Privacy Policy

1. Scope and controller

This Privacy Policy applies to the CardDrama website, application, APIs, and related services (collectively, the “Service”). The data controller is Felix, an individual operating CardDrama (“CardDrama,” “we,” “us,” or “our”). CardDrama is not represented as a corporation or other registered legal entity.

CardDrama is a production workspace for serialized visual stories. It helps users structure screenplays into characters, scenes, shots, continuity data, and generation instructions.

2. Information we collect

Information you provide

• Account information: email address, display name, account identifiers, and authentication records.
• Project content: series titles, screenplays, character descriptions, scene and shot data, prompts, continuity notes, and edits you save.
• Support information: messages and materials you send when asking for help or exercising a legal right.
• Billing information: plan, credits, transaction status, and subscription records. A payment processor, when enabled, handles card or payment-account details; CardDrama does not intend to store full card numbers.

Information collected automatically

• Usage and device data: IP address, browser type, device and operating-system information, timestamps, pages and features used, and diagnostic logs.
• Service records: AI job status, model/provider selection, credit reservations and settlements, exports, errors, and security events.
• Necessary cookies: authentication and security cookies required to keep you signed in and operate the Service.

Please do not submit government identifiers, payment-card data, health records, or other highly sensitive personal information in a screenplay or prompt unless it is necessary, lawful, and you have the right to do so.

3. How we use information and our legal bases

• Provide accounts, projects, screenplay analysis, continuity tools, exports, and customer support.
• Process requests, allocate credits, maintain subscriptions, and prevent duplicate charges.
• Secure the Service, prevent abuse, investigate errors, and enforce our Terms.
• Understand aggregate product performance and improve reliability and usability.
• Meet legal, tax, accounting, sanctions, and regulatory obligations.

Where applicable, we rely on performance of a contract to provide the Service, legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where the law requires it. You may withdraw consent at any time, without affecting processing already completed.

4. AI processing and user content

When you request screenplay analysis or related AI features, CardDrama sends the content needed for that request through OpenRouter to an upstream AI model provider. The currently configured models are MiniMax M3 and DeepSeek V4 Flash. The transmitted content may include screenplay text, character descriptions, scene context, target-model preferences, and structured instructions.

AI output can be inaccurate or incomplete. We store the resulting structured production data in your workspace so you can review, edit, lock, and export it. CardDrama does not use AI output to make decisions that produce legal or similarly significant effects about individuals.

We do not use your private project content to train CardDrama-owned general-purpose AI models. Third-party AI providers process content under their own infrastructure and contractual terms; their processing location and limited operational retention may differ from ours.

5. How we share information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We may disclose information to:

• Cloud and database providers that provide authentication, database, storage, hosting, email delivery, logging, and security.
• AI routing and model providers, including OpenRouter and the upstream providers serving MiniMax or DeepSeek models, that process screenplay-analysis and production-recipe requests.
• Payment providers that process subscriptions, purchases, refunds, fraud checks, and tax-related information when payments are enabled.
• Professional advisers and authorities when reasonably necessary for legal compliance, safety, fraud prevention, or the establishment or defense of legal claims.
• A successor organization in connection with a merger, financing, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality protections.

Service providers may access information only to perform services for us or as otherwise permitted by their agreements and applicable law.

Current and planned service providers

• Supabase: account authentication, PostgreSQL database, and file storage. The primary CardDrama project is configured in Singapore.
• Vercel: application hosting, edge delivery, and operational request logs, which may be processed in the United States and other Vercel regions.
• Resend: delivery of account authentication and service emails.
• OpenRouter, MiniMax, and DeepSeek: AI request routing and inference for features you explicitly run.
• Dodo Payments: checkout, subscription, fraud, and payment records when paid plans are enabled. CardDrama does not receive full payment-card numbers.
• Sentry and PostHog: optional error monitoring and consent-based product analytics when configured. Analytics is disabled unless you choose “Allow analytics.”

Some planned providers may remain disabled during beta. We update this list when a material processor is enabled or replaced.

6. International data transfers

CardDrama is an online service and its providers may process information in Singapore, China, the United States, and other countries. Those countries may have privacy laws different from those where you live.

Where required, we use lawful transfer mechanisms and contractual or organizational safeguards designed to protect transferred personal information. Contact us if you want more information about safeguards relevant to your data.

7. Data retention

We keep account and project information while your account is active. After you delete a project or account, we aim to remove live application copies promptly and ordinarily within 30 days, unless retention is required for security, fraud prevention, legal compliance, accounting, or legal claims.

• Protected backups: residual copies may remain until the relevant backup is overwritten, ordinarily no longer than 90 days.
• Security and operational logs: ordinarily retained for up to 90 days, but a specific incident record may be retained longer when reasonably necessary to investigate abuse or defend a legal claim.
• AI request data: structured results remain with the project. Temporary provider-side request retention is controlled by the AI provider's applicable terms and settings.
• Billing and tax records: may be retained for the period required by applicable accounting, tax, payment-dispute, or anti-fraud laws.

Deletion from backups may occur through normal backup rotation rather than immediate item-level removal. Restored backups are subject to the original deletion request.

8. Security

We use administrative, technical, and organizational safeguards intended to protect information, including access controls, encrypted network transport, database authorization policies, server-side secrets, and restricted administrative access. No system is completely secure, so we cannot guarantee absolute security.

9. Your privacy rights

Depending on where you live, you may have the right to request access, correction, deletion, restriction, objection, or a portable copy of personal information. You may also withdraw consent and complain to a data-protection authority.

Send requests to y2361222101@outlook.com. We may need to verify your identity and may retain information where an exception or legal obligation applies. Authorized agents may submit requests where local law permits.

10. California privacy disclosures

In the preceding 12 months, CardDrama may have collected the categories described above: identifiers, internet or electronic activity, commercial and subscription records, user-created content, and inferences represented by structured project data. We collect these categories from you, your use of the Service, and our service providers for the business purposes described in this Policy.

We do not sell personal information and do not share it for cross-context behavioral advertising. If the California Consumer Privacy Act applies to us, California residents may request to know, access, delete, or correct covered information and may exercise applicable opt-out and non-discrimination rights by contacting us.

11. Cookies and similar technologies

CardDrama uses cookies and local browser mechanisms that are necessary for authentication, session continuity, security, and core application preferences. Optional PostHog analytics is initialized only after you choose “Allow analytics”; your choice is saved in local storage. We do not use third-party advertising cookies or sell data for advertising.

12. Children

The Service is not directed to children under 13, and users under 13 may not create an account or use the Service. We do not knowingly collect personal information from children under 13. Users between 13 and the age of legal majority where they live may use the Service only with permission and supervision from a parent or legal guardian. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it where required.

13. Changes to this Policy

We may update this Policy as the Service or law changes. We will post the revised version here and change the effective date. If a change materially affects your rights, we will provide additional notice where required.

14. Contact us

Questions, complaints, and privacy-rights requests may be sent to: