Legal
Last updated: July 31, 2026
Novelmint is a product of TeamLesh LLC, a Washington State corporation.
This Privacy Policy describes how TeamLesh LLC (operating Novelmint) collects, uses, and protects your personal information.
Account data: name, email, and hashed password; profile information you choose to provide. Usage data: pages visited, pipeline stages completed, credit balance and transaction history, reading history and chapter unlock records. Payment data: processed by Stripe — we do not store full card numbers. AI Pipeline data: story inputs are transmitted to a model provider for prose generation (see AI Inputs and Model Providers below). Conversation data: your interactions with our AI features — the interactive character chat (the messages you send and the AI character responses you receive) and the AI writing assistant (the prompts, instructions, and messages you exchange with it while building or editing your work). Technical data: IP address, browser type, session cookies, and anonymized Vercel Analytics.
We use your data to: provide, operate, maintain, secure, and debug the Service, including having authorized personnel access and review your conversation, pipeline, and generation logs to investigate, diagnose, and fix technical issues, errors, and problems you report, and to provide support you request; process payments; detect fraud and abuse; monitor and screen character-chat conversations for safety, including the detection of self-harm or abuse, to protect users and meet our safety and legal obligations; send transactional emails; improve our product using aggregated, anonymized data; use story titles, cover images, and excerpts from published works to promote the platform (published authors may opt out by contacting legal@novelmint.ai); use reader usernames and submitted feedback for platform marketing purposes (readers may opt out by contacting legal@novelmint.ai); and send marketing communications (consent — opt-in only).
When you use the Novelmint pipeline, your story data is transmitted to a model provider for processing. Depending on the model selected for a given piece of work — by you, or by the platform's model routing — that provider is Anthropic, OpenAI, Google, or xAI. When you use interactive character chat or the AI writing assistant, the messages you send are likewise transmitted to the provider serving that model. Novelmint is the data controller for your account; each provider acts as a processor. Anthropic's API terms prohibit training on customer API data; each other provider's handling is governed by its own API terms. Novelmint does not use your content to train any AI model.
All data in transit is encrypted via TLS 1.2+. Passwords are hashed and never stored in plaintext. API keys are encrypted using Supabase Vault. The application is hosted on Vercel and our database, authentication, and file storage run on Supabase — both operating on AWS infrastructure, with access controls and audit logging.
We do not sell your personal data. We share data only with the service providers we rely on to operate Novelmint: Supabase (database, authentication, and file storage); Vercel (application hosting and anonymized analytics); Cloudflare (DNS, bot protection, and abuse filtering); Stripe (payment processing and author payouts); Anthropic (AI prose generation, character chat, and writing assistance); OpenAI (AI prose generation on models you or the platform select); Google (AI prose generation on models you or the platform select); xAI (AI prose generation on models you or the platform select); fal.ai (cover and character image generation); Inworld (audio narration, where you have requested it); ElevenLabs (audio narration for books narrated before August 2026); Resend (transactional and notification email delivery); Sentry (error monitoring, with no personal data in payloads); Google Ads (advertising measurement and retargeting, where permitted or with your consent); Microsoft Advertising (advertising measurement, where permitted or with your consent); Reddit (advertising measurement, where permitted or with your consent); X (advertising measurement, where permitted or with your consent). We may disclose data if required by law or valid authority request. In the event of a merger or acquisition, your data may transfer to the acquiring entity with prior notice.
All users may: access their data via account settings; request deletion of their account and associated data (except records we must retain for safety, abuse-prevention, fraud-prevention, or legal compliance, as described in Data Retention); and opt out of marketing emails at any time. EEA/UK users (GDPR) also have: the right to data portability; the right to restrict processing; and the right to lodge a complaint with your supervisory authority. California users (CCPA/CPRA): we do not sell your personal information for money, but our use of advertising measurement tags is "sharing" for cross-context behavioral advertising as CPRA defines it. You have the right to opt out, and you can exercise it in three ways — enable Global Privacy Control in your browser (we honour it automatically and universally, worldwide), use the controls in the Your privacy choices section below, or email privacy@novelmint.ai. You also have the right to know, delete, correct, and not be discriminated against for exercising any of these. To exercise any right, contact privacy@novelmint.ai.
Account data is retained while your account is active and deleted within 90 days of closure. Transaction records are retained for 7 years for legal compliance. Pipeline artifacts are retained while your account is active and deleted on closure or on request. AI writing-assistant conversations are retained while your account is active — to operate the feature, provide support, and diagnose and fix issues — and are deleted on account closure or on request, subject to the safety, abuse-prevention, fraud-prevention, and legal-compliance exception below. Character-chat conversation data — the messages you send and the AI character responses you receive — is retained for up to 12 months to operate the feature and meet our safety and legal obligations, after which it is deleted or anonymized. Notwithstanding account closure or the periods above, records reasonably necessary for safety, abuse-prevention, fraud-prevention, or legal compliance — including records of safety interventions — may be retained, in pseudonymized form where practicable, for as long as required for those purposes.
Novelmint is available to users aged 13 and older. We do not knowingly collect personal information from anyone under 13. If you believe a user under 13 has created an account, contact privacy@novelmint.ai and we will promptly investigate and delete the account.
We will notify you of material changes via email or in-app notice. Continued use constitutes acceptance.
Novelmint runs paid advertising and uses measurement tags to tell which campaigns lead to signups. Under California law (CPRA) that counts as "sharing" personal information for cross-context behavioral advertising, even though no money changes hands for your data. This section explains how to stop it.
If your browser sends a Global Privacy Control signal, we do not load advertising tags for you. This happens automatically, on every page, with nothing for you to click. We honour it for every visitor worldwide, not only where the law compels it. GPC is built into some browsers and available as an extension for others; enabling it also opts you out of many other sites at the same time.
Nothing loads until you say so. We ask once, through a notice at the corner of the page, and until you answer it no advertising or analytics tag is present on the page at all. Decline and none ever loads; accept only analytics and the advertising tags stay off. You can change the answer at any time using the button below, and we keep a record of what you were asked and what you chose.
The same notice appears, with one difference. India’s Digital Personal Data Protection Act treats everyone under 18 as a child and prohibits behavioural tracking and targeted advertising directed at them outright, not as something a parent can permit. We therefore do not show the notice, and load no advertising or analytics tags, unless there is an adult date of birth on your account. Browsing without an account means no tags load and you are never asked.
Email privacy@novelmint.ai from your account address and ask us to stop sharing your personal information for advertising. We will confirm and apply it to your account. We will not discriminate against you for asking — your plan, pricing, credits, and access are unaffected.
Opting out does not disable the cookies that keep you logged in, and it does not affect Vercel Analytics, which sets no cookie and cannot identify you. It also does not delete data already collected — for that, use the deletion right described under Your Rights above.
Depending on where you live you may also have the right to know what we hold, to have it deleted or corrected, to receive a portable copy, and to restrict processing. The Your Rights section above sets these out in full. Contact privacy@novelmint.ai to exercise any of them.
Contact: privacy@novelmint.ai · TeamLesh LLC, Washington State, USA
Other legal documents