Narrative Privacy Notice

Last Updated: November 21, 2024

At Narrative, we care about your privacy, and we want to make sure you feel informed and comfortable with how we handle your personal information. This Privacy Notice (“Notice”) explains what data we collect, why we collect it, how we use it, and how we keep it safe. If you have questions or need more details, we’re here to help – just reach out!

We’ll update this Notice from time to time to reflect any changes in the way we handle data, so feel free to check back.

What This Privacy Notice Covers

This Notice applies to all Personal Information that we collect, store, use, disclose and otherwise process about our Customers in the course of our business, including through our websites that link to this Notice (such as www.narrative.io) (the “Sites“), our cloud-based data collaboration platform (the “Service”) and through other business activities like our and our partner's events, sales and marketing activities (the Sites, Service and other business activities are referred to as the “Data Services”).

Narrative's business operations involve provision of data, including Personal Information, by Narrative's Customers to Narrative and the Data Services to enable Narrative to provide Customers with the services they have requested. This Notice does not apply to any information that Narrative processes on behalf of its Customers, such as the data and information that our Customers upload, process and store in the Service (“Customer Data”). Narrative processes Customer Data on behalf of those Customers and the Customer's privacy policy applies to the Customer's collection, use, disclosure and other processing of the Customer Data. All questions about Customer Data should be directed to that Customer. Narrative has no responsibility or liability for any Customer's use of its Customer Data. “Customer” means any business or organization that has interacted with Narrative or has bought or uses the Data Services, including each of their individual users.

This Notice also does not apply to Personal Information processed when you access third party sites through our Data Services. Third party websites are governed by their own privacy policies that describe how your Personal Information is used. Narrative has no responsibility or liability for third party websites.

What Personal Information We Collect and How we Collect It

Personal Information that we collect from or about you includes information you provide, information we collect automatically, and information we receive from other sources.

Information You Provide

When you interact with our Data Services or our personnel, we collect certain Personal Information that you provide to us, which may include Personal Information you provide to subscribe to our Data Services or content, to attend our events, or for any other purpose you determine. You are also asked to provide Personal Information to set up your Narrative account and Personal Information obtained during our interactions during our business relationship. Personal Information you provide may include, but is not limited to:

• Contact and Account Information: your name and email address, phone number, and other related account data you provide;
• Employment Information: the company you work for, your role at that company, company industry information, company contact information and business address;
• Commercial information: records of your history of past purchases and transactions with us (e.g. when you signed up for a free trial)
• Communication Preferences: in connection with marketing content, areas of interest, records of consent, or other correspondence;
• Communication Data: data provided in your interactions with us, such as customer support;
• Payment Information: payment and billing, including payment card or direct debit details if chosen by you as a payment method, which may be collected by or disclosed to our third-party payment and billing service providers.

Information We Automatically Collect

We use standard automated data collection tools, such as cookies, web beacons, tracking pixels, tags, and similar tools, to collect information about use of our Data Services and interactions with our emails and other communications. The automatically collected information may include without limitation:

• Device Information: data about hardware and software, browser, operating system, unique identifiers, including unique device identifiers, and IP addresses (we may also use your IP address to derive your general location information);
• Activity Information: information about your activities on our Data Services, such as how you came to and used our Data Services, event information (like access times, browser type, and language);
• Cookie data: data collected through cookies and other similar technologies stored on your device, including cookie IDs and settings. We may also use web beacons and pixels in our newsletters and other emails.

Narrative uses this information for (a) providing, supporting, and operating our products and services, (b) network and information security, and (c) analyzing, developing, and improving our products and services. The types of data collection tools we use may change over time as technology evolves.

