Privacy Policy

1. Introduction

At Craftology ("Craftology," "we," "us"), operated by ICVR LLC, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use craftology.io, the Craftology Story Lab Fellowship at storylab.craftology.io, and the Craftology platform (the "Service"). It also explains your rights and how to exercise them. Please read it carefully.

2. Who We Are (Controller)

ICVR LLC is the controller of your personal data. You can contact us at:

• Email: privacy@craftology.io
• Postal address: ICVR LLC, 501 S Beverly Dr., Beverly Hills, CA 90212, USA
• EU representative (GDPR Art. 27): Contentment GmbH, Englbergweg 24b, 84036 Landshut, Germany. UK representative: not applicable at this time; we are in the process of appointing one
• Data Protection Officer: not appointed; privacy contact above

3. Information We Collect

• Account information — name, email address, password. If you sign in with Google, we receive your email address and whether Google has verified it.
• Content — the prompts, uploads, and creative work you generate or store (“User Content”). For creative and studio users this often includes highly sensitive material such as character bibles, story and script material, look-development assets, likeness references, unreleased media, and generated assets. We treat this material as confidential and among the most sensitive data we hold, and protect it accordingly — even where it is not “personal data” in the narrow sense of privacy law.
• Payment information — processed by our payment provider; we do not store full card numbers.
• Usage and device data — log data, IP address, device and browser information, interactions.
• Communications — messages you send us.
• Waitlist information — your email address, the waitlist you joined and the form you used, your referral link, and how many people joined through it. To let you sign in to your waitlist page, we email you single-use sign-in links.
• People you invite — if you invite someone to a waitlist, the email address you give us for them. The invitation tells them your name and lets them reply to your email address. We send one invitation per address, whoever sends it, and each person can send up to five. Every invitation contains a link to opt out.
• Opt-out list — if you unsubscribe or opt out of invitations, a keyed one-way fingerprint of your email address, not the address itself, so that we never invite you again.
• Story Lab application — if you apply to the Craftology Story Lab Fellowship: your name, email address, phone number (optional), region, city and country, date of birth, company and title (optional), information about you or a link to a professional profile (optional), whether you are seeking financing, your skills, your marketing preference, and the referral link that brought you to us.
• Story Lab creator profile — if you are accepted: your display name, bio, photo and banner image, company, title, skills, region, locations, links, services, availability, contact methods, and your choices about publishing your profile and sharing your contact details. We remove location and other metadata from uploaded images.
• Story Lab review records — the status history of your application and profile, and the notes our reviewers add when they ask for changes.
• Discord — if you connect your Discord account: your Discord user ID and username. We do not keep your Discord access token.
• Cookies and similar technologies — Website analytics & Advertising pixel (Meta), for more details and consent mechanism see our Cookie Policy.

4. How We Use Your Information, and Our Legal Basis

We process personal data for the purposes below. Under the GDPR, each purpose has a legal basis:

Where we rely on legitimate interests, we balance those interests against your rights and you may object (Section 8).

5. AI Processing and Model Training

Craftology uses AI models to generate content from your inputs. The prompts and content you submit are processed to deliver outputs to you and may be shared with our AI inference subprocessors solely to provide the Service. We do not use your private User Content to train our own or third parties' AI models without your explicit, opt-in permission. We do not subject you to decisions producing legal or similarly significant effects based solely on automated processing without a lawful basis and appropriate safeguards (GDPR Art. 22). Outputs may carry machine-readable AI-generation and provenance markings; see the Content Policy.

Provenance records. If you generate a provenance record (an "Asset Birth Certificate"), we record and store the associated generation metadata — the prompts and input files you used, the model applied, and a reference to the resulting Output — so you can view or export how the asset was created. Where your prompts or inputs contain personal data, that data forms part of the provenance record.

6. Data Retention

We keep personal data only as long as necessary for the purposes above:

• Account data: for the life of your account, then deleted or anonymized within 90 days of closure.
• User Content: until you delete it or close your account, subject to short-term backup retention of up to 30 days.
• Payment/billing records: as required by tax and accounting law (typically 7 years).
• Logs: typically 12 months.
• Waitlist data: until you unsubscribe using the link in any waitlist email, ask us to remove you, or we close the waitlist.
• Unanswered invitations: deleted after 90 days, together with the emails that contained those addresses.
• Opt-out list: we keep only a keyed one-way fingerprint of your email address, not the address itself, so that we never invite you again.
• Emails we send: the copy we keep for delivery is deleted 30 days after sending.
• Story Lab application and profile data: as Account data above.
• Provenance records (“Asset Birth Certificate”): a provenance record is tied to its asset and to your account. It is retained for as long as you keep the associated asset or account, so the record stays available to you. When you delete the asset or close your account, the associated provenance record is deleted or anonymized on the same schedule as the underlying User Content (within 90 days), except that we may retain a provenance record for longer where (a) you have exported or shared it (that copy is outside our control), (b) it is subject to a legal hold or required by law, or (c) it is needed to resolve a dispute, enforce our terms, or support a rights-management or audit obligation you have asked us to maintain. We do not retain provenance records for our own independent purposes after the asset is deleted. When you exercise a deletion or erasure right under Section 8, we apply that right to the personal data in the associated provenance record on the same basis.

