Privacy Policy

1. Our Role

Depending on the circumstances, NarraLoom may process personal information in different roles.

Information NarraLoom controls

NarraLoom generally acts as the business or controller for information we determine how and why to use, such as:

• website visitor information;
• NarraLoom account information;
• billing and commercial information;
• support communications;
• NarraLoom marketing information;
• security and service-usage information; and
• information submitted directly to NarraLoom through our public websites.

Information processed for customers or agency partners

When NarraLoom processes personal information on behalf of a customer or agency partner within a workspace, NarraLoom may act as a processor or service provider.

In those circumstances, the customer or agency partner may determine the purposes and means of processing, and its own privacy notice may also apply.

If you use NarraLoom through an agency-branded portal and have a question about information controlled by that agency, you may need to contact the agency directly. Where appropriate, we may forward a privacy request to the applicable customer or agency partner.

A separate Data Processing Addendum may govern certain customer-controlled personal data.

2. Personal Information We Collect

The information we collect depends on how you interact with the Services.

A. Identity and business contact information

We may collect:

• name;
• business email address;
• business telephone number;
• company or agency name;
• job title or role;
• company website;
• business location;
• agency or client affiliation; and
• similar professional contact information.

B. Account and authentication information

We may collect:

• account identifiers;
• user IDs;
• authentication status;
• login and security events;
• account roles and permissions;
• verification information;
• OAuth authorization information; and
• information needed to administer access to an account or workspace.

Where authentication occurs through a third-party identity provider, that provider may process credentials directly.

C. Onboarding and workspace information

We may collect information you provide to configure NarraLoom, such as:

• services and products;
• target customers;
• geographic markets;
• positioning;
• brand voice;
• writing preferences;
• approved terminology;
• restricted terminology;
• claims boundaries;
• prohibited topics;
• calls to action;
• compliance instructions;
• examples and source material;
• publishing preferences; and
• workspace settings.

D. Customer Content

We may process text, documents, images, files, prompts, notes, source material, content, instructions, and other information you submit through the Services.

The Services are not designed as a repository for bulk consumer databases or unnecessary personal information.

Please do not submit personal information that is not reasonably necessary for the business purpose for which you are using NarraLoom.

E. AI Search Visibility Audit information

When an audit is requested or generated, we may collect or create information such as:

• a business or agency domain;
• public website content;
• business name and business-category information;
• business location information;
• buyer questions;
• site-coverage observations;
• search and AI-system observations;
• mentions and citations;
• outside-source information;
• publicly available competitor or publisher information;
• audit evidence;
• audit scores;
• recommendations;
• content-gap information;
• content ideas; and
• report metadata.

Much of this information concerns businesses rather than individuals. If business information contains personal information, this Privacy Policy applies to the personal-information component.

F. Publicly available and third-party information

We may collect information from sources such as:

• publicly available business websites;
• public social profiles;
• search engines;
• AI search or answer systems;
• public directories;
• publications;
• public records where appropriate;
• authorized integrations;
• referral partners;
• agencies;
• service providers; and
• other lawful business-information sources.

G. Connected-service information

If you authorize a connection to a third-party platform, we may receive information such as:

• platform account identifiers;
• page or profile identifiers;
• account metadata;
• permission scopes;
• access or authorization tokens;
• connection status;
• publishing or delivery status; and
• information necessary to provide the requested integration.

NarraLoom does not require you to provide your social-media password to NarraLoom where an authorized OAuth or comparable connection is available.

H. Billing and transaction information

We may collect:

• billing contact details;
• subscription or Order information;
• invoice records;
• transaction status;
• payment method type;
• limited payment metadata; and
• other accounting information.

Payment-card or bank-account information may be collected and processed directly by our payment processors.

NarraLoom does not need to store full payment-card information when a payment processor handles that information directly.

I. Communications and support information

We may collect information contained in:

• emails;
• support requests;
• meeting requests;
• survey responses;
• feedback;
• account communications;
• sales communications; and
• other correspondence with us.