Personal Information from Other Sources

Narrative may also receive Personal Information about you from other individuals, organizations, users, affiliates, or third parties, including without limitation:

• Third party websites or applications that are integrated into the Data Services that a Customer may elect to use may provide us with account and usage information from the third party website or application, or information to verify the Customer, your identity, or location for legal or regulatory or other reasons such as fraud prevention (but your use of those third party websites and applications are governed by the terms and privacy notices of those third parties);
• Resellers, partners, or third party service providers who may provide us with contact or commercial information, or who support us with advertising functions; and
• Public Sources, such as information made publicly available on social media networks or other websites, or government entities that maintain public records

Why We Use Your Personal Information

Narrative uses your Personal Information for our business operations, which may include, without limitation, to:

• Provide, maintain, improve and update our Data Services;
• Create and maintain your accounts on the Data Services;
• Provide customer service and support;
• Communicate with you on various matters relating to our business relationship, including security alerts, invoices and payment, notices and administration;
• Monitor and enhance the safety and security of the Data Services and Customer accounts;
• Send you surveys or promotional mailings to inform you of other products or services available from Narrative and its affiliates (where you have permitted us to do so);
• Process for other legitimate business purposes, such as for research and development, analyzing performance trends and usage to enhance our offerings, personalizing and improving your experience with our Data Services, marketing, research and/or development of our business, services or features, quality assurance;
• Investigation of security issues, prevention of fraud, or to combat improper use of our Data Services;
• Comply with our obligations under applicable law, legal process, or government regulation;
• Create de-identified or anonymized information from other information we have collected, such that it cannot be reasonably identified with you or your device, and use and disclose the de-identified and anonymized information for any legal purpose.

We may combine information we automatically collect or receive from other sources with the information we receive and collect from you.

How Narrative Shares Your Personal Information

Narrative may share your Personal Information with third parties as follows:

• Service Providers: with our third party vendors, consultants and service providers for the purpose of assisting us in operating our business including providing the Data Services, such as hosting, billing, payment card processing, customer support, sales and marketing, data analysis, detection and prevention of fraud, security threats or other illegal or improper behavior;
• Business Partners: with third party business partners, including integration partners, in connection with providing content, products, services or events to our prospects or Customers;
• Legal Reasons: when authorized by law, in response to legal demands such as subpoenas, court orders, law enforcement requests, legal claims or government inquiries; to protect the rights, interests, safety, and security of Narrative, our Customers or the public, as well as of the Data Services and our other offerings;
• Your Consent: when you have consented to the disclosure;
• Affiliates: to Narrative affiliates for their use as described in this Notice;
• Business Transactions: to third parties in connection with negotiation and consummation of corporate transactions, such as financings, sales, mergers, or consolidations.

California Users

If you are a California resident, the information below applies to you and supplements the information provided elsewhere in this Notice. Any terms defined in California privacy law (including the California Consumer Privacy Act of 2018 (CCPA) and California Privacy Rights Act (CPRA)) have the same meaning when used in this Notice in relation to California residents, notwithstanding any conflicting definitions elsewhere in this Notice.

This section describes how we collect, use, disclose and share Personal Information of California residents in our capacity as a “business” under the CCPA and their rights with respect to that Personal Information.

Categories of Collected Data:

We generally collect the following categories of Personal Information as defined by the CCPA when you use our Data Services:

• Identifiers such as a name, address, unique personal identifier, email, phone number, your device’s IP address, software, and identification numbers associated with your devices;
• Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Internet or other electronic information regarding your browsing and search history, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, and system configuration information;
• Your geolocation (such as approximate location inferred from your IP address, city, country), to the extent you have configured your device to permit us to collect such information.
• Professional or employment-related information, such as your title or other employment attributes supplied in your interactions with us.

For more information about the Personal Information we collect and how we collect it, please refer to the applicable sections above. Narrative does not knowingly collect Personal Data from individuals who are less than 16 years of age.

Sale and Sharing:

Narrative does not sell any Personal Information of consumers, including individuals interacting with the Data Services. Narrative shares each category of Personal Information listed above as described in the section of this Notice entitled “How Narrative Shares Your Personal Information“. In addition, we may disclose Identifiers and Internet or other similar network activity to advertising providers that tailor online ads to your interests based on information they collect about your online activity (known as interest-based advertising).