7. How We Share Information

We do not sell your personal data. We share it only with:

• Subprocessors that help us run the Service — see our Subprocessors.
• Professional advisers, authorities where required by law or to protect rights and prevent fraud.
• A successor in the event of a merger, acquisition, or asset sale, subject to this Policy.
• Providers of analytics, advertising, and email services used on our websites (such as Google and Meta), as described in our Cookie Policy.
• Other Story Lab members — if you publish your Story Lab creator profile, signed-in Story Lab members can see your name, photo, banner, bio, company, title, skills, region, locations, links, services, availability, and IMDb profile. They cannot see your email address, phone number, contact methods, or Discord account. Profile and banner images are shown only to signed-in Story Lab members.
• Google and Discord — if you sign in with Google or connect your Discord account, those companies process your data under their own privacy policies, as independent controllers.

Meta Pixel. Where the Meta Pixel is active on our websites, ICVR LLC and Meta Platforms Ireland Ltd. are joint controllers for the collection of data through the Pixel and its transmission to Meta. We are responsible for informing you and, where required, obtaining your consent; Meta is responsible for its subsequent processing. You can exercise your rights with either of us. See Meta's Controller Addendum and Privacy Policy.

Waitlist advertising measurement. When you join our waitlist on craftology.io, we ask whether we may share your email address, in hashed form, with Meta and Google to measure the effectiveness of our advertising. In the EEA, Iceland, Liechtenstein, Norway, the UK and Switzerland this is optional, and you can join without agreeing; elsewhere, agreeing is a condition of joining. When you agree, the Google Tag Manager, Google Analytics and Meta Pixel tags load for that visit, even if you have not accepted marketing cookies in our cookie banner; your cookie banner choice is otherwise left unchanged. You can withdraw this consent at any time by emailing privacy@craftology.io.

Business customers may enter our Data Processing Addendum.

8. Your Rights

Depending on where you live, you have the right to: access, rectify, erase, restrict processing, object to processing (including direct marketing), data portability, and to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority (in the EU/UK) or applicable regulator. To exercise any right, email privacy@craftology.io. We will respond within the timeframes required by law (generally one month under GDPR). If you unsubscribe using the link in any waitlist email, we delete your waitlist data and stop further invitations to your address.

California residents (CCPA/CPRA) have rights to know, delete, correct, and opt out of "sharing"/"sale"; we do not sell personal information. Our websites use the Meta Pixel, which may constitute "sharing" for cross-context behavioral advertising. You can opt out at any time using the methods described in Section 6 of our Cookie Policy, or by enabling Global Privacy Control, which we honor.

9. International Data Transfers

We are based in the United States and may process data outside your country. Where we transfer personal data from the EU/UK to a country without an adequacy decision, we use appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary measures as needed. Contact us for a copy of the relevant safeguards.

10. Data Security

We implement appropriate technical and organizational measures — including encryption in transit and at rest, access controls, logging, and personnel confidentiality — to protect your data. See our Trust Center and Technical & Organizational Measures ("TOMs") published at craftology.io/security-measures. No method of transmission or storage is completely secure.

We treat your creative User Content — including prompts, references, unreleased scripts and media, look-development assets, and generated output — as highly confidential, and apply the same technical and organizational safeguards to it as we do to personal data, regardless of whether it constitutes personal data under applicable law.

11. Data Breaches

If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay where the risk is high.

12. Cookies and Tracking

We use cookies and similar technologies as described in our Cookie Policy, and obtain consent for non-essential cookies where required.

13. Children's Privacy

The Service is not intended for children. We do not knowingly collect data from children under 13 (United States) or under the applicable digital-consent age (13–16) in the EU/UK. If you believe a child has provided us data, contact privacy@craftology.io and we will delete it. The Craftology Story Lab Fellowship is only for people aged 18 or over.

14. Changes to This Policy

We may update this Policy and will revise the "Last updated" date; material changes will be notified as required.

15. Contact Us

Questions or requests: privacy@craftology.io.