Privacy Policy

Who is responsible for your data

Controller

Jesus Valera Reales

Address

Sigmaringer Str. 36, 2. OG10713 BerlinGermany

Contact

hello@narrale.com

What we collect

Your account: an email address, and a name if you give us one. If you sign in with Google we receive your email address and profile name from Google, nothing else.

Your work: the chapters, notes, characters, locations and comments you write, plus the settings that make the app behave the way you like. We do not read it, and no human at Narrale opens your manuscript.

What we use it for

To run the app: to sign you in, store your writing, sync it between your devices, and email you things you asked for — magic links, mentions, and notifications you can switch off.

We do not profile you, we do not build an advertising audience, and we do not sell or rent your data to anyone, ever.

The legal basis for each use

Running your account and storing your writing is processing necessary to perform our contract with you (Art. 6(1)(b) GDPR). Without it there is no service to provide.

Keeping the service secure and working — rate limits, abuse prevention, error logs — rests on our legitimate interest in a service that stays up and is not abused (Art. 6(1)(f) GDPR). The waitlist, and loading Paddle to show you local prices, rest on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

Where tax or commercial law requires us to keep a record, the basis is our legal obligation (Art. 6(1)(c) GDPR). Giving us your data is not a statutory requirement, but an email address is necessary to have an account at all: without one we cannot create one for you.

AI features

When you ask for an editorial lens, a Story Bible extraction, or continuity tracking, the relevant chapter text is sent to our AI provider, OpenAI, so it can return the analysis. This happens only when you invoke the feature. Nothing is sent in the background as you type.

Narrale does not train models on your writing, and never sends it anywhere for that purpose. The provider receives it only to produce the analysis you asked for, and only at the moment you ask. If you never use an AI feature, your manuscript never leaves our servers.

Who else touches your data

A small number of processors, each for one job: OpenAI for AI analysis, Google for optional sign-in, Paddle for payments (your card details go to them and never reach us), and an email provider for transactional mail.

Our hosting and database run on Laravel Cloud, on Amazon Web Services infrastructure in its Frankfurt region, so your account and your writing are stored in the European Union. In front of the site sits Cloudflare’s network, which fends off attacks and sees your IP address to do so. If you join the pre-launch waitlist, or write to us through “Chat with us”, that reaches us as a Telegram message carrying your email address and whatever you typed, nothing more. A waitlist address is used for exactly one thing: telling you when Narrale opens.

Data outside the EU

Narrale itself runs in the European Union: hosting and the database sit in Laravel Cloud’s Frankfurt region, on Amazon Web Services infrastructure, so your account and every word you write are stored here. What lies outside the EU is tied to particular features: OpenAI for AI analysis, Google for optional sign-in, and Paddle for payments, all in the United States, plus Telegram, which is how a waitlist signup or a message to us arrives. Cloudflare, whose network sits in front of the site, is a US company too; it handles your requests at the location nearest to you, which for readers in Europe is in Europe.

The US transfers are covered by the European Commission’s Standard Contractual Clauses, and by the EU–US Data Privacy Framework where the provider is certified under it. The Telegram notification carries only your email address and, if you wrote one, your message; it is sent because you asked to hear from us, which is what permits it under Art. 49(1) GDPR. We will send you a copy of the safeguards if you ask. If you never use an AI feature, never sign in with Google and never write to us, nothing you have written leaves the EU at all.

Storage, export and deletion

Your writing lives in an encrypted-in-transit connection to a PostgreSQL database. You can export any story at any time as DOCX, EPUB, PDF, Markdown and other formats — your work is never locked in.

Delete a story and it goes. Delete your account and everything attached to it is removed from our live systems; backups age out on their own schedule. We keep nothing to change your mind with.

Concretely: your stories and account data are kept for as long as your account exists. Delete the account and they leave our live systems within 30 days, and our backups within 90. Records that tax or commercial law obliges us to keep are held for the statutory period — up to ten years — and used for nothing else. Waitlist addresses are deleted once the launch email has gone out, or sooner if you ask.

Your rights, and how to reach us

You can access, correct, export or delete your data from inside the app. If you are in the EU or UK you also have the right to object, to restrict processing, and to complain to your data protection authority.

Questions about any of this are always welcome: hello@narrale.com. We answer them ourselves.

You can withdraw consent at any time with effect for the future; doing so does not make what happened beforehand unlawful. The export function serves your right to data portability: it hands you, in a standard JSON file and whenever you want, every story you own with its chapters and text, together with the highlights, comments, planning canvas, Story Bible and "Ask the editor" conversations on those stories, plus your support messages, writing record and account settings. The file lists what it leaves out and why, chiefly version history and AI-generated reports, which we will send you on request at hello@narrale.com. There is no automated decision-making that produces legal effects, and no profiling.

Complaints

If you think we have handled your data wrongly, tell us first — hello@narrale.com — and we will look into it properly rather than defensively.

You also have the right to complain to a data protection supervisory authority: the one where you live, the one where you work, or the one where you think the problem happened, whichever suits you. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, the supervisory authority for Berlin.