Candlelit Stories is run by New Code Gestão Imobiliária, Lda. (NIF 513788549, Centro de Empresas Maquijig, Parque Industrial das Carrascas, Estrada Nacional 252, km 11,5, 2950-402 Palmela, Portugal), the controller of your personal data. This page explains what we collect and why. The law that applies is the EU General Data Protection Regulation (GDPR) and Portuguese law.
What we collect. Account data: your email, your name, your profile name, your sign-in details and the confirmation that you are 18 or older. Author data: pen names, biography and picture, country, and the details you give for payouts. Reading data: your purchases, library, follows, reactions and comments. Writing data: the novels, chapters, notes, covers and files you create. Payment data: Stripe handles your card details, and we receive only what we need to record the sale. Technical data: basic logs needed to keep the service secure, and settings stored on your device such as page style and your choice about hiding your name on comments. Consents: the date and version of every consent you give.
Why we use it, and on what basis. To run your account and deliver what you bought (contract). To take payments, pay authors and keep the records the law requires (contract and legal duty). To keep the site secure and prevent abuse (legitimate interest). To send you emails about your account and your orders (contract). To use the AI helper, only if you switch it on (consent). We do not sell your data and we do not use it for advertising.
No AI training. We do not use your writing or any other personal data to train AI models, and we do not give it to anyone to do so. Our AI provider receives text only when you use the AI helper, only for that request, and is not allowed to train on it under its business terms.
Who receives it. Providers that help us run the site, under contracts that protect your data: Lovable and Supabase (hosting, database and file storage), Stripe (payments and author payouts), our email delivery service, and, only if you use the AI helper, Anthropic, which receives the text you select to produce suggestions. We share information with tax authorities when the law requires it. Some providers are outside the EU. Where that is the case, they rely on approved safeguards such as standard contractual clauses.
Who sees what. Readers see an author's pen name, never the real name. Authors see how many readers follow them, never who. Authors see their own share of a sale, never who bought. A comment shows your display name unless you hide it. Administrators can read a novel only after it has been submitted for review.
Private writing. The spelling and style checks, the style insights, the continuity grid and the proof matching run in your browser, and the text is not sent to us for those. Your unpublished work is private to you. The only exceptions are beta links that you create yourself, and our review after you submit a novel. If you switch on offline writing, a private copy of your novels is kept on that device until you remove it or sign out.
How long we keep it. Account data until you close your account, then for a limited period for security and disputes. Sales, payout and accounting records for ten years, as Portuguese law requires. Fingerprints of chapters, which are codes and not text, are kept so authorship can be proven later. Backups are removed on their normal cycle.
Your rights. You can ask to see your data, correct it, delete it, receive a copy, limit or object to its use, and withdraw a consent at any time, without affecting what was done before. Write to us at hello@candlelitstories.co. You can also complain to the Portuguese data protection authority, the CNPD (cnpd.pt).
Children. The site is for adults only. If we learn that an account belongs to someone under 18, we close it.
Changes. If we change this policy in a way that matters, we will tell you.