Narrative Privacy Notice

Last Updated: March 26, 2024

This Narrative Privacy Notice (this “Notice”) describes how Narrative I/O, Inc. (“Narrative”, “us”, “we”, “our”, and “ours”) collect, store, use, disclose and otherwise process “Personal Information”, which means any information that can be used to identify an individual person. This Notice also provides information about your choices and privacy rights.

We encourage you to review this Notice on a regular basis, as we may make any changes to it to keep up with changing law and for other reasons.

Information Covered in This Privacy Notice

This Notice applies to all Personal Information that we collect, store, use, disclose and otherwise process about our Customers in the course of our business, including through our websites that link to this Notice (such as www.narrative.io) (the “Sites“), our cloud-based data collaboration platform (the “Service”) and through other business activities like our and our partner's events, sales and marketing activities (the Sites, Service and other business activities are referred to as the “Data Services”).

Narrative's business operations involve provision of data, including Personal Information, by Narrative's Customers to Narrative and the Data Services to enable Narrative to provide Customers with the services they have requested. This Notice does not apply to any information that Narrative processes on behalf of its Customers, such as the data and information that our Customers upload, process and store in the Service (“Customer Data”). Narrative processes Customer Data on behalf of those Customers and the Customer's privacy policy applies to the Customer's collection, use, disclosure and other processing of the Customer Data. All questions about Customer Data should be directed to that Customer. Narrative has no responsibility or liability for any Customer's use of its Customer Data. “Customer” means any business or organization that has interacted with Narrative or has bought or uses the Data Services, including each of their individual users.

This Notice also does not apply to Personal Information processed when you access third party sites through our Data Services. Third party websites are governed by their own privacy policies that describe how your Personal Information is used. Narrative has no responsibility or liability for third party websites.

Personal Information Collected by Narrative

Personal Information that we collect from or about you includes information you provide, information we collect automatically, and information we receive from other sources.

Information You Provide

When you interact with our Data Services or our personnel, we collect certain Personal Information that you provide to us, which may include Personal Information you provide to subscribe to our Data Services or content, to attend our events, or for any other purpose you determine. You are also asked to provide Personal Information to set up your Narrative account and Personal Information obtained during our interactions during our business relationship. Personal Information you provide may include, but is not limited to:

• Contact and Account Information: your name and email address, phone number, and other related account data you provide;
• Employment Information: the company you work for, your role at that company, company industry information, company contact information and business address;
• Commercial information: records of your history of past purchases and transactions with us (e.g. when you signed up for a free trial)
• Communication Preferences: in connection with marketing content, areas of interest, records of consent, or other correspondence;
• Communication Data: data provided in your interactions with us, such as customer support;
• Payment Information: payment and billing, including payment card or direct debit details if chosen by you as a payment method, which may be collected by or disclosed to our third-party payment and billing service providers.

Information We Automatically Collect

We use standard automated data collection tools, such as cookies, web beacons, tracking pixels, tags, and similar tools, to collect information about use of our Data Services and interactions with our emails and other communications. The automatically collected information may include without limitation:

• Device Information: data about hardware and software, browser, operating system, unique identifiers, including unique device identifiers, and IP addresses (we may also use your IP address to derive your general location information);
• Activity Information: information about your activities on our Data Services, such asihow you came to and used our Data Services, event information (like access times, browser type, and language);
• Cookie data: data collected through cookies and other similar technologies stored on your device, including cookie IDs and settings. We may also use web beacons and pixels in our newsletters and other emails.

Narrative uses this information for (a) providing, supporting, and operating our products and services, (b) network and information security, and (c) analyzing, developing, and improving our products and services.The types of data collection tools we use may change over time as technology evolves.