Sources: Narrative collects the categories of Personal Information listed above that you provide, that we automatically collect or from third party sources as described in the section of this Notice entitled “What Personal Information We Collect and How we Collect It”.

Purpose: Narrative uses the Personal Information for its Business Purposes and as described in the section of this Notice entitled “Why We Use Your Personal Information“. The CCPA defines a “business purpose” as the use of Personal Information for the business’s operational purposes, or other notified purposes, provided the use of Personal Information is reasonably necessary and proportionate to achieve the operational purpose for which the Personal Information was collected or another operational purpose that is compatible with the context in which the Personal Information was collected.

Processing Personal Information (EEA, UK, and Switzerland Residents)

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, we rely on one or more of the following legal bases for processing your personal information:

• Performance of a Contract: Processing is necessary to provide the Data Services or perform a contract with you or your organization.
• Legitimate Interests: We process your personal information for our legitimate business interests, such as improving our Data Services, communicating with you, and detecting fraud, provided that our interests are not overridden by your data protection rights.
• Consent: Where required by law, we obtain your consent to process your personal information for specific purposes.
• Compliance with Legal Obligations: Processing is necessary to comply with our legal obligations.

Your Data Your Choices

European Privacy Rights (EEA, UK, and Switzerland Residents)

If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal information:

• Access: The right to request access to your personal information.
• Rectification: The right to request that we correct any inaccuracies in your personal information.
• Erasure: The right to request that we delete your personal information under certain circumstances.
• Restriction: The right to request that we restrict the processing of your personal information.
• Data Portability: The right to receive your personal information in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Objection: The right to object to the processing of your personal information based on our legitimate interests.
• Withdrawal of Consent: Where we have obtained your consent, you have the right to withdraw your consent at any time.

To exercise your rights, please contact us by emailing privacy@narrative.io. You also have the right to lodge a complaint with a supervisory authority.

California Privacy Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: The right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting, selling, or sharing your personal information, and the categories of third parties with whom we have disclosed your personal information.
• Right to Delete: The right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Opt-Out: The right to opt out of the sale or sharing of your personal information. However, we do not sell personal information as defined under the CCPA.
• Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

To exercise your rights, please  contact us by emailing privacy@narrative.io.

Other U.S. Privacy Rights

Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information's nature processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for:
  • targeted advertising (excluding Iowa);
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
• Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state. To exercise any of these rights please contact us by emailing privacy@narrative.io.

To appeal a decision regarding a consumer rights request please contact us by emailing privacy@narrative.io.

Data Retention

Narrative retains the Personal Information covered by this Notice for as long as you use the Data Services, as may be required by law, as necessary for other legitimate business or commercial purposes described in this Notice (for example, to resolve disputes or enforce our agreements), or as otherwise communicated to you.

Security of Your Personal Information

Narrative implements and maintains appropriate technical and organizational security measures which are designed to protect the security and confidentiality of your Personal Information under our control. However, as effective as protective measures and technology are, no security system is impenetrable, and Narrative cannot guarantee the security of your Personal Information.

Children's Personal Information

The Data Services are not directed towards children, and Narrative does not knowingly collect any Personal Information from children under the age of 13. If we discover that we have received Personal Information from a child under the age of 13, we will promptly delete that information or notify the relevant individual.

Updates to this Notice

Narrative may change this Notice from time to time, by posting those changes here and by changing the “Last Updated” date at the top of this Notice. If we make material changes, we will provide you with additional notice (such as adding a statement to the main website page, providing notice through the Services login page, or sending you an email notice).

Contact Narrative

If you have any questions about this Notice, or privacy-related issues, please contact us by sending an email to privacy@narrative.io. You can also write to us at 228 Park Ave South, PMB 23303, New York, NY 10003, Attn: Privacy. For inquiries related to our activities in the EEA, United Kingdom, and/or Switzerland, you may contact Narrative’s Data Protection Officer (DPO) at dpo@narrative.io.