's Article 50 obligations:

• Image Lab images carry embedded provenance metadata identifying them as AI-generated, written automatically at generation time and persisting through export — this is the marking and detectability mechanism contemplated by Article 50(2) for synthetic image content. The Service additionally displays an in-app "AI-generated" indicator, which you may hide for personal organization without affecting the underlying provenance metadata.
• Story Bible / Codex Lens entries are labeled within the Review Queue while pending your review. Once approved into your World Codex, they become part of Your Content (see Section 4.1 and Terms of Service Section 6.4), consistent with the Act's treatment of content that has undergone human review and is subject to your own editorial responsibility.
• Scribe's Counsel suggestions are labeled within the suggestion panel where AI output is displayed. Text you incorporate into your manuscript is Your Content.

11.5 Your Choices

All AI features are optional. You can use Nornveil's manuscript editor, World Codex, and organizational tools without ever invoking an AI feature — in which case no content is transmitted to any AI provider.

We may update this Privacy Policy. We will notify you by email or in-app notice at least 14 days before material changes take effect. The "Last Updated" date at the top reflects the most recent revision.

For privacy questions or to exercise your rights:

• Email: privacy@nornveil.com
• General support: support@nornveil.com
• Legal: legal@nornveil.com
• DMCA: dmca@nornveil.com

EEA users have the right to lodge a complaint with your national data protection authority if you believe we have not handled your data lawfully. Users in other jurisdictions with a data protection authority (e.g., the UK ICO, or APAC equivalents) have an equivalent right to lodge a complaint locally.