Personal Information from Other Sources

Narrative may also receive Personal Information about you from other individuals, organizations, users, affiliates, or third parties, including without limitation:

• Third party websites or applications that are integrated into the Data Services that a Customer may elect to use may provide us with account and usage information from the third party website or application, or information to verify the Customer, your identity, or location for legal or regulatory or other reasons such as fraud prevention (but your use of those third party websites and applications are governed by the terms and privacy notices of those third parties);
• Resellers, partners, or third party service providers who may provide us with contact or commercial information, or who support us with advertising functions; and
• Public Sources, such as information made publicly available on social media networks or other websites, or government entities that maintain public records

Use of Your Personal Information

Narrative uses your Personal Information for our business operations, which may include, without limitation, to:

• Provide, maintain, improve and update our Data Services;
• Create and maintain your accounts on the Data Services;
• Provide customer service and support;
• Communicate with you on various matters relating to our business relationship, including security alerts, invoices and payment, notices and administration;
• Monitor and enhance the safety and security of the Data Services and Customer accounts;
• Send you surveys or promotional mailings to inform you of other products or services available from Narrative and its affiliates (where you have permitted us to do so);
• Process for other legitimate business purposes, such as for research and development, analyzing performance trends and usage to enhance our offerings, personalizing and improving your experience with our Data Services, marketing, research and/or development of our business, services or features, quality assurance;
• Investigation of security issues, prevention of fraud, or to combat improper use of our Data Services;
• Comply with our obligations under applicable law, legal process, or government regulation;
• Create de-identified or anonymized information from other information we have collected, such that it cannot be reasonably identified with you or your device, and use and disclose the de-identified and anonymized information for any legal purpose.

We may combine information we automatically collect or receive from other sources with the information we receive and collect from you.

How Narrative Shares Your Personal Information

Narrative may share your Personal Information with third parties as follows:

• Service Providers: with our third party vendors, consultants and service providers for the purpose of assisting us in operating our business including providing the Data Services, such as hosting, billing, payment card processing, customer support, sales and marketing, data analysis, detection and prevention of fraud, security threats or other illegal or improper behavior;
• Business Partners: with third party business partners, including integration partners, in connection with providing content, products, services or events to our prospects or Customers;
• Legal Reasons: when authorized by law, in response to legal demands such as subpoenas, court orders, law enforcement requests, legal claims or government inquiries; to protect the rights, interests, safety, and security of Narrative, our Customers or the public, as well as of the Data Services and our other offerings;
• Your Consent: when you have consented to the disclosure;
• Affiliates: to Narrative affiliates for their use as described in this Notice;
• Business Transactions: to third parties in connection with negotiation and consummation of corporate transactions, such as financings, sales, mergers, or consolidations.

California Users

If you are a California resident, the information below applies to you and supplements the information provided elsewhere in this Notice. Any terms defined in California privacy law (including the California Consumer Privacy Act of 2018 (CCPA) and California Privacy Rights Act (CPRA)) have the same meaning when used in this Notice in relation to California residents, notwithstanding any conflicting definitions elsewhere in this Notice.

This section describes how we collect, use, disclose and share Personal Information of California residents in our capacity as a “business” under the CCPA and their rights with respect to that Personal Information.

Categories of Collected Data:

We generally collect the following categories of Personal Information as defined by the CCPA when you use our Data Services:

• Identifiers such as a name, address, unique personal identifier, email, phone number, your device’s IP address, software, and identification numbers associated with your devices;
• Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Internet or other electronic information regarding your browsing and search history, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, and system configuration information;
• Your geolocation (such as approximate location inferred from your IP address, city, country), to the extent you have configured your device to permit us to collect such information.
• Professional or employment-related information, such as your title or other employment attributes supplied in your interactions with us.

For more information about the Personal Information we collect and how we collect it, please refer to the applicable sections above. Narrative does not knowingly collect Personal Data from individuals who are less than 16 years of age.

Sale and Sharing:

Narrative does not sell any Personal Information of consumers, including individuals interacting with the Data Services. Narrative shares each category of Personal Information listed above as described in the section of this Notice entitled “How Narrative Shares Your Personal Information“. In addition, we may disclose Identifiers and Internet or other similar network activity to advertising providers that tailor online ads to your interests based on information they collect about your online activity (known as interest-based advertising).

