Privacy Policy

Account Information

• Email address (required for account creation and communication)
• Username (chosen by you for identification within the service)
• Password (encrypted and stored securely)
• Profile information if you choose to add it

Google Sign-In Data

If you choose to sign up using Google, we may receive:

• Your Google account email address
• Your Google profile name
• Your Google profile picture (if you've set one)

Campaign and Usage Data

• Campaign content you create (characters, locations, notes, etc.)
• Files you upload to your campaigns
• Conversation history with our AI assistant
• Usage patterns and feature interactions (to improve our service)

Technical Information

• IP address and location data (for security and service delivery)
• Browser type and version
• Device information (for compatibility and support)
• Essential cookies for authentication and service functionality

Discord Integration Data

If you connect a Discord server to a campaign, we collect and store:

• Your Discord server (guild) ID and the IDs and names of the channels, including threads, you choose to connect
• Your Discord user ID and username, so we can identify who set up the connection
• The date and time we last read a connected channel

We do not store the content of any Discord message. When the Campaign Assistant needs context from a connected channel, we fetch recent messages directly from Discord at the moment you ask a question, pass them to our AI provider to generate a response, and then discard them. Nothing is written to our database, search index, or any cache. One exception: a Discord thread's name often echoes the message that started it, so we retain that name as part of the connection record, even though the thread's messages themselves are never stored.

This means we read messages posted by everyone in a connected channel, not just you. Anyone who posts in a channel you connect, including players who have never signed up for ScriptoriumGM, has their messages read on the same basis, obtained from Discord at your direction when you chose to connect the channel. See Discord Channel Grounding below for the full explanation and the rights available to people whose messages we read this way.

Service Provision (Legitimate Interest)

• Provide access to ScriptoriumGM's campaign management features
• Process AI assistant requests and generate content
• Store and organize your campaign data
• Ensure service security and prevent fraud
• Provide technical support when needed

Service Improvement (Legitimate Interest)

• Analyze usage patterns to improve features and performance
• Develop new features based on user needs
• Troubleshoot technical issues
• Ensure platform stability and performance

Communication (Consent/Legitimate Interest)

• Send essential service communications (with legitimate interest)
• Send marketing emails about ScriptoriumGM (with your consent)
• Respond to your support requests and inquiries
• Notify you of important updates or security issues

Discord Channel Grounding (Legitimate Interest / Contract Performance)

• Read connected Discord channels, at the moment you ask, to give the Campaign Assistant context about what's happening in your game
• Never store, retrain, or reuse Discord message content beyond that single response
• See Discord Channel Grounding below for the full explanation and the rights available to people whose messages are read this way

To provide ScriptoriumGM's services, we work with carefully selected third-party service providers. Some of these providers are based in the United States and other countries outside the UK. Where we transfer personal data, including Discord channel content processed under "Discord Channel Grounding" above, to our AI Provider(s), see Current AI Sub-processor below for who that is today and the specific transfer mechanism in place. We ensure equivalent appropriate safeguards are in place for all other international data transfers in accordance with UK GDPR requirements.

You have the following rights regarding your personal data:

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access, in accordance with Article 32 of the UK General Data Protection Regulation:

• All data transmission is encrypted using industry-standard TLS
• Passwords are securely hashed and never stored in plain text
• We use reputable cloud providers with strong security credentials
• Regular security assessments and updates
• Limited access controls for our systems

Data Isolation and Separation

Your uploaded documents, vector embeddings, and conversation history are stored in isolated, per-user data partitions. We implement technical controls to prevent your content from being accessed by or disclosed to other users of the Service. Our vector database stores your document embeddings in namespaced partitions indexed to your user account. Only your account can query your namespace.

Contact Us

To exercise your rights or if you have questions about this Privacy Policy, contact us at:

support@scriptoriumgm.com

We will respond to your request within 30 days.

If you don't have a ScriptoriumGM account

You don't need one to reach us about your Discord messages; see Discord Channel Grounding above.

Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):