Last updated: 13 September 2026
Who We Are
SpiceMyStory is a personalised romance novel company based in the United Kingdom. We are the data controller for the personal information you provide when ordering from us.
What We Collect
When book ordering is available and you place an order, we collect your name and email address, delivery address, payment status and transaction references, and the personalisation details you provide for your book, such as character names, memories, dedication message and preferences. If you apply for or use our affiliate programme, we may also collect affiliate account details such as your name, email address, website or social profile, referral-link activity, commission records and payout details needed to manage the programme. When you use Spice Rating, we process the messages and choices needed to provide replies, feedback and scores. Flirt Duet also processes both players' chosen names, messages, mode, scene, private heat choices, referee commentary and shared verdict.
Optional Emails and Member Accounts
A member account is optional for free Spice Rating play. If you choose to create or use one, the app stores your normalised email address, account timestamps and limited sign-in and checkout-coordination records. Where Stripe membership is enabled, it also stores Stripe customer and subscription references, subscription status and period-end information so access can be associated with your account. Full payment-card details are handled by Stripe and are not stored in the Spice Rating account record. The separate optional report/update form has a consent box that starts unticked and must be actively selected, together with an adult confirmation; it records the email address, form source, result archetype where present, the consent flag, a server-set consent version and the time of consent. That capture records your request and consent evidence; it does not by itself send a report.
How We Use Your Data
We use order and personalisation information to create and fulfil your personalised edition where ordering is available, provide order confirmation and operational updates, respond to support requests, prevent fraud, and manage the affiliate programme where relevant. Spice Rating uses game data to run the selected feature, account email to send a requested one-time sign-in link, consent evidence to record an email opt-in, and Stripe customer or subscription references to associate subscription state with the correct account where membership is enabled. We do not sell personalisation data or use personalisation details for unrelated marketing or analytics.
Affiliate Referrals
If you visit our website through an affiliate or referral link, we may process referral information so we can attribute an approved completed order to the correct affiliate. This may include a referral identifier, affiliate identifier, visit date/time, order value, and commission status. Affiliate referral data is used only to operate, review, and administer the Spice My Story affiliate programme.
Spice Rating and AI Processing
A solo-practice transcript is held in server memory while the round is active and sent to the configured AI service to generate replies, feedback and a score. After a successful score, the conversation, system prompt and stored IP value are cleared; the scored result can remain in memory for the rest of the session so a retry returns the same result. An unfinished or scored session expires after 30 minutes of inactivity. Do not submit confidential information or personal information about someone who has not agreed to take part.
Flirt Duet Storage and Retention
Flirt Duet stores its game record so two people can take turns on different devices and receive a shared AI-referee verdict. An invitation can be joined for 7 days; after the second player joins, the game becomes inactive after 48 hours without a move. An ordinary completed or expired Duet has a 14-day retention cutoff after completion or latest activity, and the service sweeps records on access and periodically. Invitation links contain a random game identifier. Each player's private seat key is stored on that player's device and is not included in the shared invitation link.
Spice Rating Browser Storage and Account Cookie
Spice Rating uses storage scoped to the app's own browser origin for progress, preferences, saved practice lines, access state and private Flirt Duet seat keys. Browser storage is not automatically sent with every request and remains on that device until an in-app control or the browser's site-data controls remove it. If you choose to sign in to a member account, the app sets an essential HttpOnly, SameSite=Lax account-session cookie for up to 30 days; it is marked Secure on HTTPS and is cleared when you sign out.
Data Retention
Personalisation data can be held in the current browser tab while you complete the wizard, in WooCommerce order records, and in authorised generation, quality-control and fulfilment records. Account, subscription, checkout-coordination, email-consent, order and affiliate records are separate from the automated solo-session and Duet cutoffs described above. No single fixed retention period applies to all of those categories; retention depends on the purpose of the record and applicable operational, dispute, accounting or other record-keeping requirements. Browser-stored copies remain under the controls of the device and browser being used.
Service Providers
The service-provider categories used to operate SpiceMyStory can include website and app hosting or storage, payment and subscription processing, email delivery, AI conversation and scoring, human-verification and security services, affiliate or referral tooling, and authorised book generation, quality-control or fulfilment services where those features apply. Stripe handles hosted Spice Rating membership payment when that feature is enabled and returns customer, subscription and payment-status references rather than full card details to the app. The categories involved depend on the feature you use and the live configuration.
Your Rights
Depending on the circumstances, you may have rights to access, correction, deletion, restriction, objection and portability. Spice Rating does not currently provide a self-service account-deletion control. To ask about or request deletion of account, consent, game, personalisation or other records, use our contact page or email hello@spicemystory.com, including an order number or account email where available so the relevant record can be located. Do not send card details, sign-in links or private Duet seat keys. Some information may need to be retained where an applicable obligation or dispute requires it.
Cookies and Consent
We use necessary cookies to store privacy choices and maintain security, cart, checkout or account sessions that you request. Website analytics through Google Analytics/Site Kit and referral attribution through WooCommerce or SliceWP are optional, denied by default, and require your affirmative consent for the relevant category. Known optional identifiers are removed when that category is rejected or withdrawn where the browser makes them available to this site. Spice Rating also uses same-origin browser storage as described above. Use the persistent Cookie preferences control to withdraw or change your choices, and see our Cookie Policy for category and retention details.
Contact
For any privacy queries contact hello@spicemystory.com. For complaints you may also contact the Information Commissioner's Office at ico.org.uk.
Questions? Email us at hello@spicemystory.com