Privacy policy

1. Who handles your information

SP "Barmagambetov", Kazakhstan, operates Story Not Story and is responsible for the personal information it processes to run the service. For privacy requests, contact zhanibek@mail.ru. Our public business details are on Contact & support. This policy covers the app and our product support; it does not replace the policies of independent services you choose to use.

If you upload information about a client, actor, employee or another person, ensure you have authority and have given any required notice or obtained necessary consent. We process that material to provide your requested features. If your organization requires a data-processing agreement, specific storage location or additional contractual safeguards, contact us before submitting that data; this policy alone does not establish those arrangements.

2. Information we process

• Account information: email, account identifiers, sign-in and security records, optional profile name and username, and records of terms acknowledgement where captured. Authentication providers handle credentials; we do not ask you to send passwords to support.
• Creative material: briefs, audience and production settings, scripts, scenes, shots, character descriptions, reference photographs, brand assets, style choices, generated text and images, editor arrangements, saved project context and original-input snapshots.
• Usage and billing records: model and operation requested, quoted and consumed credits, reservations, timestamps, payment/customer/subscription identifiers, transaction status, plan, billing periods and refund or dispute adjustments.
• Support information: messages, contact details and diagnostic material you choose to share. Remove unrelated client or personal information from screenshots.
• Technical information: IP addresses, browser or device information, request and error details, access logs, session identifiers and functional preferences processed by the app and its hosting, authentication and payment providers. Hosting analytics also reports visited pages, referral sources, approximate visitor country and device type.

3. Where information comes from

Most information comes from you, your use of the app, or someone authorized to act for your account. If you choose Google sign-in, the authentication flow supplies the account information needed to sign you in. Paddle supplies billing events. AI providers return generated results. A connected app can supply or access content when you authorize its permissions.

Please avoid uploading government identity documents, full payment-card details, health records, biometric identification datasets, children’s personal information or other sensitive records into creative prompts or references. A photograph may reveal sensitive characteristics even when you do not describe them in text.

4. Purposes and legal grounds

The applicable legal ground depends on the processing and jurisdiction: consent where required, performing an agreement where recognized, a legal obligation, or legitimate operational interests where that ground is available and does not override your rights. We do not treat acceptance of the Terms or acknowledgement of this notice as unlimited consent. Where separate consent is required, it must cover the relevant purpose and disclosure; you may withdraw it by contacting us, subject to lawful exceptions and the effect on features that need the data.

We do not sell your personal information, operate targeted advertising in this app, or make decisions producing legal or similarly significant effects about you solely from storyboard Outputs. Billing limits and security controls may operate automatically; contact support if you believe a restriction is incorrect.

• Create and secure accounts, save and display projects, perform requested AI operations, deliver exports and provide support.
• Verify paid access, calculate credits, reconcile failed or disputed requests, prevent duplicate funding and investigate billing problems.
• Maintain reliability, understand aggregate website use, investigate errors, prevent abuse or unauthorized access, and comply with lawful requests and recordkeeping duties.
• Communicate about your account, material service changes, payment issues, requests and security incidents where appropriate or required.

5. AI requests and project context

When you request generation, the app sends the information needed for that feature through Lovable’s AI gateway to the configured Google or OpenAI model. This can include your original brief and project defaults, developed story, script, character profiles, neighboring scenes, shot descriptions, style choices, logo, reference photographs, character sheets and existing frames. The context helps continuity; the request is not limited to the last text box you edited.

Generated results are saved to your account when the operation and save complete. Providers may process prompts, image attachments and responses to fulfill the request, operate safeguards and investigate abuse or failures. We do not train our own models on your content or publish your private projects for marketing without separate permission. We do not promise zero provider retention or that every provider has identical contractual settings. Contact us before using the app for work that requires a verified no-training, no-retention or location guarantee.

Authorized administrators can access records when necessary for support, security, service operation or legal compliance. We do not promise that no human can ever access content. We limit the use of that access to legitimate service purposes.

6. Providers and other recipients

Provider notices include Lovable, Supabase, Google and OpenAI. These explain those providers’ practices; linking to them does not replace our responsibilities or grant broader rights in your content.