J. Device, log, and usage information

When you use the Services, we may automatically collect:

• IP address;
• browser type;
• operating system;
• device type;
• approximate location derived from IP;
• referring URL;
• pages or features used;
• links clicked;
• session information;
• timestamps;
• application events;
• error logs;
• diagnostic information;
• performance information; and
• security events.

K. Cookies and similar technologies

We use cookies and similar technologies for purposes such as:

• operating the website;
• maintaining sessions;
• protecting security;
• remembering preferences; and
• understanding website usage.

Our current public website also uses analytics technologies to understand website traffic and performance.

On narraloom.com, optional analytics technologies (Google Analytics 4 and Ahrefs Web Analytics) and optional marketing technologies (RB2B visitor identification, GoHighLevel affiliate attribution and LeadConnector chat) load only if you allow them through our cookie-preference controls. Essential technologies, such as sign-in storage, Cloudflare Turnstile and the record of your cookie choices, are always on.

Additional details may be provided in our Cookie Policy and cookie-preference interface.

L. Derived information

We may derive or infer information from data described above, such as:

• account preferences;
• likely business category;
• workflow configuration;
• content preferences;
• business fit;
• service usage patterns; and
• security-risk indicators.

3. Sensitive Personal Information

The Services are designed primarily for business information.

We do not intentionally request sensitive personal information unless it is necessary for an expressly authorized purpose.

Sensitive information can include information such as:

• Social Security or government identification numbers;
• financial-account credentials;
• precise geolocation;
• biometric or genetic data;
• medical diagnoses or treatment information;
• information revealing certain protected personal characteristics; or
• personal information concerning children.

Do not submit sensitive or regulated information merely because a text field or upload feature technically permits it.

Unless we expressly agree otherwise in writing, NarraLoom is not intended to receive protected health information subject to HIPAA, nonpublic financial information subject to GLBA, or other specially regulated customer records.

If you voluntarily provide sensitive information without authorization, we may process it only as necessary to provide the requested Service, secure the Services, comply with law, or delete it.

4. How We Collect Personal Information

We collect personal information:

• directly from you;
• from your organization;
• from an agency or customer that gives you access;
• automatically through your use of the Services;
• from cookies and analytics technologies;
• from publicly available sources;
• from authorized integrations;
• from service providers;
• from business partners and referrals; and
• from other lawful sources described in this Policy.

5. How We Use Personal Information

We may use personal information to:

Provide the Services

• create and maintain accounts;
• administer agency and client workspaces;
• authenticate users;
• provide audits and reports;
• create and deliver content;
• operate review and approval workflows;
• provide authorized integrations;
• generate analytics and reporting;
• provide customer support; and
• otherwise perform requested Services.

Personalize and configure the Services

We may use onboarding information, preferences, business context, and workspace settings to apply:

• brand voice;
• positioning;
• rules;
• compliance boundaries;
• content preferences;
• workflow settings; and
• other customer-specific configurations.

Operate AI Search Visibility features

We may process information to:

• research buyer questions;
• evaluate website coverage;
• observe search and AI-system results;
• classify sources;
• generate reports and recommendations;
• prioritize content opportunities; and
• measure changes over time.

Communicate with you

We may send:

• account communications;
• authentication or security messages;
• audit or report communications;
• onboarding information;
• billing notices;
• service notices;
• customer-support responses;
• requested information; and
• marketing communications where permitted by law.

Process transactions

We may use information to:

• process subscriptions and Orders;
• issue invoices;
• administer renewals;
• maintain accounting records;
• detect payment fraud; and
• resolve billing issues.

Secure and protect the Services

We may process information to:

• authenticate users;
• detect unauthorized activity;
• investigate fraud or abuse;
• prevent security incidents;
• troubleshoot;
• enforce our Terms and policies; and
• protect NarraLoom, customers, and third parties.

Improve NarraLoom

We may analyze usage, performance, error information, feedback, and aggregated or de-identified information to:

• maintain and improve existing features;
• develop new features;
• measure service quality;
• improve reliability; and
• understand how customers use the Services.

Meet legal obligations

We may process information to:

• comply with law;
• respond to lawful process;
• establish or defend legal claims;
• enforce agreements;
• maintain required business records; and
• protect legal rights.

