Privacy Policy

1. Who we are #

Studio Kizen Corp. is a company incorporated in Ontario, Canada. We operate the Kizen platform at kizenworlds.com, and we are the controller of the personal information described here.

Questions, requests or complaints: hello@kizenworlds.com

2. Our privacy officer #

Privacy officer. Saina Sefidbakht, Privacy Officer, is accountable for our compliance with privacy law and is the person to contact about how we handle personal information.

Studio Kizen Corp. 350 Bay St, Suite 1300B, Toronto, Ontario M5H 2S6, Canada hello@kizenworlds.com

3. What we collect #

Information you give us when you create an account

• email address
• password, stored only as a bcrypt hash, never in readable form
• your Google account identifier, if you sign in with Google
• first and last name, if you provide them
• profile bio and avatar image, if you provide them

Information you create in the Service

• prompts you write
• chat conversations with the story assistant
• story documents, character files, world and location files
• images you upload
• images and text generated from your prompts
• your credit balance and generation history

Information you give us when you apply to a programme or join a waitlist

• your name and email address
• a description of the show you want to make, and links to your work and social profiles, if you apply
• where you already spend time online, if you tell us

We use this to run the programme you applied to and to email you about it, including the outcome. We email you about Kizen more broadly only if you opted in when you applied, or if you joined a waitlist to hear from us. We never sell it or share it with advertisers.

Information relating to payment

We have not taken any payments yet. When paid plans go live, this will include:

• the plan you are on, your billing history, and the last four digits and expiry of your payment card, held by Stripe

We will never see or store your full payment card number.

Information collected automatically

• IP address and browser user-agent string, recorded in server logs
• session tokens, used to keep you signed in
• analytics data about how you use our website and the product: pages viewed, links clicked, approximate location from your IP address, device and browser type, and a randomly generated visitor identifier

What we do not collect

We do not run device fingerprinting or advertising trackers. We do not record your sessions: session recording is switched off in our analytics code itself, so it cannot be turned on from a settings screen. We do not collect audio or voice recordings. We do not buy personal information from data brokers.

4. Where the information comes from #

Directly from you, when you register, apply to a programme or join a waitlist, use the Service, contact us, or, once paid plans are live, buy something. Automatically from your device, when you connect to our servers. From Google, if you choose to sign in with Google. From our payment processor, for billing records, once paid plans are live.

5. Cookies and local storage #

We set cookies and similar identifiers for 3 purposes.

Strictly necessary. Sign-in works using your browser's local storage rather than a cookie. Anything we set to keep you signed in and run the Service is strictly necessary.

Attribution. If you arrive at kizenworlds.com/originals/ through a referral link or a link with campaign tags, we save the referral code and campaign tags in your browser's local storage, under the key kz-originals-ref. This lets us see which link brought you if you apply or join the waitlist. It stays in your browser, reaches us only if you submit one of those forms, and is deleted after 30 days.

Analytics. We use Google Analytics on our website and PostHog in the product to understand how people find and use the Service. These set cookies and identifiers in your browser and send your IP address and browsing activity to Google and to PostHog. Google Analytics loads only for visitors outside the European Economic Area and the United Kingdom. Where it loads, it sets these cookies:

PostHog runs in the product for signed-in users everywhere, including in the EEA and UK. Everywhere else, you can opt out of Google Analytics using Google's browser add-on, and you can block these cookies in your browser settings without losing access to the Service.

We host our own fonts, so loading a page does not send your information to a font provider.

6. How we use your information #

We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. Because we do not sell or share, there is nothing for an opt-out preference signal such as Global Privacy Control to act on, and we honour such signals to the extent they apply.

7. Categories of personal information, for California residents #

The California Consumer Privacy Act asks us to describe what we collect using its own categories. Over the past twelve months we have collected:

We do not disclose personal information for monetary or other valuable consideration.

8. Legal bases, if you are in the EEA or UK #

• Performance of a contract: running your account, providing the Service, and, once paid plans are live, taking payment
• Legitimate interests: security, abuse prevention, debugging, and improving the Service
• Consent: optional profile information, marketing email, and any use of your work in our marketing
• Legal obligation: where we must retain or disclose information by law, including tax records

Where we rely on legitimate interests you may object. Where we rely on consent you may withdraw it at any time.

9. AI providers, and what each one receives #

Generating content requires sending your request to a third party. This is the most important section of this policy.

Anthropic provides the writing and story assistance models. Anthropic receives your prompt, relevant story context, your internal Kizen user identifier and the project name. Anthropic does not receive your name or email address. Under our agreement with Anthropic, your inputs are not used to train their models.

fal.ai provides image generation. fal.ai receives only your prompt, the number of images requested, the aspect ratio, and any reference images you supply. It receives no account identifier, name or email address. fal.ai routes your request to a model operated by a third-party AI lab, currently including Black Forest Labs, Google, OpenAI, xAI, Ideogram, Recraft and ByteDance. Each lab has its own terms covering how request data is handled.

