Privacy & PII

Analytics data is only useful if you can keep it responsibly. This page is the short, honest version of how to do that with Narrato.

What not to send

Don’t put personal data in event properties unless you need it for analysis. In practice:

Never send: passwords, tokens, full payment details, government identifiers, health information, message/content bodies.
Avoid: raw email addresses and full names in properties. If you need to segment by domain, send the domain (email_domain: "example.com"), not the address.
Prefer stable pseudonymous ids: identify('user-42') with your internal user id, not an email. You can join to real identities in your own systems; Narrato never needs to know who user-42 is.

The SDK helps by not auto-capturing clicks or form input. Only page views are automatic, so nothing sensitive is hoovered up behind your back. Everything else is an explicit track() call you wrote.

What’s captured automatically

Page views (URL, path, title, referrer, and the referrer the visit arrived from) when autoPageviews is on.
A persistent anonymous id and session id (random, generated client-side).
app_version if you configure it, platform, the browser’s user agent, and the client IP as seen by our edge (you can also supply your own ip_address field from backends). Neither is stored in the analytics database you query.
country: the two-letter country code for that IP, looked up when the event arrives. An event that already sets country keeps its own value. Private and reserved addresses get none, and region and city are only what you set. The lookup uses IP Geolocation by DB-IP (the free IP to Country Lite database, CC BY 4.0) and runs on our servers, so IP addresses aren’t sent anywhere for it.

Our Privacy Policy covers the legal side: who processes data for us, and how long each kind is kept, including the IP addresses above.

Narrato doesn’t inject a consent banner or make consent decisions for you, because you know your jurisdiction and your users. The SDK is easy to gate: initialize it only after consent, or call shutdown() when consent is withdrawn (queued events stay local and unsent until re-init).

Deletion requests

Current state, stated plainly: you can delete a whole project yourself (below). Deleting events for a single end user inside a project (e.g. a GDPR/CCPA request from your end user) isn’t self-serve yet: contact us with the project and the user_id you send for them. We delete every event carrying that id, usually within days, and confirm when it’s done. Stop tracking that user first, or new events will keep arriving.

Archiving a project stops ingestion and removes it from the console, but is not a data-destruction guarantee. Delete the project when you need actual removal. Once a project is archived, the console can no longer delete it; ask us and we’ll remove it. Files you uploaded to an archived project are deleted 30 days after it was archived.

Deleting a project (from its page in the console, typing its name to confirm), closing your account, or deleting a team is different:

The affected projects’ write keys stop working, typically within a minute.
Their chat history, uploaded files, data dictionary, dashboards, and reports are deleted right away. Anything a still-running assistant request writes afterwards is removed within minutes.
Their events are removed from analytics within days.
Usage counts (numbers only, no event content) are kept as billing records.

Events older than 13 months age out for everyone (see limits).

Email we send you

Narrato emails your account (a personal workspace’s owner, or a team’s admins) only about things that need action:

your workspace crossing 80%, 100% or 120% of its monthly event quota (once per threshold per month);
a failed payment, or a paid plan ending;
a project’s write key being rotated or revoked.

Each new account also gets one welcome email with the first steps.

These are operational notices about your account, so there’s no unsubscribe. We don’t send marketing email from the product.

Feedback you send us

Messages sent with Feedback in the console are stored with your account (and the console page you sent them from) and emailed to the Narrato team. They’re deleted when your account is.

Where data lives

Your events are stored in Narrato’s infrastructure and are mechanically scoped to your account. Every read path is bounded server-side to the projects you can access (the same enforcement applies to the assistant), and adversarial tests in our suite cover that boundary.