• Lovable Cloud and Supabase infrastructure support hosting, database storage, authentication and app operations. Lovable’s AI gateway routes requested generations to Google or OpenAI. These providers can receive the account, technical or creative information needed for their role.
• Paddle acts as the payment merchant and handles checkout, receipts, tax, fraud prevention, cancellation and refunds. Payment-card information is entered with Paddle rather than in our project database. We receive transaction and subscription references and results. Paddle determines its own payment-related processing under its Privacy Policy.
• Google Fonts supplies the website’s typography; loading it sends Google the browser/network request information needed to serve fonts. Google sign-in is optional and follows its own authentication disclosures. If an image is displayed from a third-party image address, that host also receives the browser/network request needed to serve it.
• Applications you authorize through the connection consent screen can access the approved account content. Copies you export or share leave our control; recipients are responsible for their own processing.
• Professional advisers or competent authorities may receive information where needed for a lawful obligation, a dispute, fraud prevention or protecting rights. If the business is transferred, relevant records may transfer subject to applicable safeguards and notice requirements.

7. Cookies, browser storage and local drafts

The app uses browser storage for sign-in sessions, theme and language choices, draft recovery and sample-editor changes. Interface components may also use a functional preference cookie. Authentication, hosting and checkout providers can use their own session and security storage. We have not added an advertising SDK to the product. Lovable’s hosting dashboard provides website traffic analytics, including page, source, country and device summaries.

You can manage cookies and site storage in your browser. Blocking necessary storage can prevent sign-in or saving preferences. Clearing local or session storage may permanently remove unsaved drafts and demo edits; it does not delete projects already saved to your account. On a shared device, sign out and remove local drafts you do not want other device users to see.

8. Retention and deletion

Saved account and project content is retained to make your account and work available until you remove it or request account closure, subject to necessary retention. You can delete supported projects, storyboards, scenes and characters in the app. Deleting one item does not necessarily delete independent copies in other projects, local drafts, exports or another recipient’s systems.

Account-wide deletion and a complete personal-data export are handled through support rather than an automated account-deletion button. We verify the request, identify affected records and explain any legal or technical limits. We retain records only for as long as needed for their purpose or applicable law, considering account use, the request, security investigations, outstanding disputes, tax and accounting obligations and limitation periods.

Backups and provider security or operational logs follow their own retention processes and may not disappear immediately when an active record is removed. We do not claim one fixed deletion deadline for every provider or record. We will explain applicable timelines and exceptions when responding to your request and comply with mandatory deadlines. Where a record must remain, its use will be limited to the reason for retention.

9. International processing and security

The main app database is hosted in Seoul, South Korea, as verified on 7 September 2026. The service also uses international authentication, AI and payment providers. Information can be processed outside Kazakhstan or your home country, and the laws there may differ. The project’s hosting region does not necessarily determine where AI, support, payment or security processing takes place. We do not represent that all data stays in Kazakhstan or in any other single jurisdiction.

Applicable localization and cross-border-transfer requirements must be met for the processing concerned. Consent to a transfer does not replace a separate legal storage requirement. Contact us for information about the current arrangements before submitting data subject to location restrictions. This notice is not a certification of compliance for a regulated deployment.

We use account authentication, access controls and encrypted HTTPS connections to protect the service. No internet service or device is completely secure. Protect your credentials, device and exported files, and report suspected exposure promptly. We will address incidents and give notices where required by law.

10. Your choices and privacy rights

Depending on applicable law, you can request information about processing, access and a copy, correction, deletion or blocking, restriction, portability, an objection to certain processing, or withdrawal of consent. Contact zhanibek@mail.ru using your account email and describe what you need. We may request proportionate verification; do not send a password or full identity document unless a necessary, secure verification method has been agreed.

We will respond within the applicable legal period, explain any lawful refusal or retained records, and avoid making you provide information unrelated to the request. Withdrawing consent does not undo earlier lawful processing; it may prevent continued use of a feature that needs the information. You may also complain to the competent data-protection authority or seek judicial protection. Your rights do not depend on maintaining a paid subscription.

The storyboard CSV/JSON export can help you retrieve creative work, but it is not a complete personal-data export. To stop recurring charges, cancel your subscription separately from a privacy or deletion request. Tell support if you need help coordinating both.

11. Children

The service is for adults aged 18 and over. It is not directed to children, and users should not upload children’s personal information. If you believe a child has created an account or their information has been provided improperly, contact us so we can investigate and take appropriate action.

12. Policy updates

We update this notice when relevant practices or legal requirements change. The version and date appear above. We will give additional notice of material changes and obtain fresh consent where required before using information for a new purpose. A revised notice does not retroactively authorize processing that required consent.