Privacy Policy — Narrative

1. Who we are

Narrative is an AI-powered reporting platform for digital marketing agencies, operated as an independent product. For questions about this policy, contact: privacy@trynarrative.io.

2. Data we collect

Account data: email address, agency name, and hashed password (or Google OAuth token) when you register.
Client and report data: client names, campaign data, and performance metrics you enter or connect.
Usage data: pages visited and actions taken within the app (stored server-side in logs, not sold or shared).
Session data: a secure HTTP-only session cookie to keep you signed in.

We do not collect advertising identifiers, device fingerprints, or any cross-site tracking data.

3. Legal basis (GDPR)

Contract performance (Art. 6(1)(b)): Processing your account and report data is necessary to deliver the service.
Legitimate interest (Art. 6(1)(f)): Server logs for security and debugging.
Consent (Art. 6(1)(a)): Optional cookies beyond the essential session cookie.

4. Cookies

We use one essential session cookie to keep you authenticated. No advertising or analytics cookies are set. You can decline non-essential cookies via the banner shown on your first visit.

5. Data storage and transfers

All data is stored in the EU (Frankfurt region) on Neon Postgres and Vercel infrastructure. No data is transferred outside the EEA without adequate safeguards.

6. Data retention

Account and report data is retained for as long as your account is active. On account deletion, all personal data is erased within 30 days.

7. Third-party processors

Vercel — hosting and edge functions (EU data processing agreement in place).
Neon — managed Postgres database (Frankfurt, EU).
Anthropic — AI report generation. Only the campaign metrics and context text you provide are sent; no end-client personal data is included.

8. Your rights

Under GDPR you have the right to:

Access the personal data we hold about you
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict or object to processing
Data portability (export your reports)
Withdraw consent at any time

To exercise any right, email privacy@trynarrative.io. We respond within 30 days.

9. Changes to this policy

We may update this policy. Material changes will be communicated by email or an in-app notice at least 14 days before taking effect.