Privacy Policy
This Policy explains what data Narevly processes, why it is processed, which providers receive it, how long it may be retained and what choices and rights users have.
Narevly processes screenshots because you ask it to analyze a conversation. The current app sends the screenshots to an AI API for that analysis and returns the result to your browser. The app should not be marketed as “never shared with anyone”: AI and infrastructure providers necessarily process data to deliver the service. We aim to minimize what is collected and ask users to redact unnecessary identifiers before upload.
Contents
1. Who is responsible for your data
The data controller for Narevly is [LEGAL BUSINESS NAME], [BUSINESS ADDRESS]. Privacy questions and data-rights requests should be sent to [PRIVACY EMAIL]. If a Data Protection Officer or EU representative becomes legally required, the relevant contact details will be added here before the Service is offered in the affected market.
2. Scope of this Privacy Policy
This Policy covers personal data processed when you visit or use the Narevly web application, upload screenshots for analysis, purchase or manage a subscription, contact support, or otherwise interact with the Service. Third-party websites and services have their own privacy practices.
3. Categories of data we process
Conversation inputs
Images/screenshots you choose to upload, including visible message text, timestamps, names/usernames, profile images or other information that may appear in the screenshot.
AI output
The generated analysis, which may include communication-pattern summaries, effort percentages, possible turning points, signals, likely-intent wording, next-move suggestions and a confidence score.
Payment and subscription data
Stripe checkout/session identifiers, subscription status, selected plan, transaction status and related billing metadata. Complete card details are handled by Stripe rather than being entered into Narevly’s own analysis backend.
Technical and security data
Depending on hosting configuration, infrastructure providers may process IP address, request time, browser/device data, error logs and security metadata needed to serve and protect the application.
Support data
Information you voluntarily include when contacting support or making a privacy/billing request.
4. Screenshots may contain data about other people
A conversation screenshot often contains personal data belonging to the other participant. Before upload, remove information that is not necessary for the requested analysis, especially full names, phone numbers, email addresses, exact locations, profile photos and account identifiers. Do not upload material you obtained unlawfully or from an account you were not authorized to access.
Narevly is designed to analyze communication patterns, not identify people. We do not need the other participant’s real identity to produce the analysis.
5. Why we process data and the legal basis
Subject to the final legal setup for the launch jurisdiction, the intended bases are:
- Providing the requested analysis and paid access: processing necessary to perform the contract with the user or take requested pre-contract steps.
- Billing and subscription administration: performance of the contract and compliance with accounting/tax obligations where applicable.
- Security, abuse prevention and service integrity: legitimate interests in protecting users, the Service and payment systems, balanced against privacy rights.
- Legal compliance: processing necessary to comply with legal obligations.
- Optional marketing/analytics: only where a valid consent or another lawful basis applies. The current MVP should not enable non-essential tracking by default.
The final controller should document the applicable Article 6 GDPR basis and, where special-category data can be processed, an applicable Article 9 condition before EU launch.
6. Special-category and highly sensitive information
Narevly is not intended for medical records, explicit sexual content, biometric identifiers, political/religious beliefs, government identifiers, financial credentials or other highly sensitive material. Relationship conversations can nevertheless incidentally reveal sensitive facts. Users are instructed to redact such content where it is not necessary.
If the product is intentionally expanded to process special-category personal data at scale, the operator should complete a dedicated GDPR assessment (including whether a DPIA is required) and document an appropriate Article 9 condition before that processing is enabled.
7. How AI analysis works
In the current implementation, uploaded screenshots are transmitted from Narevly’s backend to the OpenAI API so the model can read the visible conversation and generate a structured analysis. The application instructs the model to treat its conclusions as uncertain inferences, avoid mental-health diagnosis and avoid exposing personal data unnecessarily.
OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in. OpenAI also states that standard API abuse-monitoring logs may retain customer content for up to 30 days unless different approved retention controls apply. The operator should verify its OpenAI account’s current data-control configuration before launch and update this Policy if that configuration changes.
8. Payment processing
Stripe processes checkout and subscription payments. Stripe may receive your payment method, billing details, IP/device information and transaction metadata for payment processing, fraud prevention, compliance and its other documented purposes. Narevly receives the information needed to verify payment and manage access, but the analysis code does not need your full card number.
9. Browser storage used by the current app
The current web app uses browser storage for limited functionality. It may store a payment/session reference and an access flag in localStorage, and may temporarily store the generated analysis in sessionStorage so it survives the Stripe checkout redirect. Browser storage remains on that device/browser until removed by the app, the user or browser settings.
The current frontend does not intentionally save the uploaded image files to localStorage or sessionStorage. Image previews are generated locally in the browser, while the selected files are sent for analysis when you press the analysis button.
10. Service providers and recipients
Data may be processed by providers required to operate the Service, currently including: OpenAI for AI inference; Stripe for payments/subscriptions; and Cloudflare (or the configured hosting/infrastructure provider) for hosting, routing, security and server functions. Professional advisers, authorities or other recipients may receive data where required by law or necessary to establish, exercise or defend legal claims.
Before launch, the operator should maintain a current processor/subprocessor list and appropriate data-processing agreements.
11. International data transfers
Some technology providers may process data outside your country or the European Economic Area. Where GDPR Chapter V applies, the operator must ensure an appropriate transfer mechanism, such as an adequacy decision or approved contractual safeguards, and provide further information on request where required.
12. How long data is kept
Narevly application layer: the current analysis endpoint is designed to return the analysis without intentionally writing screenshots to a Narevly database. Generated analysis may remain temporarily in your browser session, and access/payment references may remain in local browser storage.
AI provider: provider-side retention is governed by the configured API data controls. Under OpenAI’s standard API data-control documentation, abuse-monitoring logs may retain customer content for up to 30 days unless approved reduced-retention controls are enabled.
Payments and legal records: payment/subscription and accounting records may need to be kept for periods required by tax, accounting, fraud-prevention or other law. Support correspondence is kept only as long as reasonably needed for the request and related legal/security needs.
13. Security
We use reasonable technical and organizational measures appropriate to the Service, including server-side API secrets, HTTPS in production, access controls and data-minimization practices. No internet service can guarantee absolute security. Users should redact unnecessary identifiers and avoid uploading information that is not needed for the analysis.
14. Your privacy rights
Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent where consent is the basis, and information about processing. EU/EEA users may also lodge a complaint with a competent supervisory authority. Rights can be subject to legal exceptions and identity verification.
Requests should be sent to [PRIVACY EMAIL]. The operator should respond within the time required by applicable law.
15. Children
Narevly is intended for adults and is not designed for children. Do not upload conversations involving minors for relationship analysis. If we learn that personal data of a child has been submitted inappropriately, we may delete or restrict the material and take other appropriate steps.
16. Cookies, analytics and advertising technologies
The current MVP does not need non-essential advertising trackers to perform the core analysis. If analytics, advertising pixels or similar technologies are later added, this Policy and any cookie/consent interface must be updated before those technologies are activated where consent is legally required.
17. Changes to this Policy
We may update this Policy when the product, providers, retention practices or legal requirements change. The effective date will be updated, and material changes will be communicated where required.
18. Contact and complaints
Controller: [LEGAL BUSINESS NAME]
Address: [BUSINESS ADDRESS]
Privacy email: [PRIVACY EMAIL]
Support/billing email: [SUPPORT EMAIL]
EU/EEA users also have the right to complain to the data-protection supervisory authority competent for their place of residence, work or the alleged infringement.