Narrato is a product-analytics service: you send us events from your app, and you ask questions about them in plain language. This policy explains what we collect, why, who helps us process it, how long it’s kept, and how to delete it. It’s written to be accurate rather than broad, so if something here doesn’t match what you see, tell us at support@narrato.app.
Narrato is in an invite-only preview. Paid plans aren’t live yet; where this policy describes billing, it describes how billing works once they are.
Two kinds of data
- Your account data. Information about you and your team as Narrato customers. We decide how it’s used, as described below.
- Your users’ event data. The events your apps send us about your end users. We process it only to provide the service to you. You decide what to send, and you’re responsible for having the right to send it (notice and consent where your law requires them).
Account data we collect
- Account and team details, through our sign-in provider: your name, email address, team name and memberships, and roles.
- What you create in Narrato: projects and their write keys, your project’s data dictionary, conversations with the assistant, dashboards, reports, files you upload for reports (CSV, TSV, JSON, text or Markdown, up to 5 MB each), and feedback you send from the console (with the page you sent it from).
- Usage records: daily event counts per project, assistant message and token counts, used for quotas and billing.
A workspace is your personal account or a team. Plans, quotas and storage limits apply per workspace.
- Billing (once paid plans launch): payments are handled by Stripe. We store your Stripe customer and subscription identifiers and your plan, never card details.
- Technical data: our servers log each request’s IP address, path and status for security and debugging.
Data about your end users
When your app uses the Narrato SDK or API, each event can contain:
- the event name, a timestamp, the platform, your app version and the SDK version;
- identifiers: an anonymous device id generated in the browser, a session id,
and the user id you pass to
identify()(we recommend your own internal id, not an email address); - for automatic page views: the page URL, path, query string, title and
referrer. Query parameters that look like credentials are replaced with
[redacted]before sending; - the browser’s user agent string;
- any properties you choose to send, and any location fields (country, city, region) you choose to set;
- the sender’s country, which we look up from the IP address (see below) unless the event already has one.
The SDK stores its ids and a small offline queue in the browser’s
localStorage. It sets no cookies, and it doesn’t capture clicks or form
input.
IP addresses. When an event arrives, we attach the sender’s IP address unless you’ve supplied one. IP addresses and user agents travel with the event through our ingestion stream, which holds events for up to 7 days, and appear in our request logs (30 days). They are not stored in the analytics database you query. When an event arrives, we look up the country for its IP address and store only the two-letter country code with the event. The lookup runs on our own servers against a copy of the IP to Country Lite database by DB-IP (licensed under CC BY 4.0), so IP addresses are never sent to DB-IP. We don’t look up a region or city.
What not to send, and how to keep personal data out of events, is covered in the Privacy & PII guide.
The assistant and AI processing
Narrato’s assistant uses large language models from Anthropic. To answer a question, we send Anthropic:
- your messages, and the conversation so far;
- your project’s data dictionary and the names and properties of your events;
- the results of the queries the assistant runs for you (up to 100 rows per query);
- short samples (about 4,000 characters) of any files you attach to a report.
That can include values from your end users’ events. Anthropic processes this content under its commercial API terms to generate the response. We don’t send your data to any other AI provider.
Our own analytics
Our website uses Narrato itself, with the same SDK and the same behaviour
described above: page views, an anonymous id in localStorage, no cookies.
When you join the waitlist, your email address goes to our sign-in provider,
which runs the waitlist, and is also recorded with the waitlist event in our
own analytics, where it’s kept like any other event (see
How long we keep it). The console doesn’t run
analytics.
Cookies
Our website and the SDK set no cookies. The console uses strictly necessary cookies, set by our sign-in provider, to keep you signed in.
Who processes data for us
| Provider | What for | What it receives |
|---|---|---|
| Amazon Web Services (US, us-east-1) | Hosting, storage, databases, email delivery, security monitoring | All service data |
| Clerk | Sign-in, accounts, teams, the waitlist | Account details, waitlist emails |
| Anthropic | The assistant | As described above |
| Stripe (once paid plans launch) | Payments, invoices, tax | Billing details |
| Cloudflare | Bot protection on the sign-in form (through Clerk) | Browser signals during sign-in |
| Google Fonts | Fonts on our website and console | Your IP address, when the browser loads font files |
We don’t sell personal data, and we don’t use your data or your users’ data for advertising.
Where data is stored
Narrato runs in AWS’s US East (N. Virginia) region. If you’re outside the United States, your data is transferred there.
How long we keep it
| Data | Kept for |
|---|---|
| Events in the analytics database | Queryable for 13 months. After that they’re no longer queryable, but the stored files aren’t yet deleted automatically. We’re adding that and will update this page. |
| Events in the ingestion stream (including IP and user agent) | Up to 7 days |
| Request logs (including IP addresses) | 30 days |
| Database backups | 14 days |
| Deleted or replaced event files (versioned storage) | 30 days |
| Assistant conversations | Until you delete them, or the project or account |
| Uploaded files | Until replaced (each workspace keeps up to 100 files / 250 MB, oldest removed first), deleted, or 30 days after their project is archived |
| Account, projects, dashboards, reports, data dictionary | Until you delete the project or your account |
| Usage counts (numbers only, no event content) | Kept as billing records, including after a project is deleted |
Deleting data
- A project: delete it from its page in the console. Its write keys stop working within about a minute. Its conversations, files, data dictionary, dashboards and reports are deleted immediately. Its events are queued for deletion and removed from analytics, usually within days.
- Your account or a team: deleting it does the same for every project it owns.
- One of your end users: email us the project and the
user_idyou send for that person, and we’ll delete every event carrying it, usually within days. Events without that id can’t be attributed to the person. - Archived projects stop receiving data but aren’t deleted. Ask us and we’ll delete one.
Deleted data can remain in database backups for up to 14 days, and deleted event files in versioned storage for up to 30 days.
You can also ask us at support@narrato.app for a copy of your account data, to correct it, or to delete it.
Security
- Encryption: data is encrypted at rest. Traffic to Narrato uses HTTPS, and our cache connections use TLS.
- Tenant isolation: every query is limited server-side to the projects you can access, including the assistant’s queries. Automated adversarial tests cover it.
- Access and monitoring: production access goes through AWS’s managed access tools, with no open SSH. Changes to our infrastructure are audit-logged, and a web application firewall filters known-bad traffic.
Children
Narrato is a business tool and isn’t directed at children under 16.
Changes
We’ll update this page when what we do changes, and list each change below with its date.
- October 10, 2026: first version.
Contact
Questions or requests: support@narrato.app.