Privacy Policy
This explains what we collect, why we collect it, who sees it, and how you stay in control. We have tried to write it in plain language rather than legal padding.
1. Who is responsible
Narravec is operated by TBD, registered in Malaysia (registration number TBD) (the "Operator"), which is the data controller for the personal data described in this policy. For anything about your data — access, correction, deletion, or a complaint — write to privacy@narravec.com. For anything else, hello@narravec.com.
Two different roles, and how to tell them apart
Which role we are in decides who is accountable, so it is worth being clear:
| Whose data | Our role | What that means |
|---|---|---|
| Yours — your account, your business, your Listing, documents you upload, your activity on Narravec | Controller | We decide why we hold it, and this policy explains that. You come to us about it. |
| Your customers' — a contact list you upload, or visits measured by a Narravec script on your own website | Processor | You decide why it is held; we act on your instruction. You are the controller of it, and your own privacy notice governs it. The terms are in section 15 of our Terms of Service. |
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password (hashed), role, phone number if you add one | You |
| Business information | Business name, description, story, sector, location, links, photographs, video, documents | You |
| Financial information | Revenue, margin, costs and similar figures you enter | You |
| Verification documents | Registration certificates, licences and similar evidence | You |
| Activity | Sign-ins, actions taken, features used, Tokens and Credits spent, consent given | Automatic |
| Technical | Browser and device information, approximate timezone, screen size | Automatic |
| Connected channels | Access tokens for accounts you connect, and metrics returned by them | The platform you connect, with your authorisation |
We do not ask for special-category data (health, beliefs, biometrics) and ask that you do not upload it. We never ask for card numbers or passwords in chat.
3. Why we use it, and our legal basis
| Purpose | Basis |
|---|---|
| Create and run your account, provide the features you use | Performance of a contract |
| Verify a business and issue or withdraw a badge | Performance of a contract; legitimate interests in a trustworthy marketplace |
| Generate listings, marketing material, analysis and recommendations | Performance of a contract |
| Publish to a channel you connected, on your instruction | Performance of a contract |
| Pass your contact details to a growth partner | Your explicit consent, given per engagement |
| Keep the platform secure, prevent fraud and abuse | Legitimate interests; legal obligation |
| Understand which features are used so we can improve them | Legitimate interests |
| Send service emails you need to receive | Performance of a contract |
| Send optional product news | Consent — withdraw any time |
4. What stays private
This matters enough to state plainly:
- Your financial figures are never published and are never sent to another user unless you choose to send them.
- Verification documents are never shown to other users. Only Narravec reviewers see them.
- A growth partner liking or saving your business is anonymous. You may see how many are watching, never who.
- Your contact details reach a partner only after you accept an engagement and tick the agreement naming exactly what will be shared.
- Your public listing contains only what you chose to publish.
5. Who we share with
Service providers acting for us
We use a small number of providers to run Narravec. They process personal data only on our instructions, under contract, and may not use it for their own purposes:
| What they do | What they handle |
|---|---|
| Hosting, database, file storage and sign-in | Account details, everything you save, documents you upload |
| AI processing | Only the content needed for the feature you used. They are not permitted to train models on it. |
| Email delivery | Your email address and the message being sent |
| Payment processing (when paid plans launch) | Handled by the payment provider. We do not receive or store your card details. |
| Publishing to a Connected Channel, if you connect one | Only the content you asked us to publish |
We will publish the specific providers before the platform opens to the public, and will update that list when it changes.
We do not sell personal data, and we do not share it for anyone else's advertising. We share only with:
- Other users — as described above, and only what you published or agreed to share.
- Infrastructure providers — hosting, database and storage (including Supabase and our hosting provider), who process data on our instructions.
- AI providers — the content needed for a feature you invoked. They act as processors and are not permitted to train models on your content.
- Channels you connect — the content you instruct us to publish.
- Payment providers — to take payment. We do not store card details.
- Professional advisers and authorities — where legally required, or to establish or defend legal claims.
6. International transfers
Narravec serves users worldwide, and our providers operate globally, so your data may be processed outside your country. Where it leaves a region with data-transfer restrictions, we rely on appropriate safeguards such as standard contractual clauses. You may ask us which safeguards apply to you.
7. How long we keep it
- Account and business data — while your account is open.
- After you delete your account — removed within 30 days, except where we must keep something longer for legal or accounting reasons, or to resolve a dispute.
- Verification documents — kept while the badge is active, then removed within 90 days of expiry or withdrawal.
- Activity logs — up to 24 months, for security and dispute resolution.
- Inactive accounts — where an account is untouched for an extended period we will contact you before removing anything, and will not delete without notice.
8. Your rights
Wherever you live, we offer the same controls:
- Access and portability — export your data from Settings.
- Correction — edit your information at any time.
- Deletion — request account deletion from Settings. We will confirm and act within 30 days.
- Withdraw consent — turn off optional processing, or revoke a contact-sharing agreement, in Settings. Contact already sent to a partner cannot be recalled.
- Object or restrict — tell us and we will consider it and reply.
- Complain — to us first, and to your local data-protection authority if you remain unsatisfied.
We do not make decisions with legal effect about you by automated means alone. AI produces suggestions; people decide.
9. Security
We use encrypted connections, hashed passwords, database-level access rules so users can only reach their own rows, encrypted storage for tokens granted by connected channels, and audit logs for sensitive actions. No system is perfectly secure; if a breach affects you we will notify you and the relevant authority as the law requires.
If something goes wrong
If a security incident affects your personal data, we will:
- act to contain it and find out what happened;
- notify the relevant supervisory authority where the law requires it, within the time that law allows — under GDPR-style rules, ordinarily within 72 hours of becoming aware;
- tell affected users directly, without undue delay, where the incident is likely to put them at high risk;
- explain what happened, what data was involved, what we have done, and what you should do.
We will not stay silent about an incident that affects you. If you believe your account has been accessed by someone else, tell us at privacy@narravec.com immediately.
10. Cookies and similar technologies
We keep this deliberately small. Narravec uses only what it needs to work.
| What | Why | How long |
|---|---|---|
| Sign-in and session (strictly necessary) | Keeps you signed in and secure between pages. Without these you cannot use an account. | Until you sign out or the session expires |
| Local storage on your device (strictly necessary) | Remembers your place in a mode, drafts you have not saved, and small preferences, so you do not lose work. | Until you clear it, or you sign out |
| Tracked links (only if you use them) | If you publish a Narravec tracked link in your own advertising, we count the visit so you can see which channel sent people. We count the visit, not the person. | Counted at the time; no profile is built |
What we do not use: advertising cookies, cross-site tracking, third-party marketing pixels, and data brokers. We do not build advertising profiles, and we do not let anyone else do so through our pages.
Because the cookies we set are strictly necessary to provide a service you asked for, they do not require consent under GDPR-style rules. If we ever add anything beyond that, we will ask you first and you will be able to refuse without losing access to the platform. You can clear or block cookies in your browser at any time, but sign-in will stop working.
Third-party platforms you choose to connect set their own cookies under their own policies, which we do not control.
11. Children
Narravec is for business use by adults. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will remove it.
12. Changes
If we change this policy materially we will notify you in the platform or by email before the change takes effect. Each version is dated.