Privacy notice
NarraSight Ltd · Glasgow · Last updated 1 October 2026
Who we are
NarraSight Ltd, a company incorporated in Scotland (company number SC857212), registered office Graham Hill Building, 50 Richmond Street, Glasgow G1 1XP. For privacy questions, contact hello@narrasight.com.
What we collect and why (lawful basis)
- Account data (name, email, organisation, hashed password): to create and run your account. Basis: performance of a contract.
- Billing data (plan, billing email, Stripe customer/subscription identifiers, and card data is handled by Stripe, not stored by us): to take payment and manage subscriptions. Basis: contract and legal obligation (tax records).
- Usage data (API usage, image/description counts, audit-log events): to operate, meter, secure and improve the service. Basis: legitimate interests (with an assessment) and contract.
- Marketing-site analytics: we run none. If we ever add them, nothing will be set before you consent. Basis: consent.
- Health Score service records (the public web address scanned, the resulting score and when): kept to operate the free scanner, build aggregate benchmarks, understand demand and decide which organisations to contact about NarraSight. We do not record who ran a scan unless you ask us for the report. Basis: legitimate interests. If you do ask for the report, we also keep your email address, the page scanned, your score, and the readiness rating and any words you type in the readiness box, and we store them in Microsoft Azure, UK South, to send you your report and, only if you ticked the box asking for them, up to two short follow-ups about it. Basis: legitimate interests for the report you asked for, and your consent for the follow-ups. You can object or withdraw at any time by replying with the word stop, and we stop at once. We read replies to our mailbox so that anyone who says stop is not emailed again.
Customer content (our processor role)
The images and page content you submit for alt-text generation are processed on your instructions under the DPA. We do not use your content to train or improve any AI model, and we contractually require our model provider not to train on it either.
Who we share it with
We use the sub-processors listed at Sub-processors: Netlify (website hosting), Fly.io (application hosting), Supabase (database), Upstash (queue), OpenAI and Microsoft Azure OpenAI (AI models), Microsoft Azure, UK South, which runs the form and report service behind the Health Score and the enquiry forms (Azure Container Apps and Azure Storage), Azure Communication Services (email) and Stripe (payments). On the live demo, if you choose to enter your own OpenAI key, your browser sends the image and the key directly to OpenAI under your own OpenAI account, not through NarraSight. We do not sell personal data.
International transfers
Some providers process data outside the UK/EEA (notably the US AI model provider). Where they do, we rely on an appropriate safeguard (the UK IDTA/Addendum, EU Standard Contractual Clauses, or the UK-US Data Bridge) and a transfer risk assessment. Each provider's location and transfer mechanism is listed on the Sub-processors page.
How long we keep it
Account and billing data for the life of your account plus any legally required retention. Health Score report requests, enquiry-form messages and scan records for 12 months from your last contact with us, then deleted. Usage and audit logs for as long as needed for security, accountability and legal defence, then deleted. Customer content is deleted or returned at the end of service under the DPA.
Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing, and you can withdraw consent at any time. To exercise these, contact hello@narrasight.com. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
Cookies
The marketing site sets no cookies and runs no analytics scripts. The Health Score keeps your last five scans in your own browser so you can reopen them, and sends them nowhere. The NarraSight platform uses a strictly necessary authentication cookie only. Should we ever add non-essential cookies, none will be set before consent, refusing will be as easy as accepting, and the list will appear here.