6. AI and Automated Processing

Artificial intelligence and automated systems are part of NarraLoom's Services.

They may assist with:

• research;
• classification;
• extraction;
• summarization;
• content generation;
• content refinement;
• source analysis;
• quality checks;
• rule checks;
• originality analysis;
• recommendations; and
• report generation.

Information processed through these features may be sent to third-party AI or technology service providers acting as subprocessors or service providers to NarraLoom.

We limit such processing to purposes reasonably related to providing, supporting, securing, or improving the Services.

NarraLoom's Services are not designed to use personal information to make solely automated decisions about individuals concerning employment, credit, housing, insurance eligibility, medical treatment, criminal justice, or other decisions that produce legal or similarly significant effects.

NarraLoom may use aggregated or de-identified information for product analytics and improvement where that information does not reasonably identify an individual or customer.

7. Public and Shareable Audit Reports

Some NarraLoom audits are intended as public, prospect-facing, or shareable business reports.

A report may display information such as:

• the audited business's name;
• business website;
• public business information;
• audit findings;
• buyer questions;
• public outside sources;
• source URLs;
• business-category information;
• scores or observations; and
• recommendations.

A verification or contact email submitted to request an audit is not made public merely because the report is shareable unless the interface expressly states otherwise.

Do not place confidential or unnecessary personal information into a public-audit workflow.

8. Agency and White-Label Environments

NarraLoom supports agency-branded and white-label environments.

If you interact with NarraLoom through an agency-branded portal:

• the agency may receive information about your account and workspace;
• the agency may administer users and client workspaces;
• the agency may determine certain purposes for processing information;
• NarraLoom may process information on the agency's behalf; and
• the agency's own privacy policy may apply independently.

NarraLoom does not treat one customer's confidential workspace information as another customer's information merely because both customers use the same platform.

9. When We Disclose Personal Information

We may disclose personal information in the following circumstances.

Service providers and subprocessors

We may use vendors that provide:

• cloud hosting;
• database infrastructure;
• security;
• authentication;
• AI and content processing;
• search or data services;
• analytics;
• visitor identification and referral attribution, where you allow marketing technologies on our website;
• website chat;
• meeting scheduling;
• communications;
• email delivery;
• payment processing;
• customer-support tools;
• error monitoring;
• workflow automation;
• integration services; and
• other technology necessary to operate NarraLoom.

These providers may process information on our behalf subject to applicable contractual or legal restrictions.

Customers, agencies, and workspace administrators

Information associated with a customer-controlled workspace may be available to that customer's or agency's authorized administrators and users according to their permissions.

Connected services

If you instruct us to connect or interact with a third-party service, we may disclose information to that service as necessary to perform your request.

Legal and safety purposes

We may disclose information where we reasonably believe it is necessary to:

• comply with applicable law;
• respond to valid legal process;
• protect legal rights;
• investigate fraud or abuse;
• protect the security of the Services; or
• protect NarraLoom, our customers, or others from harm.

Business transactions

Information may be disclosed as part of a proposed or completed:

• merger;
• acquisition;
• investment;
• financing;
• reorganization;
• bankruptcy;
• sale of assets; or
• similar corporate transaction,

subject to appropriate confidentiality protections where applicable.

At your direction

We may disclose information when you direct or authorize us to do so.

10. Sale, Targeted Advertising, and Analytics

NarraLoom does not sell personal information for monetary consideration.

NarraLoom's public website uses cookies and similar technologies for essential functionality and, only if you allow them, for analytics and marketing.

If you allow marketing technologies, RB2B may attempt to identify the businesses, and in some cases the professional profiles of people, that visit our website, and GoHighLevel may record which referral or affiliate link brought you to our website.

Our optional marketing technologies operate on narraloom.com only when you allow Marketing through our cookie-preference controls. They remain disabled while your browser sends a Global Privacy Control signal. These controls govern whether optional marketing tracking runs on our website going forward; they do not erase information already received by third-party providers or necessarily control how those providers subsequently process it. You may exercise the privacy rights described in Section 16 using the procedures in Section 17.

