Privacy Policy

1. About Us and Contact

Fanon Private Limited ("the Company," "we," "us," or "our"), whose registered office is at Koramangala, 3rd Block, 80 Feet Road, Bengaluru, Karnataka 560095, India, operates the fan-fiction creation platform at fanon-in.com (the "Platform"). The Company is the Data Fiduciary for personal data processed through the Platform.

Fanon is an AI-assisted platform where creators develop characters, timelines, and story segments in self-defined fictional universes, then share them with readers. This Privacy Policy covers the personal data collected to run the service, its use, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDPA 2023"), the Information Technology Act, 2000 ("IT Act"), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021").

For questions or requests, contact us at [email protected] or the address above.

2. Data We Collect

Account and registration data: Opening a Fanon account requires your name, email address, and chosen username. Paid Creator or Studio subscribers also provide billing information. Our payment processor handles card details directly, and Fanon's systems do not store them.

Creator content: You provide universe notes, character details, drafts, and revision histories so we can create consistent characters and story segments (collectively, "your Content"). The Platform stores this Content and its AI generation service processes it to provide requested features.

AI generation inputs and outputs: We log each prompt sent to the generation service and the returned text for reliability, quota enforcement, and abuse prevention. During the Section 6 retention period, these logs remain linked to your account.

Usage and technical data: We automatically collect accessed pages and features, generation counts for plan limits, IP address, browser type, device identifiers, and session timing. We use this data to run and improve the Platform.

Communications: If you contact us by email or contact form, we retain your message and contact details to reply and keep records of the issue or request.

3. How We Use Data

To operate the Platform: Account data, Content, and generation history enable AI character and story generation, lore checks, community-feed publishing, and access to saved work across sessions.

Quota and plan enforcement: We track generation counts and feature use against your plan, Starter, Creator, or Studio, to apply the relevant limits and entitlements.

Community publishing: Content you make public appears to registered users in the community feed and exploration results. Account settings let you set visibility for each universe and story segment.

Content policy and safety: We review flagged content and generation logs to enforce our Content Policy, answer takedown requests, and comply with applicable law. Where a valid legal order requires it, this may include disclosure to law enforcement.

Platform improvements: Aggregated and anonymised usage patterns guide decisions on features, generation quality, and reliability. We do not use personally identifiable data for advertising profiling.

Important: no model training without your consent. The Company does not use your story content, character descriptions, or universe notes to train its underlying AI language models without your explicit written consent. We process your creative work only to produce requested output and run the service you chose.

4. Consent and Legal Basis (DPDPA 2023)

Under DPDPA 2023, the Company processes personal data based on consent provided at registration. Before creating your account, we give clear notice of the data categories and purposes and ask you to confirm your agreement.

You may withdraw consent anytime by requesting account deletion (see Section 7). Withdrawal does not change the lawfulness of earlier processing. After deletion, we retain only data that applicable law requires.

For Content already published publicly when you delete your account, the Company retains a 90-day period to handle takedown requests from users who engaged with it. It is then removed.

5. Sharing and Sub-Processors

We share personal data only with these party categories, each subject to written contractual obligations:

• Cloud infrastructure and hosting providers that store Platform data in secure data centres for us.
• AI model providers that process prompts and return text. They receive only prompt text, not your name, email, or account credentials.
• Payment processors that handle subscription billing. Under their own privacy frameworks, they provide only transaction confirmation, never card details.
• Government authorities and law enforcement when a valid order under applicable Indian law requires disclosure.

We do not sell personal data to advertisers, data brokers, or other third parties.

6. Retention

We retain account data and Content while your account remains active. On deletion, account data is removed within 90 days. Published Content follows the Section 4 90-day window, while unpublished drafts are promptly deleted.

We retain identifiable AI generation logs for up to 90 days for abuse investigations, then aggregate and anonymise them. Anonymised aggregate usage telemetry is retained for up to 13 months.

If applicable law requires longer retention of records, we retain them only for the required period and purpose.

7. Data Principal Rights (DPDPA 2023)

Under Sections 11 to 14 of the DPDPA 2023, you have these rights concerning your personal data:

• Right to access (Section 11): Request a summary of the personal data the Company holds about you and the purposes for which it is being processed.
• Right to correction and erasure (Section 12): Request correction of inaccurate personal data, or request erasure of data the Company no longer has a lawful basis to retain.
• Right to grievance redressal (Section 13): Raise a grievance with our Grievance Officer regarding any aspect of how the Company processes your personal data (see Section 8).
• Right to nominate (Section 14): Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
• Right to withdraw consent: Withdraw your consent to data processing at any time by deleting your account, as described in Section 4.

To exercise a right, email [email protected] with the subject "Data Rights Request." We aim to acknowledge requests within 24 hours and give a substantive response within 30 days.

8. Grievance Officer

In accordance with the IT Rules 2021 and DPDPA 2023, the Company has appointed a Grievance Officer for complaints from creators and readers about the Platform or personal-data processing.

Grievance Officer: Priya Krishnamoorthi, Head of Community
Fanon Private Limited
Koramangala, 3rd Block, 80 Feet Road
Bengaluru, Karnataka 560095, India
Email: [email protected] (subject: "Grievance")

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it or give a substantive response within 15 days of receipt.

9. Cookies and Tracking

See our Cookie Policy for details of the cookies and similar technologies we use and how to manage them.

10. Security

The Company uses administrative, technical, and physical safeguards suited to the sensitivity of processed data. We send Generation prompts and Content over HTTPS and store them with access controls limiting internal access. Our payment processor handles payment processing through its PCI-compliant systems.

11. Policy Changes

We may revise this Privacy Policy as the Platform's data practices or applicable law changes. A material update will show a new "Last updated" date at the page top. For significant changes, we will email registered creators before they take effect.

Fanon Private Limited
Koramangala, 3rd Block, 80 Feet Road
Bengaluru, Karnataka 560095, India
[email protected]
+91 80 4093 5170