Privacy Policy

Account data: your email address, authentication metadata, assigned role, and basic profile information. Settings: preferences you save (e.g. theme and reading position). Assistant conversations: if you use the “Ask” assistant, the questions you ask and the answers you receive are saved to your account so you can revisit them; they are visible only to you, and you can delete any conversation — or your entire chat history — at any time from within the tool. Notes you write in the Notepad tool are stored only in your browser (local storage) and are never sent to our servers. Usage/operational data: limited logs (such as request metadata, rate-limit counters, and per-account AI usage counts) needed for security, abuse prevention, cost control, and reliability. Billing data: handled by our payment processor — see “Payments” below. Campaign attribution:if you arrive from a tagged link (e.g. an ad or a campaign URL), the campaign tags and referring site are saved with your account — see “Cookies, advertising & analytics” below. We do not sell your personal data.

To authenticate you, enforce role- and tier-based access, operate and secure the Service, prevent abuse and control costs, and communicate about your account. Intelligence content is generated on a shared schedule and is not personalized from your private data.

We use third-party providers to run the Service. As of the “Last updated” date they are: Vercel (application hosting and deployment), Supabase (authentication, database, and file storage), OpenAI (AI content and audio generation — under API terms that do not use our data to train their models), Resend (transactional email delivery), Google (optional “Sign in with Google”), Cloudflare (DNS, network, and inbound email routing), and Stripe (payment processing — see “Payments” below). If — and only if — you accept advertising cookies, Meta and Xalso receive the limited measurement events described in “Cookies, advertising & analytics” below; unlike the providers above they act as independent controllers of that data, not as processors for us. Market and social data feeds (e.g. CoinGecko, the X API) supply content to the Service and do not receive your personal data. API keys and secrets used for content generation are held server-side and are never exposed in the application frontend or in any mobile bundle. These providers process data on our behalf under their own security and privacy commitments, and we will keep this list current as our infrastructure changes.

Payments are processed by a third-party payment processor, Stripe. We follow a processor-first model: card and payment details are entered with and stored by the processor, not by NarvixAI. We retain only limited subscription metadata (such as plan, status, and renewal date) needed to provision your access.

Strictly necessary: we use necessary cookies/local storage to keep you signed in and to remember preferences (such as your theme and reading position). These are required for the Service to work and are always on.

Advertising measurement: on our public pages we use the Meta Pixel and the X (Twitter) Pixel so we can tell which of our ads bring people to NarvixAI. We currently operate for a United States audience, so these load by default, and the first time you visit we show a notice with a one-click opt-out. You can opt out at any time — when you do, we stop loading them and store that choice in your browser, and no further advertising data goes to Meta or X. These pixels are limited to our public pages and the upgrade page; they are never loaded on intelligence modules or briefs, so what you read inside the product is not shared with any advertising network.

When loaded, these pixels tell Meta/X that a browser viewed a page, created a free account, or started checkout, along with the data those networks collect automatically (such as IP address, browser information, and their own cookies). We send event names only — we do not send your email address, name, user ID, or any content you read, and we deliberately disable the “advanced matching” and automatic form/button collection features these tools offer by default. Their handling of that data is governed by their own policies (Meta and X).

Campaign attribution (first-party): when you arrive from a link that carries campaign tags (such as utm_source) or an ad-click identifier, we store those tags — plus the site that referred you — in your browser. If you then create an account, they are saved to your account record so we can understand which campaign it came from. This stays with us; it is not shared with advertising networks, is not used to profile you or personalize content, and is deleted with your account.

We do not use third-party analytics products and we never sell your personal data. We are also direct with you about the other half of that phrase: while the advertising pixels above are active, that disclosure to Meta/X may qualify as “sharing” for cross-context behavioral advertising under some US state privacy laws. The opt-out in the notice — available on every visit until you use it — is your control to stop that sharing; once you opt out, the pixels no longer load and nothing further is shared.

Access is restricted to approved roles and protected by authentication and row-level security. Exposed API routes use authentication, authorization, and rate limiting. We do not embed secret API keys in client code or mobile bundles. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect data.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can export your data and permanently delete your account yourself, at any time, from Account settings → Your data. For access or correction requests you can also reach us via the Support page; we action reasonable requests consistent with legal and operational obligations.

We retain account data for as long as your account is active and as needed to comply with legal obligations, resolve disputes, and enforce agreements. When you delete your account from Account settings, we permanently remove your authentication record and the personal data linked to it — your profile, role, saved settings, and your assistant conversations — right away; any content you authored is kept with your identity removed. Notepad notes, which live only in your browser, are cleared from this device when you delete your account.

Typical retention periods: account and profile data — deleted immediately on account deletion; assistant conversations — kept until you delete them in the tool, and deleted immediately when you delete your account; security, rate-limit, and usage logs — up to 24 months, for abuse prevention and cost auditing; encrypted database backups — deleted data rolls out of backups within about 30 days; email delivery logs — held briefly by our email provider; billing and subscription records — retained for up to 7 years where required for tax, accounting, and audit purposes. We may retain specific information longer where the law requires it.

The Service is not directed to children and is intended for users 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us via Support.

The Service may be operated from, and data processed in, the United States or other countries. By using the Service you understand your information may be transferred to and processed in locations with different data-protection laws than your own.

We may update this Policy; the “Last updated” date reflects the latest version. Privacy questions can be sent via the Support page or to support@narvixai.com.