Sources: Narrative collects the categories of Personal Information listed above that you provide, that we automatically collect or from third party sources as described in the section of this Notice entitled “Personal Information Collected by Narrative”.

Purpose: Narrative uses the Personal Information for its Business Purposes and as described in the section of this Notice entitled “Use of Your Personal Information“. The CCPA defines a “business purpose” as the use of Personal Information for the business’s operational purposes, or other notified purposes, provided the use of Personal Information is reasonably necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or another operational purpose that is compatible with the context in which the Personal Information was collected.

California Consumer Rights: California residents can make requests described below relating to Personal Information that Narrative processes on our own behalf. Any request relating to Customer Data must be made directly to the relevant Customer which is the entity controlling that Customer Data. You can request:

(i) Access to a copy the Personal Information that we have collected about you in the 12 months prior to your request;

(ii) Correction of any such Personal Information that is inaccurate; and/or

(iii) Deletion of Personal Information, subject to certain exceptions.

(iv) Right to Opt-Out of Selling. “Personal Information” and “selling” are broadly defined in the CCPA such that sharing identifiers linked to you for a benefit may be considered a sale. We do not “sell” your Personal Information in the traditional sense; but as described in this Notice, we may share information about you with our partners, third parties or affiliates for our marketing purposes which the CCPA may consider a “sale” of Personal Information. Note - if you opt-out, we may be unable to offer you some of our Data Services which require sharing of Personal Information.

To make any of the requests described above, please contact us by email at privacy@narrative.io. We will respond to your request consistent with, and subject to any exceptions in, the CCPA. Narrative does not discriminate against you for exercising your rights or offer you financial incentives related to the use of your Personal Information.

International

References to “Personal Information” in this Section have the same meaning as the term “personal data” as defined by European data protection legislation. This section relates to Personal Information that Narrative processes as a “controller”. Any Customer Data is processed by Narrative as a “processor” and is not governed by this Notice.

Narrative’s data hosting is located in the United States. If you are located outside the United States and choose to provide Personal Information to us, you should understand that we transfer Personal Information to the United States. We use your Personal information for our legitimate business interests in conducting our operations, to comply with legal obligations, to fulfill our contractual obligations to your organization, or with your consent. We may use your Personal Information for reasons not described in this Notice if permitted by law and the reason is compatible with the purpose for which we collected it.

You can request access to your Personal Information and request that we correct, amend, or delete it if it is inaccurate or processed in violation of European data protection legislation by emailing privacy@narrative.io. We may request specific information from you to help us confirm your identity and process your request. If we decline your request as permitted or required by applicable law, we will tell you why to the extent legally permitted.

Data Retention

Narrative retains the Personal Information covered by this Notice for as long as you use the Data Services, as may be required by law, as necessary for other legitimate business or commercial purposes described in this Notice (for example, to resolve disputes or enforce our agreements), or as otherwise communicated to you.

Security of Your Personal Information

Narrative implements and maintains appropriate technical and organizational security measures which are designed to protect the security and confidentiality of your Personal Information under our control. However, as effective as protective measures and technology are, no security system is impenetrable, and Narrative cannot guarantee the security of your Personal Information.

Children's Personal Information

The Data Services are not directed towards children, and Narrative does not knowingly collect any Personal Information from children under the age of 13. If we discover that we have received Personal Information from a child under the age of 13, we will promptly delete that information or notify the relevant individual.

Updates to this Notice

Narrative may change this Notice from time to time, by posting those changes here and by changing the “Last Updated” date at the top of this Notice. If we make material changes, we will provide you with additional notice (such as adding a statement to the main website page, providing notice through the Services login page, or sending you an email notice).

Contact Narrative

If you have any questions about this Notice, or privacy-related issues, please contact us by sending an email to privacy@narrative.io. You can also write to us at 228 Park Ave South, PMB 23303, New York, NY 10003, Attn: Privacy. For inquiries related to our activities in the EEA, United Kingdom, and/or Switzerland, you may contact Narrative’s Data Protection Officer (DPO) at dpo@narrative.io.