Privacy Policy

Revision 1.1 (2026-08-23)

1. Who Is Responsible

The data controller for Turnleaves is Vadim G. Biktimirov, an individual entrepreneur registered in the Russian Federation (INN 025805298896, OGRNIP 326028000188150), registered address: 75-1 Lesnaya St., Blagoveshchensk, Republic of Bashkortostan 453434, Russia. For any privacy question or request, contact [email protected] or [email protected].

Operator details may be updated upon registration of the Kazakhstan entity; the current version of this document is authoritative.

2. Data We Collect

• Account data: email address, username, and a hashed password. Optional profile details (avatar, bio) if you add them.
• Content data: the prompts, story settings, chapters, comments, and reviews you create on the service.
• Usage data: pages viewed, generation requests, feature usage, approximate region, device and browser type, IP address, and server logs kept for security.
• Payment data: payments are processed by Paddle as merchant of record. We never receive your full card details; we receive only transaction confirmations (plan, amount, status) needed to activate your subscription or credits.

3. How We Use Data

We use your data to operate the service (generate stories, narration, and images you request), manage subscriptions and credits, moderate published content, secure the platform, respond to support requests, and send essential service emails such as verification and billing notices. We do not send marketing email without your consent.

4. Processors and Sharing

We share data only with service providers acting on our instructions under data-processing agreements:

• AI providers that generate text, speech, and images (DeepSeek for prose and service reasoning, OpenRouter for embeddings and image generation, Microsoft Edge neural text-to-speech for narration) — they receive the story context needed to produce output you request;
• Paddle.com Market Ltd — checkout, billing, taxes, and refunds for customers outside Russia; Robokassa — card acquiring for customers paying in Russian roubles;
• hosting and infrastructure providers (ALEXHOST SRL, Romania — servers; Cloudflare — DNS, CDN and protection). Transactional email is sent from our own mail server, not by a third-party email provider.

The complete, current list — who, what they process, where, and on what basis — is published on the Subprocessors page.

We do not sell your personal data and we do not share it with advertisers or data brokers. We may disclose data where the law requires it, for example in response to a valid legal order or to report child-safety violations to the competent authorities.

5. Legal Bases (GDPR)

Where the GDPR applies, we process data to perform our contract with you (Art. 6(1)(b)), for our legitimate interests in security and service improvement (Art. 6(1)(f)), to comply with legal obligations (Art. 6(1)(c)), and with your consent where we ask for it (Art. 6(1)(a)).

6. Your Rights

Access, portability and erasure are self-service: you do not have to write to us and wait.

• Export (portability): Profile → “Data & privacy” → Request an export. We build a ZIP archive containing your account data, stories with their chapters and choices, story memory, comments, reviews, ratings, payment history, consents and settings, in JSON with a documented format_version. The download link is valid for 7 days.
• Deletion: Profile → “Data & privacy” → Delete account. We confirm it is you (password, or a confirmation link by email for accounts without a password), then schedule the deletion with a 7-day cancellation window during which you can restore the account from the link in the confirmation email or by signing in. When the window closes we cancel any active subscription, delete your stories with their chapters, memory and media, anonymize your comments and reviews, and irreversibly anonymize the account itself.
• Correction: name, bio, avatar and interface language in profile settings.
• Objection, restriction, withdrawal of consent, complaints: write to [email protected]; we respond within one month. If you are in the EU/EEA or UK, you may also lodge a complaint with your local supervisory authority.

7. Retention and Transfers

We keep account and content data while your account is active. After deletion we delete or anonymize it within 30 days — in practice at the end of the 7-day cancellation window — except records we must keep for legal, billing, tax or safety reasons: payment records, the credit ledger, moderation decisions and security logs are retained in a form that is no longer linked to an identifiable profile. Data may be processed outside your country; where required, we use appropriate safeguards such as standard contractual clauses.

8. Cookies

Turnleaves uses only essential cookies: a session/authentication cookie and basic preference storage. We use no advertising cookies and no third-party tracking, so we do not show a consent banner for non-essential cookies — there are none.

9. Children

Turnleaves is not directed at children under 16, and we do not knowingly collect their data. If you believe a child is using the service, contact [email protected].

10. Changes

We will announce material changes to this policy by email or in-product notice before they take effect.

← Back to Turnleaves