RB2B's visitor-identification technology can match activity on our website with information held in RB2B's identity network, which may include professional or contact profiles. Information obtained this way may be used for business outreach, subject to applicable law. You can ask RB2B to exclude you from its identity network through its opt-out page at https://app.retention.com/optout. That request goes directly to the provider and is separate from our Cookie Preferences and from the privacy-rights procedures described in Sections 16 and 17.

Analytics providers may receive device and usage information when you interact with our website. Depending on the provider's technology and settings, the provider may be capable of associating information with activity on other websites or services.

Please review our Cookie Policy and available privacy controls for current information about cookies and analytics technologies.

11. Cookies, Do Not Track, and Universal Opt-Out Signals

You can control cookies using:

• browser settings;
• available cookie-preference controls, including the "Cookie preferences" link at the bottom of each page on narraloom.com; and
• other device or browser tools.

Blocking certain cookies may affect website functionality.

Consent choices on narraloom.com

When you first visit narraloom.com, you can choose Accept all, Reject all or Preferences. Optional analytics and marketing technologies stay off until you choose.

You may withdraw consent at any time through the "Cookie preferences" link. Withdrawal stops the optional technologies on our website from then on. It does not delete information a provider has already received, and we cannot remove cookies that other companies set on their own websites.

These choices apply to the narraloom.com public website, in the browser and on the device where you make them. They do not automatically apply to other NarraLoom applications or to third-party websites.

Do Not Track

There is no single universally adopted technical standard for browser-based "Do Not Track" signals.

Accordingly, NarraLoom does not currently respond to traditional Do Not Track signals except where applicable law requires otherwise.

Universal opt-out signals

Where applicable law requires us to recognize a legally valid universal opt-out mechanism, such as an eligible Global Privacy Control signal, we will process that signal for the browser or device from which it is received with respect to covered sale or targeted-advertising activity.

If we are not engaged in covered sale or targeted-advertising processing, an opt-out signal may not change our processing because there is no applicable activity from which to opt out.

In addition, when your browser sends a Global Privacy Control signal, narraloom.com keeps its optional marketing technologies off for that browser, even if you previously allowed them or choose Accept all. Analytics is a separate choice that the signal does not change.

12. Marketing Communications

You may unsubscribe from marketing email by:

• using the unsubscribe link included in the email; or
• contacting us at privacy@narraloom.com.

Opting out of marketing does not prevent us from sending necessary transactional, security, billing, support, or account communications.

13. SMS and Telephone Communications

If you voluntarily opt in to receive text messages, we may use your telephone number for the types of communications described when you opt in.

Message frequency may vary. Message and data rates may apply.

Consent to marketing text messages is not a condition of purchasing NarraLoom.

You may revoke consent through any reasonable method that clearly communicates your request, including replying STOP to supported SMS programs.

We may send a confirmation of your opt-out.

Mobile opt-in information and text-message consent are not sold or disclosed to third parties for their independent marketing purposes. They may be provided to communications vendors as necessary to deliver and administer the messaging program.

14. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, taking into account:

• the length of the customer relationship;
• the type and sensitivity of the information;
• the reason it was collected;
• account and service requirements;
• security requirements;
• legal and regulatory obligations;
• accounting and tax requirements;
• limitation periods;
• dispute and enforcement needs; and
• backup and disaster-recovery requirements.

For example, we may retain:

• account information while an account remains active and for an appropriate period afterward;
• billing and transaction records for legally required accounting periods;
• audit and report records where needed to maintain audit history and reporting continuity;
• workspace content while necessary to provide the Services;
• security logs for a period appropriate to security and fraud-prevention needs; and
• backups until they are overwritten or deleted under normal backup cycles.

When information is no longer reasonably necessary, we may delete, aggregate, anonymize, or de-identify it unless law permits or requires additional retention.

15. Data Security

NarraLoom uses administrative, technical, and organizational safeguards designed to protect personal information.

Measures may include, as appropriate:

• encryption;
• access controls;
• role-based permissions;
• authentication controls;
• tenant or workspace isolation;
• logging and monitoring;
• secure infrastructure;
• backup processes; and
• security review.

