1. Data Controller

The data controller responsible for your personal data is:

Narrative AB
Grevgatan 67
Stockholm, 114 59
Sweden
Email: support@your-saga.com

2. Personal Data We Collect

We collect the following categories of personal data:

• Account data: Name and email address provided during registration.
• Interview content: Voice recordings (audio files), transcriptions of spoken content, and written responses submitted during interviews.
• Photos: Images you voluntarily upload to your story chapters.
• Generated content: AI-generated story chapters derived from your interview responses.
• Usage data: Log data including IP address, browser type, and interaction events, collected automatically when you use the service.
• Payment data: Payment transaction records processed through Stripe. We do not store full card details.

3. Purposes and Legal Bases for Processing

Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. AI and Automated Processing Transparency

Saga uses AI models (including those provided by OpenAI and Anthropic) to generate interview questions and transform your spoken and written responses into story chapters. This involves:

• Sending your transcribed interview content to third-party AI providers for processing.
• Generating narrative text from your responses.

No automated decisions with legal or similarly significant effects are made about you based solely on automated processing. A human (you) always reviews and approves the generated content before it is finalised or printed.

5. Data Sharing and Third Parties

We share data with the following categories of third-party processors:

• OpenAI / Anthropic: AI-generated question and story content processing.
• ElevenLabs: Text-to-speech audio generation.
• Deepgram / AssemblyAI: Speech-to-text transcription.
• Google Cloud Storage: Secure storage of audio files and photos.
• Stripe: Payment processing.
• Resend: Transactional email delivery.
• MongoDB Atlas / Heroku: Database hosting and application infrastructure.

All processors are engaged under data processing agreements. We do not sell your personal data to third parties, and we do not share your data for advertising purposes.

6. International Data Transfers

Some of our third-party processors are located outside the EEA or UK, including in the United States. Where we transfer personal data outside these regions, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO, or reliance on adequacy decisions where applicable.

You may request more information about the safeguards in place for international transfers by contacting us at support@your-saga.com.

7. Data Retention

• Account data: Retained for as long as your account is active, and for up to 3 years after account deletion for legal and compliance purposes.
• Interview recordings and transcripts: Retained until you revoke recording consent or delete your account, whichever comes first.
• Generated story content: Retained until you delete your project or account.
• Payment records: Retained for 7 years to comply with Swedish accounting laws.

When data is no longer needed, it is securely deleted or anonymised.

8. Children’s Data

Saga is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete it.

9. Your Rights Under GDPR and UK GDPR

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (“right to be forgotten”).
• Right to restriction: Request that we limit how we process your data.
• Right to data portability: Receive your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is consent-based.

To exercise any of these rights, contact us at support@your-saga.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority. In Sweden, this is the Integritetsskyddsmyndigheten (IMY) at www.imy.se. In the UK, this is the Information Commissioner’s Office (ICO) at www.ico.org.uk.

10. Cookies and Tracking

Saga uses only essential session cookies required for authentication and service functionality. We do not use advertising cookies, tracking pixels, or third-party analytics that identify individual users. No cookie consent banner is required for essential cookies under ePrivacy rules. See our Cookie Policy for full details.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS) and at rest.
• Access controls limiting who can access personal data.
• Secure cloud infrastructure with regular security reviews.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected individuals without undue delay.

12. Data About Other People

If you use Saga to record or describe stories involving other people (e.g., family members), you are responsible for ensuring that you have a lawful basis to share their information. We recommend informing any individuals mentioned in your stories that their information may be included.

13. Automated Decision-Making

We do not make any decisions about you that produce legal effects or similarly significant impacts based solely on automated processing, including profiling, as defined in Article 22 of the GDPR.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice on the platform. We encourage you to review this policy periodically. Continued use of Saga after changes constitutes acceptance of the updated policy.