Data Protection Policy - WorldKonstruct

Data Protection Policy

Last Updated: April 11, 2026

Introduction

At WorldKonstruct, we are committed to protecting the personal data of our users. This Data Protection Policy explains how we collect, process, and safeguard your data in compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Data Controller

For the purposes of applicable data protection laws, WorldKonstruct is the data controller for personal information collected through our Google Docs add-on.

What Personal Data We Process

We collect and process the minimum amount of personal data necessary to provide our services:

  • Google Email Address: Your primary Google account email address, used solely to identify you as a user and verify your licence status (FREE or PRO). This is transmitted to our backend database (Supabase) for licence verification.
  • Story Bible Entries: Names, types, descriptions, relationships, and other metadata for your characters, locations, objects, factions, worldbuilding elements, and events. These are stored within Google's infrastructure using PropertiesService (scoped to the document) and synced to a linked Google Sheet in your Google Drive (one tab per user-facing entry type, plus relationship and metadata tabs).
  • @Mention and Link Data: Records of how entries are cross-referenced within your manuscript, enabling bi-directional navigation and rename propagation.
  • Document Content (for AI Features): When you use AI-powered features — Document Scanning, AI Enhance, Enrich All, or Dramatica Archetype Analysis — relevant text (manuscript excerpts, entry names, or context) is sent to AI services for processing. By default, all AI requests are sent directly to Google's Gemini API (Flash 2.5 / Pro, paid commercial tier). If you use BYOK (Bring Your Own Key) with an Anthropic or OpenRouter key, supported requests may be routed to Anthropic's Claude or through OpenRouter instead. WorldKonstruct does not store your manuscript text or AI inputs beyond the active processing session.
  • Sidebar Preferences: Settings such as your view mode, display density, sort preferences, pinned entries, and other UI customisation options.
  • AI Usage Data: Records of AI actions (scans, enhancements, enrich-all runs, and reports) including action counts and timestamps — stored in our backend database (Supabase) for quota management and usage analytics. These are linked to your email address but do not contain any document content.
  • Payment Information: If you purchase Pro (a one-time lifetime purchase), your payment is processed by LemonSqueezy. We do not directly handle or store your payment card details — LemonSqueezy processes the transaction and shares your email with our backend to activate your Pro licence.
  • OpenRouter API Key (BYOK): If you are a Pro user and choose to bring your own API key (Google Gemini, Anthropic Claude, or OpenRouter), that key is stored in your Google Account's PropertiesService. It is never sent to our servers — it is transmitted directly from the add-on to the AI provider over HTTPS.
  • Imported Data: If you import data from Notion, Scrivener, or Obsidian, the uploaded zip file is processed client-side to extract entries, images, and relationships. The import archive is processed in-memory and is not stored on our servers. Extracted entries are saved to your story bible in PropertiesService and your linked Google Sheet.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Performance of a Contract: Processing necessary for the performance of our agreement with you to provide the WorldKonstruct service — including storing your story bible data, processing @mentions, and enabling document scanning.
  • Legitimate Interests: Processing necessary for our legitimate interests, such as to improve and optimize our service, provided these interests are not overridden by your rights.
  • Consent: Where applicable, we process data based on your explicit consent — for example, when you choose to initiate an AI document scan.
  • Legal Obligation: Processing necessary to comply with our legal obligations.

How We Use Your Data

We use your personal data only for specific, explicit purposes:

  • To provide and maintain your story bible, including creating/editing entries, resolving @mentions, tracking relationships (14 bidirectional relationship types), and propagating renames across your manuscript
  • To enable AI-powered features: Document Scanning (entity extraction with 6 parallel prompts and delta resync), AI Enhance (enriching entries from manuscript context), Enrich All (populating empty fields in bulk), and Dramatica Archetype Analysis (character arc and theme reports)
  • To verify your licence status (FREE or PRO) and enforce usage quotas
  • To sync story bible data to a linked Google Sheet in your own Google Drive (one tab per entry type)
  • To import story bible data from external tools (Notion, Scrivener, Obsidian)
  • To export your story bible in JSON, Markdown (ZIP), or premium HTML formats
  • To personalise your sidebar experience and remember your display preferences
  • To process your Pro purchase via LemonSqueezy (one-time lifetime payment)
  • To improve our service based on anonymous usage patterns
  • To communicate with you regarding service updates or inquiries

Data Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage:

