Privacy Notice — Good Story AI

1. Who we are

Good Story AI is operated by Good Story USA Inc., a corporation based in Ormond Beach, Florida, USA, trading as Good Story AI. Good Story USA Inc. is the data controller for personal data processed through the Service. Contact: tommy@yourgoodstory.biz.

2. Data we collect

Account data: name, email address, hashed password (or Google account identifier if you sign in with Google).
Content: the prompts you submit, AI outputs, conversation titles, and saved chats.
Support data: messages you send us.
Usage & telemetry: pages viewed, features used, events such as sign-in or message-sent.
Device data: IP address, browser, operating system, approximate location derived from IP.
Cookies: essential cookies for authentication and limited analytics cookies.

Payment information (card details, billing address, tax data) is collected and processed directly by Paddle as the Merchant of Record. We do not receive or store card numbers.

3. How we use your data

Create and operate your account (legal basis: contract performance).
Provide AI responses, save chats, and run the Service (contract performance).
Send transactional emails (e.g. password reset, receipt) (contract performance).
Protect against fraud, abuse, and security threats (legitimate interests).
Improve the Service and debug issues (legitimate interests).
Customer support (contract performance / legitimate interests).
Marketing communications, where you have opted in (consent).
Comply with legal obligations (legal obligation).

We do not use your prompts or outputs to train third-party AI models. Inputs may be transiently sent to AI model providers solely to generate your response.

4. Who we share data with

Service providers (subprocessors): cloud hosting (Cloudflare), database & auth (Supabase), AI model providers (Google, OpenAI via the Lovable AI gateway), email delivery, and analytics tooling.
Merchant of Record: Paddle.com, for sale of the product, subscription management, payments, tax compliance, refunds, and invoicing.
Professional advisers: legal and accounting, where necessary.
Authorities: where required by law, court order, or to protect rights, safety, and property.

We do not sell your personal data.

5. International transfers

Our subprocessors may process data in countries outside the UK/EEA, including the United States. Where required, we rely on safeguards such as the EU Standard Contractual Clauses or applicable adequacy decisions.

6. Data retention

We keep your account data while your account is active and for up to 12 months after deletion for legal, audit, and fraud-prevention purposes. Conversations and content are deleted shortly after you delete them or your account. Billing records held by Paddle are retained per Paddle's policies and tax-law requirements.

7. Your rights

Depending on your location, you may have the right to:

Access the data we hold about you.
Correct inaccurate data.
Delete your data ("right to erasure").
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent (where processing relies on consent).
Lodge a complaint with your local data protection authority.

To exercise these rights, email tommy@yourgoodstory.biz. We respond within 30 days.

8. Security

We use industry-standard technical and organizational measures, including TLS encryption in transit, encryption at rest, access controls, and row-level database security. No system is 100% secure; please use a strong unique password and notify us of any suspected breach.

9. Cookies

We use essential cookies to keep you signed in and remember preferences, and limited analytics cookies (first-party) to understand aggregate usage. You can clear cookies in your browser. Disabling essential cookies will break sign-in.

10. Children

The Service is not intended for users under 18. We do not knowingly collect data from children.

11. Changes

We may update this Notice; we'll notify you of material changes by email or in-app.

12. Contact

Questions or requests? Email tommy@yourgoodstory.biz.