LangChain (LangSmith) provides the tracing and monitoring tools we use to see how the assistant is behaving, find faults and improve it. Your full prompts, your chat history and your internal Kizen user identifier are sent to LangSmith, in both our production and testing environments. LangSmith does not receive your name or email address, and does not train on our data.

We may add, change or remove providers. We will update this policy when we do.

10. Other services that handle your data #

11. Who else we may share with #

We share personal information only as described in this policy, and with:

• Service providers listed above, who process it on our instructions
• Professional advisers, such as lawyers and accountants, under a duty of confidence
• Authorities, where we are legally required to, or where we believe in good faith it is necessary to prevent serious harm or to establish or defend legal claims
• A buyer or successor, if we are involved in a merger, acquisition, financing or sale of assets, subject to this policy continuing to apply

12. Marketing email #

We send two kinds of email.

Service messages are about your account, your purchases, security, and changes to these documents. We send these because we have to, and you cannot opt out of them while you have an account.

Marketing email is about new features, programmes and things we have made. We send it only where you have given us consent, or where Canada's anti-spam legislation otherwise permits it, and every message identifies us, gives our contact details, and contains a working unsubscribe link that we action within 10 business days. You can also unsubscribe at any time by emailing hello@kizenworlds.com.

13. Where your data is stored #

All data we store sits in Amazon Web Services infrastructure in the United States, in the US East (Northern Virginia) region.

Our AI providers are all United States services. We do not currently restrict processing to a particular region. PostHog, which we use for product analytics, stores data in its United States region.

If you are in Canada, the EEA or the UK, your personal information is therefore transferred to and processed in the United States, which has a different data protection framework from your own.

Each of our providers, Anthropic, fal.ai, Amazon Web Services and LangChain, incorporates a data processing agreement into the terms we accepted, and each of those carries the European Commission's Standard Contractual Clauses together with the UK Addendum. Those are the safeguards we rely on for these transfers. You can ask us for details at hello@kizenworlds.com.

PostHog, Google and Resend also process personal information in the United States. [TBC: confirm the transfer safeguards each of them provides.]

14. How long we keep things #

15. Images of people #

You can upload images to the Service and use them as references for generation.

You must not upload a photograph of a real, identifiable person unless you have that person's written permission, and during our early access programme you must not upload photographs of identifiable people at all. This is set out in our Terms of Service.

We do not knowingly collect or process biometric identifiers or biometric information. We do not use face recognition, we do not create face templates, faceprints, voiceprints or scans of face or hand geometry, and we do not use uploaded images to identify anyone. Uploaded images are stored and passed to our image generation provider as reference material only. We do not sell, lease, trade or otherwise profit from any image you upload.

If you believe an image of you has been uploaded to the Service without your permission, email hello@kizenworlds.com and we will investigate and remove it.

16. Your rights #

Depending on where you live, you may have the right to:

• get a copy of the personal information we hold about you, and know how we use it
• correct it if it is wrong
• delete it
• restrict or object to how we use it
• receive it in a portable format
• withdraw consent where we relied on consent
• complain to a regulator

To exercise any of these, email hello@kizenworlds.com. We will respond within 30 days, and will tell you if we need longer. We may ask you to confirm your identity first. An authorised agent may make a request on your behalf with written proof of authority. We will not treat you differently, or give you a worse service or price, for exercising a right.

If we refuse a request we will tell you why and how to challenge that decision.

Canada. You can complain to the Office of the Privacy Commissioner of Canada. Quebec residents have additional rights under Law 25, including rights relating to automated processing and to the portability of computerised information.

EEA and UK. You can complain to your national supervisory authority.

California. You have the rights above under the CCPA as amended, including the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined.

17. Age #

The Service is not for anyone under 18. We do not knowingly collect personal information from anyone under 18, and if we learn we have, we will delete the account and the information. If you believe someone under 18 has given us information, email hello@kizenworlds.com.

18. Security #

Passwords are hashed with bcrypt and never stored in readable form. Access to production systems is limited to staff who need it. Data is transmitted over encrypted connections.

No system is completely secure. We cannot guarantee the security of information transmitted to us, and you use the Service at your own risk.

If a breach occurs that creates a real risk of significant harm, we will notify affected users and the relevant regulators as the law requires, and we will keep records of breaches as required under Canadian law.

19. Automated decision-making #

We do not make decisions about you that produce legal or similarly significant effects using automated processing alone.

20. Business and organisational customers #

If you use the Service on behalf of an organisation and need a data processing agreement, contact hello@kizenworlds.com.

21. Changes #

We may update this policy. If a change is material we will notify you by email or in the product before it takes effect. The date at the top shows when it was last revised.

22. Contact #

Studio Kizen Corp. 350 Bay St, Suite 1300B Toronto, Ontario M5H 2S6, Canada

hello@kizenworlds.com