1. Who we are

1.1 The controller of your data is NovelLab.ai LLC, a Wyoming (USA) limited liability company, trading as NovelLab Studio.

1.2 Privacy contact: legal@novellab.ai.

1.3 If operation of the Service moves to a Saudi affiliate of ours, we will update this policy and tell you 30 days in advance.

2. The short version

We do not sell your data. We do not give sponsors or partners personal data.

3. What we collect

3.1 When you browse without an account

• A random viewer ID generated by your browser or the app, not derived from any device identifier. We use it to count views and votes without double-counting. We store it hashed.
• Playback analytics: the work and episode; the format (video, webtoon, audio or text); your position; seconds watched; whether you finished; the surface (web, iOS or Android); and the partner link code, if any.
• General usage events with no personal data, such as opening a series page or tapping Share.
• Technical data: IP address, browser and device type, used for security, abuse prevention and running the Service.
• A partner link code, if you arrived through a partner link (§11).

3.2 When you create an account

• Email address, username and sign-in method (Google, Apple, email link or password). Passwords are stored as a BCrypt hash that we cannot read.
• If you sign in with Google or Apple: the name and email the provider shares with us. Apple may give us a private relay email.
• Your interface language, and records of your acceptance of the Terms and this policy (version, time and IP address).
• Your IP address at registration and an approximate location (country, region and city) that we derive from it through a geolocation provider. This is not precise location or GPS. We use it for security, fraud prevention and aggregate statistics.

3.3 Your viewer activity

• Series you follow, «ذكّرني» reminders, favourites, and your watching and reading progress.
• Your poll votes, with the partner link code if there was one.
• Comments, reviews, ratings, reactions and reports you send.
• Your push-notification token, if you allow notifications, and the notifications we sent you.

3.4 "Talk to the character"

We keep your conversations with characters in your account so they can continue. The conversation text is sent to a language-model provider to generate replies (§7). You can delete any conversation at any time. Without an account, the conversation is not kept after your session, and we store only a hashed IP address to apply usage limits.

3.5 Kids profiles

Display name, age band, avatar, an optional screen-time limit, and the parent's PIN as a hash. Nothing is collected from the child. Details are in the Kids Privacy Notice.

3.6 Messages to us

The content of support messages, privacy requests and reports, and anything you attach.

3.7 Former creator accounts

• Stories, drafts, characters, images and audio created before 3 October 2026 were deleted on that date (Terms §12.6).
• We keep a log of payment events (identifiers, amounts and dates) for 7 years for accounting and tax purposes, even if you delete your account. Gem-usage details and refund requests are deleted with your account.
• Stripe, our payment processor, holds your card details. We never stored them.

3.8 Studio team, collaborators, partners and sponsor reviewers

• Studio members and collaborators: name and role, shown in a work's credits and authorship ledger, plus sign-off records in the production workflow.
• Celebrity partners: name, public handles, contact details, the intro clips they upload themselves, and aggregate performance numbers.
• Sponsor reviewers: the name the reviewer types, their decisions, and their comments on the review link.
• Separate contracts also govern this data.

3.9 Private screenings

Viewers of private screenings (invitation links) are anonymous. We record a hashed browser ID, a coarse device class, how far they watched, and an optional answer to a short question.

3.10 Analytics and advertising cookies

These load only after you consent. See §11.

4. Why we use your data, and our legal basis

We do not make automated decisions with legal effects on you. We do not build advertising profiles. We do not knowingly process sensitive data.

5. Playback analytics and sponsor reports

5.1 We measure views, unique viewers, watch hours, completion, the retention curve (when people stop watching), votes, clicks on sponsor calls to action, and QR scans.

5.2 Sponsors receive aggregate numbers and rates only, never lists of viewers or their identifiers.

5.3 A sponsor report may include a summary of how public comments feel, with short quotes without usernames.

5.4 Partners see only the aggregate numbers for their own links: clicks, views and votes.

6. Who we share data with

6.1 Service providers that process data on our behalf and on our instructions:

6.2 Analytics and advertising partners receive usage and device data only after your consent: Google (Analytics and Ads), Meta and TikTok. They may use it for their own purposes as independent controllers. They never receive your account content or comments.

6.3 Sponsors and partners: aggregate numbers only (§5).

6.4 The public: your username and the comments and reviews you post are visible to others.

6.5 Authorities: where the law requires it or a valid legal request is made, or to protect rights and safety. We will tell you where the law allows.

6.6 Business transfer: to an affiliate, including the planned Saudi company, or to a buyer, with prior notice to you.

6.7 Training: we do not use your data to train AI models. Each AI provider's own terms govern how it handles the data we send it.

7. AI and your data

• "Talk to the character": your conversation text is sent to a language model to generate replies. Do not share sensitive information in it.
• Analysis of public comments: a language model may read the public comments on a work to summarise reactions in an aggregate report. Usernames are removed from any quote.
• We do not use your data to train AI models.
• AI never decides to suspend your account.

8. Where data is stored, and transfers

8.1 Our servers are in the United States (Azure, Central US region). If you use the Service from Saudi Arabia or elsewhere, your data is transferred to the United States.

9. How long we keep data

10. Your rights and how to use them

10.1 You have the right to be informed about how your data is processed, to access it, to get a copy in a readable format, to correct it, to have it deleted or destroyed, to withdraw consent, and to object to processing based on legitimate interest. These rights come from Saudi Arabia's Personal Data Protection Law (PDPL), the EU General Data Protection Regulation (GDPR), California law (CCPA/CPRA) and other laws.

10.2 Yourself: download your data from Settings → Privacy → Download my data, or delete your account in Settings.

10.3 By email: write to legal@novellab.ai from your account email. We reply within 30 days, and may extend once where the law allows, telling you why.

10.4 We will not treat you differently for using your rights.

10.5 You may complain to the competent authority: in Saudi Arabia, the Saudi Data & AI Authority (SDAIA); in Europe, your local data-protection authority.

10.6 "Do Not Sell or Share": we do not sell your data. You can stop advertising data-sharing through the "Cookie Preferences" link in the site footer, or by turning on Global Privacy Control in your browser.

11. Cookies and local storage

• Consent: analytics and advertising tools load only after you choose "Accept all", in every country. Change your choice any time from "Cookie Preferences" in the footer.
• Global Privacy Control: if your browser sends this signal, we treat it as an automatic refusal.
• Kids pages: analytics and advertising tools never load there, and no consent banner appears.

12. Children

12.1 Accounts are for people aged 13 and over. Children under 13 watch only through the Kids section of a parent's account.

12.2 We do not knowingly collect personal data from children. If we learn that a child under 13 has an account, we delete it.

12.3 Details of the Kids section are in the Kids Privacy Notice.

13. Security

• Encryption in transit (HTTPS) and at rest (Azure default encryption).
• Passwords, parent PINs and review links are stored as hashes.
• Staff access is role-based and need-to-know.
• No system is perfectly secure.

14. Data incidents

If an incident affects your personal data, we will notify the competent authorities within the legal deadlines, including SDAIA within 72 hours where the PDPL requires it. We will tell you without undue delay if the incident could harm you.

15. Changes

We will tell you about any material change at least 30 days before it takes effect, by email or in the Service.

16. Contact

legal@novellab.ai

NovelLab.ai LLC, c/o FBRA LLC (Registered Agent), 1023 E Lincolnway, Cheyenne, WY 82001, United States.