Privacy notice
NarraSight Ltd · Glasgow · Last updated [date]
Who we are
NarraSight Ltd, a company incorporated in Scotland (company number to be confirmed), registered office [registered office address], Glasgow. For privacy questions, contact [privacy contact email].
What we collect and why (lawful basis)
- Account data (name, email, organisation, hashed password) — to create and run your account. Basis: performance of a contract.
- Billing data (plan, billing email, Stripe customer/subscription identifiers; card data is handled by Stripe, not stored by us) — to take payment and manage subscriptions. Basis: contract and legal obligation (tax records).
- Usage data (API usage, image/description counts, audit-log events) — to operate, meter, secure and improve the service. Basis: legitimate interests (with an assessment) and contract.
- Marketing-site analytics — only if you consent to non-essential cookies. Basis: consent.
Customer content (our processor role)
The images and page content you submit for alt-text generation are processed on your instructions under the DPA. We do not use your content to train or improve any AI model, and we contractually require our model provider not to train on it either.
Who we share it with
We use the sub-processors listed at Sub-processors (hosting, database, queue, and the AI model provider), plus Stripe for payments. We do not sell personal data.
International transfers
Some providers process data outside the UK/EEA (notably the US AI model provider). Where they do, we rely on an appropriate safeguard — the UK IDTA/Addendum, EU Standard Contractual Clauses, or the UK-US Data Bridge — and a transfer risk assessment. Provider regions and mechanisms are being confirmed.
How long we keep it
Account and billing data for the life of your account plus any legally required retention; usage and audit logs for as long as needed for security, accountability and legal defence, then deleted. Customer content is deleted or returned at the end of service under the DPA.
Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing, and you can withdraw consent at any time. To exercise these, contact [privacy contact email]. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
Cookies
No non-essential cookies are set before consent; refusing is as easy as accepting. Authentication/session cookies in the portal are strictly necessary. A full cookie list will be maintained here.