Privacy Policy

Last updated: June 12, 2026

At Juan Manuel Cuenca Navarro (hereinafter "we", "our" or "Scriptum"), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website (scriptumwriterstudio.com) and our Scriptum software, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

For any question related to data protection, you may contact us at the email address above.

2. Data we collect

2.1 Data you provide directly

• Registration data: email address and password (stored only as a secure hash, never in plain text).
• Billing data: full name, address, country, postal code. Payment data (credit/debit card) is processed directly by Lemon Squeezy (our Merchant of Record) and never passes through our servers.
• Support data: information you provide when contacting us (email, description of the issue).

2.2 Data we collect automatically

• Server technical data: IP address and access logs, necessary for security and the operation of the service.
• Website usage statistics (only with your consent): if you accept analytical cookies, Google Analytics 4 collects pages visited, visit duration, browser type, operating system, language and interaction data, associated with a random identifier (not your identity). With IP anonymisation. See the Cookie Policy.

2.3 Data we do NOT collect

• We do NOT read or store the content of your novels, chapters or writing projects on our servers: your manuscript is saved locally on your device.
• We do NOT use your creative content to train AI models, either our own or third-party ones.
• We do NOT store credit card data on our servers.
• The writing application does NOT contain analytics or advertising tools: your writing activity is not measured or tracked.

3. Legal basis for processing (GDPR Art. 6)

We do not send commercial communications or newsletters. Should we ever do so in the future, it would only be with your prior and express consent (Art. 6.1.a GDPR and Art. 21 of the Spanish LSSI-CE), with the option to unsubscribe at any time.

4. Purposes of processing

• Create and manage your Scriptum user account.
• Process and manage your subscription and associated payments.
• Provide you with access to the software and its features, including the AI assistant.
• Send you operational communications about your account (confirmations, receipts, password resets, service changes).
• Respond to your enquiries and support requests.
• Improve our website through aggregated statistics (only if you consent to analytical cookies).
• Comply with applicable legal and tax obligations.
• Prevent fraud and ensure platform security.

5. Sharing data with third parties

We share your personal data only with the following recipients and solely for the purposes indicated. Our processors and sub-processors are exclusively:

AI providers (BYOK model — third parties contracted by you): when you use Aura AI, Scriptum operates in BYOK mode: it is you who provides your own key from an AI provider (OpenAI, Google Gemini, Groq or OpenRouter; Anthropic/Claude or local models in the desktop version). Those providers are independent third parties with whom you hold the contractual and processing relationship, in accordance with the terms you accepted with them. In the web version, Scriptum acts merely as a technical conduit: it forwards your request to the provider you choose using your key, without storing the key or the content of the request.

We do NOT sell, rent or otherwise transfer your personal data to third parties for commercial or marketing purposes.

6. International data transfers

Some of our providers are located in the United States. These transfers are protected by:

• EU-U.S. Data Privacy Framework (DPF): Lemon Squeezy and Google LLC are certified under the DPF, recognised by the European Commission's Adequacy Decision of 10 July 2023.
• UK Extension to the EU-U.S. DPF ("UK-US Data Bridge"): for transfers of UK residents' personal data to the United States, the UK Extension to the Data Privacy Framework (in force since 12 October 2023) applies to DPF-certified providers; where a provider is not certified, the UK International Data Transfer Agreement (IDTA) or Addendum applies.

AI providers (BYOK): international transfers arising from the use of the AI providers (OpenAI, Google Gemini, Groq, OpenRouter, Anthropic) are governed by the contract you, as a user, hold directly with each provider under the BYOK model, and not by Scriptum's transfer mechanisms.

Hostinger operates within the European Union (Lithuania).

7. Data retention

Once these periods have elapsed, data will be securely deleted or irreversibly anonymised.

8. Your rights

8.1 Rights under the GDPR (European Union / EEA)

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data ("right to be forgotten").
• Restriction: restrict the processing of your data in certain circumstances.
• Portability: receive your data in a structured and commonly used format (JSON or CSV).
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: withdraw at any time the consent previously given (e.g. analytical cookies, via the "🍪 Cookies" button or the settings panel), without affecting the lawfulness of prior processing.

8.2 Rights under the CCPA/CPRA (California, USA)

• Know: what personal data we collect, use and share.
• Delete: request the deletion of your personal data.
• Correct: request the correction of inaccurate data.
• Non-discrimination: not be discriminated against for exercising your privacy rights.
• Opt-out of sale or sharing: we do not sell or share your personal data within the meaning of the CCPA/CPRA. If this were to change, we would provide an opt-out mechanism.

Categories of personal information collected (CCPA/CPRA §1798.140): identifiers (name, email address); commercial information (subscription status and purchase history, processed by Lemon Squeezy as Merchant of Record); internet or other electronic network activity (aggregated usage statistics, collected only if you accept analytics cookies). We do not collect sensitive personal information in order to infer characteristics about you.

Your Privacy Choices — Do Not Sell or Share My Personal Information: we do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as defined by the CPRA. Our analytics operate with Google Consent Mode signals set to deny advertising storage and ad personalisation, and load only after you consent. To exercise any California privacy right, email contacto@scriptumwriterstudio.com with the subject "California Privacy", or use the "🍪 Cookies" button to manage analytics at any time.

8.3 Rights under the LGPD (Brazil)

If you reside in Brazil, you have rights similar to those under the GDPR, including confirmation of processing, access, correction, anonymisation, portability and deletion.

8.4 How to exercise your rights

Send an email to contacto@scriptumwriterstudio.com with the subject "Privacy Rights" stating:

• Your full name and the email address associated with the account.
• The right you wish to exercise.
• Sufficient information to verify your identity (we will only request additional documentation if there is reasonable doubt about your identity).

We will respond to your request within a maximum of one month of receipt (extendable by two further months in complex cases, in which case we will notify you), in accordance with Art. 12.3 GDPR.

9. Protection of minors

Scriptum is not directed at persons under 16 years of age (or the minimum age established by local legislation; in Spain, 14 years for consent to data processing). We do not intentionally collect data from minors. If we discover that we have collected data from a minor without their legal guardian's consent, we will delete such data immediately. Subscribing requires legal capacity to enter into a contract.

10. Data security

• Encryption in transit (TLS/HTTPS) for all communications.
• Passwords stored with a high-cost secure hash (bcrypt), never in plain text.
• Session cookie with HttpOnly, Secure and SameSite attributes (not accessible from JavaScript).
• Restricted access to personal data (principle of least privilege).
• Payment processing delegated to Lemon Squeezy (Merchant of Record with PCI DSS compliance).
• Encrypted backups.

However, no electronic transmission or storage system is 100% secure. We cannot guarantee the absolute security of your data.

11. Security breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) within a maximum of 72 hours of becoming aware of it (Art. 33 GDPR) and, when the risk is high, we will inform you directly and without undue delay (Art. 34 GDPR), indicating the measures taken.

12. Changes to this policy

We reserve the right to amend this Privacy Policy. Changes will be published on this page with the corresponding update date. For significant changes, we will notify you by email.

13. Supervisory authority

If you consider that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority:

• Spain: Spanish Data Protection Agency (AEPD): www.aepd.es — C/ Jorge Juan, 6, 28001 Madrid.
• Other EU countries: the data protection authority of your country of residence.
• United Kingdom (UK GDPR): Information Commissioner's Office (ICO): ico.org.uk.

14. Contact

For any enquiry about this Privacy Policy:

Email: contacto@scriptumwriterstudio.com
Subject: Privacy: Scriptum
Postal address: Calle la Cruz, 26 — 12590 Almenara (Castellón), Spain