  • Document-Scoped Storage: Story bible entries are stored per-document using Google's PropertiesService, meaning each document's data is isolated and accessible only within that document
  • Google Infrastructure: All server-side data is stored within the secure Google Workspace environment and protected by Google's enterprise-grade security
  • Limited Access: Only authorized personnel have access to systems where data is processed
  • Encryption: Data is encrypted during transmission via HTTPS/TLS
  • Client-Side Caching: Local cache data (localStorage/IndexedDB) remains on your device and can be cleared at any time via the add-on's settings or your browser
  • Regular Assessments: We conduct regular assessments of our data protection measures

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Story Bible Entries: Persists with the Google Document and linked Google Sheet. Deleting entries removes them from PropertiesService and the Sheet. Deleting the document removes all associated data from PropertiesService; Sheet data persists in your Google Drive until you delete it.
  • Linked Sheet Data: Persists in your Google Sheet until you delete it. Sheet data is owned by you and follows Google Drive's retention policies.
  • Sidebar Cache: localStorage and IndexedDB cache can be cleared via the "Clear Cache" option or by uninstalling the add-on. Browser data follows your browser's storage policies.
  • AI Usage Data: Usage records (action counts, timestamps) linked to your email are retained in Supabase for quota enforcement and service improvement. These do not contain document content.
  • Licence & Payment Records: Your licence status is retained in Supabase indefinitely to verify your Pro access (since Pro is a one-time lifetime purchase). Purchase records are retained by LemonSqueezy in accordance with their retention policies and applicable tax and accounting laws.
  • BYOK API Key: If you bring your own API key (Google Gemini, Anthropic Claude, or OpenRouter), it is stored in your Google Account's PropertiesService and is removed when you clear it from settings or uninstall the add-on.

International Data Transfers

As a Google Docs add-on, your story bible data is stored within Google's infrastructure and may be transferred to various Google data centres around the world. Google maintains compliance with international data transfer requirements.

When you use AI features, data may be processed by the following services:

  • Google Gemini API (Flash 2.5 / Pro) — the primary AI provider for all included-credit features: Document Scanning, entity extraction, validation, AI Enhance, Enrich All, and Dramatica Analysis. All requests go directly to Google's Gemini API (paid commercial tier — no model training on API data). Operates within Google Cloud's infrastructure.
  • Anthropic Claude (BYOK only) — if you bring your own Anthropic API key (sk-ant-*), supported AI requests are sent directly to Anthropic's API (Claude Sonnet 4.6, Haiku 4.5). Anthropic does not train on API data.
  • OpenRouter (BYOK only) — if you bring your own OpenRouter API key (sk-or-*), requests are routed through OpenRouter to your chosen model. OpenRouter is based in the United States. WorldKonstruct's own infrastructure never routes through OpenRouter.
  • Supabase — for licence verification and AI usage tracking. Supabase infrastructure is hosted on AWS.
  • LemonSqueezy — for payment processing (Pro purchases only).

In all cases, only the minimum data necessary for the specific function is transmitted, and no document content is stored by any third party beyond the active processing session.

Your Data Protection Rights

Depending on your location, you have the following rights:

For Users in the European Economic Area (EEA), UK, and Similar Jurisdictions:

  • Right to Access: You have the right to request copies of your personal data. You can view all your story bible data directly in the sidebar and export it at any time.
  • Right to Rectification: You have the right to request that we correct inaccurate information. You can edit any story bible entry directly in the add-on.
  • Right to Erasure: You have the right to request that we delete your data. You can delete individual entries, clear your entire story bible, or uninstall the add-on to remove all data.
  • Right to Restrict Processing: You have the right to request that we restrict the processing of your data.
  • Right to Data Portability: You have the right to request that we transfer your data to another organization or directly to you. WorldKonstruct's export feature (Markdown, Sheets sync) enables you to take your data with you.
  • Right to Object: You have the right to object to our processing of your personal data.
  • Rights Related to Automated Decision Making: You have rights related to automated decision making and profiling. AI Document Scan results are always presented for your review before being added to your story bible — no automated decisions are made without your confirmation.

For California Residents:

  • Right to Know: You have the right to request information about the personal information we collect and how it is used.
  • Right to Delete: You have the right to request deletion of your personal information.
  • Right to Opt-Out: You have the right to opt-out of the sale of your personal information. WorldKonstruct does not sell your personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, please contact us at privacy@wordfokus.com. We will respond to your request within the timeframe required by applicable law.

Data Breach Notification

In the event of a data breach that affects your personal data, we will notify you and the relevant supervisory authority in accordance with applicable law.

Children's Data

Our services are not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete such information.

Changes to This Policy

We may update this Data Protection Policy from time to time. We will notify you of any changes by posting the new policy on our website and updating the "Last Updated" date. You are advised to review this policy periodically for any changes.

Data Protection Officer

While we do not formally appoint a Data Protection Officer, privacy inquiries can be directed to:

Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with your local data protection authority.