No security program eliminates all risk.

We therefore cannot guarantee that unauthorized access, disclosure, alteration, loss, or other security incidents will never occur.

If a security incident requires notification under applicable law, we will provide notice as required.

16. Your Privacy Rights

Depending on where you reside and whether an applicable privacy law applies to NarraLoom's processing, you may have rights such as the right to:

• confirm whether we process your personal information;
• access personal information;
• obtain a copy of personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain portable information where applicable;
• obtain information about categories of third parties to which data has been disclosed;
• opt out of the sale of personal information;
• opt out of targeted advertising;
• opt out of qualifying profiling or solely automated decision-making;
• withdraw consent where processing depends on consent;
• limit or object to certain sensitive-data processing;
• designate an authorized agent where permitted;
• appeal a denial of a privacy request; and
• exercise privacy rights without unlawful discrimination.

Not every right applies in every jurisdiction or circumstance.

Legal exemptions may permit or require us to retain or continue processing certain information.

17. How to Exercise Privacy Rights

You may submit a request by emailing:

privacy@narraloom.com

Please provide enough information for us to identify the relevant records and understand your request.

We may need to verify your identity before fulfilling a request.

We will not require you to create a new account solely to make a privacy request, although we may ask you to use an existing authenticated account where appropriate.

If an authorized agent makes a request on your behalf, we may request reasonable evidence of the agent's authority and may verify your identity directly where permitted by law.

We will respond within the period required by applicable law.

18. Appeals

If applicable law gives you a right to appeal a decision concerning a privacy request, email:

privacy@narraloom.com

Use the subject line:

Privacy Appeal

Explain the decision you are appealing and any additional information you want us to consider.

We will respond within the time required by applicable law.

If you are a Delaware resident and we deny an appeal covered by the Delaware Personal Data Privacy Act, you may submit a complaint to the Delaware Department of Justice at:

privacy@delaware.gov

Residents of other jurisdictions may also have the right to contact their applicable Attorney General, privacy regulator, or data-protection authority.

19. Information About Children

The Services are designed for business use and are not directed to children.

Users must be at least 18 to create an account unless NarraLoom expressly authorizes otherwise.

We do not knowingly collect personal information from children under 13 through the Services.

If you believe a child has provided personal information to us, contact privacy@narraloom.com.

20. International Users

NarraLoom is based in the United States.

Personal information may be processed in the United States and in other locations where our service providers operate.

Those locations may have different privacy laws from your country.

Where applicable law requires a lawful transfer mechanism, we will use an appropriate mechanism.

Legal bases where required

Where a jurisdiction requires us to identify a legal basis for processing, we may rely on:

• performance of a contract;
• steps requested before entering a contract;
• our legitimate interests in operating, securing, supporting, and improving the Services;
• consent;
• compliance with legal obligations; and
• establishment, exercise, or defense of legal claims.

Where applicable law provides additional rights, including rights to object to or restrict processing or lodge a complaint with a supervisory authority, we will honor those rights as required.

21. Third-Party Websites and Services

Our Services may link to or integrate with third-party websites, platforms, or services.

Their privacy practices are governed by their own policies.

NarraLoom is not responsible for the independent privacy practices of third parties.

You should review a third party's privacy information before providing personal information directly to that party.

For example, our booking page shows a scheduling page provided by Calendly. Calendly's own privacy and cookie practices apply to that page, and our cookie-preference controls do not govern it.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• the Services;
• our processing practices;
• technology;
• legal requirements; or
• business operations.

We will update the "Last Updated" date when the Policy changes.

If a change materially expands how we use personal information already collected or materially reduces a privacy commitment, we will provide additional notice or obtain consent where required by law.

We will not rely solely on a hidden or retroactive policy change where applicable law requires additional notice or consent.

23. Contact Us

For privacy questions or requests:

NarraLoom Inc.
8 The Green, STE B
Dover, DE 19901
United States

Privacy: privacy@narraloom.com
General: admin@narraloom.com
Security: security@narraloom.com
Phone: 888-870-4024