Draft — pending legal review. Effective date to be added once finalized.
DRAFT — pending legal review. This Privacy Policy has been substantially rewritten to reflect the WriteStories clinical platform and has not yet been reviewed by an attorney. Open items still being finalized: confirming state-privacy-law applicability, the cookie/analytics disclosure, and the Effective Date.
This Privacy Policy describes how Scriptive LLC (“SCRIPTIVE,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with the WriteStories platform and our website (together, the “Services”). This Policy applies to Adult Users, Child Users, Clinician Users, and Institutions as defined in our Terms of Use, which this Policy is incorporated into by reference.
a) From Clinician Users: name, professional email address, professional license or credential information where applicable, and subscription billing information (processed by a third-party payment processor; we do not store full payment card numbers).
b) From Child Users: first name and last initial, grade level or age band, and story writing or narration samples. We do not knowingly collect a Child User's email address, phone number, precise location, or photograph.
c) From Adult Users (Parents/Guardians): name, email address, and account creation and activity data.
d) From Institutions: administrator contact information and roster or provisioning data necessary to manage accounts under an Institutional Agreement.
e) Usage and Technical Data: pages visited, features used, device and browser type, and approximate location derived from IP address.
We and our service providers use cookies and similar technologies to operate the Services, remember preferences, and understand aggregate usage patterns. We do not use cookies to serve targeted advertising to Child Users. Categories of cookies we may use include:
Most browsers allow you to control or delete cookies through their settings. Where required by law, we will obtain consent before setting non-essential cookies.
We use information to provide and maintain the Services, support narrative-language scoring and progress tracking, process payments, communicate with you, provide support, and improve the Services through aggregated, de-identified analysis. We do not use Child User information for behavioral advertising and do not sell personal information.
Certain features use third-party AI service providers to support narrative-language scoring. Story text submitted for this processing is anonymized before transmission. We require a Zero Data Retention agreement with an AI service provider before that provider may process student-authored content in production; as of this Policy's date, those agreements are in progress and not yet executed, and student content will not be processed by an AI service provider in production until they are.
We do not sell personal information. We share information only as necessary to provide the Services, including with: cloud hosting providers; a third-party payment processor; email/communications delivery providers; AI service providers as described above; and professional advisors or successors in a merger or acquisition, subject to confidentiality obligations. We may disclose information where required by law or legal process.
We retain personal information for as long as necessary to provide the Services, generally for the account's service term plus ninety (90) days, unless a longer period is required by law or an Institutional Agreement. Upon a valid deletion request, we will delete or de-identify applicable information within a reasonable time, except where retention is required by law.
Where a Child User's data originates from a school or district subject to FERPA, SCRIPTIVE operates as a “School Official” under FERPA (34 C.F.R. § 99.31(a)(1)), accessing education records solely to provide the contracted Services under the school or district's direct control.
We comply with the Children's Online Privacy Protection Act with respect to Child Users under 13. Where a Child Sub-Account is created directly by a parent or guardian, we obtain verifiable parental consent before collecting personal information. Where a Child User's account is provisioned by a Clinician User or Institution, that Clinician User or Institution is responsible for providing notice to and obtaining consent from the child's parent or guardian. A parent or guardian may review, request deletion of, or refuse further collection of their child's information at any time by contacting privacy@scriptive.us.
Some Clinician Users may work within a HIPAA “covered entity.” SCRIPTIVE does not represent that the Services are “HIPAA compliant” as a general matter. Upon request, SCRIPTIVE will make available a Business Associate Agreement to Clinician Users or Institutions who are HIPAA-covered entities or business associates and require one.
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, and opt out of non-essential communications, by contacting privacy@scriptive.us. We may need to verify your identity before completing certain requests.
If you are a resident of California, Virginia, Colorado, or another state with a comprehensive consumer privacy law, you may have additional rights, including the right to: confirm whether we process your personal information; access a copy of it; correct inaccuracies; delete it; and not be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. You may exercise these rights by contacting privacy@scriptive.us. If we deny a request, you may appeal by replying to our denial with the word “Appeal.”
We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption of data in transit and at rest and access controls limiting personal information to personnel who need it. No method of transmission or storage is completely secure.
The Services are intended for use within the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last Revised” date and, where required by law, provide additional notice.
Questions or requests may be directed to privacy@scriptive.us (privacy questions and data requests) or security@scriptive.us (security concerns), or in writing to Scriptive LLC, 3611 Cty Rd Q, Dodgeville, WI 53533.