Privacy Policy

1. Data controller

The controller of your personal data is Alessandro Ceruti, an individual who runs Bloomwright as a personal project.

Contact email: liebyrinth.support@gmail.com

The controller's postal address is available on request by writing to the email address above.

2. Personal data we collect

Bloomwright collects and processes the following personal data:

• Email address — provided by the authentication provider (Google) when you sign in.
• Google account identifier (provider account ID) — used to link your Bloomwright account to the authentication provider.
• Project content — the data you enter or generate through Bloomwright (project sheet, chapters, scenes, characters, settings, story structure, conversations with the AI agents). This content stays associated with your account.
• Service usage data — available credits, credit history, and the cost of the API calls associated with your account.
• Technical data — the date your account was created and last updated.

We do not collect your first or last name, profile picture, physical address, phone number, or any personal data beyond what is listed above.

3. Purposes and legal basis for processing

The data we collect is processed for the following purposes, each with its own legal basis:

4. Recipients and data sharing

Personal data is never sold or transferred to third parties for marketing or profiling purposes. Data may be disclosed to the following parties, solely for the purposes stated:

• Google Ireland Ltd — for the OAuth authentication process. Google acts as an independent controller for its own processing. See Google’s privacy policy.
• Google LLC — project content and agent conversations are processed by the Gemini artificial-intelligence models to generate responses and prose. The content sent comprises the text of your project (chapters, scenes, characters, structure) and includes no identifying personal data other than whatever you may have written into that text yourself. Bloomwright uses the paid Gemini API (Google AI/Cloud "paid services" tier): under Google’s terms of service, content sent through this tier is not used to train Google’s models, nor shared with other organisations.
• Anthropic PBC — the editor's chat assistant, the onboarding conversation and part of the planning and review work run on Anthropic's Claude models; Anthropic is also the fallback provider when a call to Gemini fails. The content sent is the project text described above, and includes what you type into the public onboarding wizard before you create an account, which is sent in order to answer you. Under Anthropic's commercial terms, inputs and outputs sent through the API are not used to train its models.
• OpenRouter, Inc. — prose generation is routed through OpenRouter to the DeepSeek V4 Pro model. Bloomwright restricts this routing to endpoints OpenRouter designates zero-data-retention — meaning the inference provider does not retain the prompt or the generated text once the request completes — and pins it to a fixed allowlist of inference providers (Novita, IonStream, DeepInfra) acting as sub-processors. The non-zero-data-retention direct endpoint is excluded.
• Neon, Inc. — for storing account data and project content on a managed PostgreSQL database.
• Upstash, Inc. — for technical rate limiting of requests (serverless Redis). Only technical request identifiers (IP address) are transmitted, for the purpose of protecting the service.
• Vercel, Inc. — for hosting and delivering the application.

5. Transfers to third countries

Account data and project content are stored on servers located in the European Union or the United Kingdom (depending on the configured Neon region).

Some service providers are based in the United States (Google LLC, Anthropic PBC, OpenRouter Inc., Vercel Inc., Upstash Inc., Neon Inc.). Transfers of data to the United States take place on the basis of the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023, under Art. 45 GDPR) where the provider is certified, or otherwise under Standard Contractual Clauses (the model clauses approved by the European Commission, under Art. 46(2)(c) GDPR).

Prose generation may be served by any of the inference providers OpenRouter is allowed to route to (Novita, IonStream, DeepInfra), some of which are established outside the European Economic Area. Those transfers rely on the same safeguards — an adequacy decision where the provider is covered by one, otherwise Standard Contractual Clauses — and the routing is restricted to zero-data-retention endpoints, so no project text is retained by the inference provider after the request completes.

You can request further information about the safeguards in place by contacting liebyrinth.support@gmail.com.

6. Data retention

Personal data is retained according to the following criteria:

• Account data and project content — retained for as long as the account is active.
• Deleted projects — a project you delete is kept in a soft-deleted state for 30 days, during which it can be restored on request; after that period the content is permanently erased.
• After an account deletion request — the account is deactivated and all personal data is permanently erased within 30 days of the request.

You can request deletion of your account and all associated data at any time by writing to liebyrinth.support@gmail.com.

7. Minimum age

Bloomwright is intended for users who are at least 14 years old, in accordance with Art. 2-quinquies of Italian Legislative Decree 101/2018. If you are under 14 you may not create an account or use the service. The controller reserves the right to delete accounts where there is reasonable doubt that this requirement is met.

8. Your rights as a data subject

Under Articles 15–22 GDPR, you have the right to:

• Access (Art. 15) — obtain confirmation that we process your data, and a copy of it.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your data (the "right to be forgotten").
• Restriction of processing (Art. 18) — request that processing be restricted in certain cases.
• Portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21) — object to the processing of your data on legitimate grounds.

To exercise your rights, write to liebyrinth.support@gmail.com. We will respond within 30 days of receiving your request.

You also have the right to lodge a complaint with the supervisory authority: the Garante per la protezione dei dati personali (the Italian data protection authority), Piazza Venezia 11 — 00187 Rome, www.garanteprivacy.it, email: garante@gpdp.it.

9. Cookies and local storage technologies

For detailed information about our use of cookies and localStorage, see our Cookie Policy.

10. Changes to this notice

The controller reserves the right to update this notice to reflect changes in the law or in the service. In the event of material changes, a notification will be sent to the email address associated with your account. The current version will always be available on this page, with the date it was last updated.