Skip to main content

    Privacy policy

    How we collect, use, and protect your personal data

    Last updated: October 2026

    1. Information we collect

    We collect information you give us directly. That is your name, email and organisation details through contact forms. For invited pilot users, it is also the Sada registration. We also collect data automatically: cookies, analytics data and usage patterns. If you work with us, we also process data from that work. For example meeting notes and recordings of conversations for notes and evaluation.

    2. How we use your information

    We use your information to provide our services and answer your questions. With your consent, we send you newsletters. We also use it to improve our website and services. And to meet legal obligations and protect against fraud and abuse.

    3. Legal basis for processing

    Under the GDPR, we process data on these grounds. Consent (newsletters, cookies) and contractual necessity (service delivery). Legitimate interests (website improvement, security) and legal obligations (tax records, compliance).

    4. Data sharing & third parties

    We don’t sell your data. We only share data with service providers we need for our work, and when the law requires it. For this website these are Supabase (hosting, and counting to stop abuse) and HubSpot (contact forms, newsletter and calls). When you book a call, we send the invite and two reminders by email through Resend. If you add your own agenda, we read it once. We only see if you are free or busy, and we do not keep the link. To suggest a video app, we look up your email domain in the public DNS. Your address itself does not go there. Only with your consent, they are also PostHog and Google Analytics (analytics). For our services we use Google Workspace (email, calendar, documents and video calls) and Sembly (AI meeting notes). Also HubSpot (CRM, contact and newsletter), Notion (workspace and notes) and the AI assistants Claude (Anthropic) and ChatGPT (OpenAI). We choose providers with appropriate safeguards. Where needed, we make data processing agreements.

    5. Cookies & tracking

    We use cookies to make the website work and to remember your preferences. And for analytics: PostHog for product analytics, including session recordings. And Google Analytics via Google Tag Manager for marketing analytics. Session recordings mask all form inputs and sensitive data by default. You can accept, decline or customise cookies in the cookie banner. This section describes the cookies we use. With Remembering, your browser keeps your group and interests between visits, in your browser only. Our own calendar for booking a call sets no cookies. If it does not work for a moment, we show the HubSpot calendar. HubSpot only sets cookies once you open that calendar yourself. The page Personalisation lists every measuring point and why we use it. And what we know about you right now.

    6. Your rights under GDPR

    We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR). We process data lawfully, transparently, and only for specified purposes.

    Right to access
    You can request a copy of all personal data we hold about you. We will provide this within one month of your request.
    Right to rectification
    If your data is inaccurate or incomplete, you have the right to have it corrected or completed.
    Right to erasure (‘right to be forgotten’)
    You can ask us to delete your personal data. That applies when we no longer need it for the purpose we collected it for. Or when you withdraw your consent.
    Right to restrict processing
    You can ask us to limit how we use your data. That applies while we check whether it is correct, or while we assess your objection.
    Right to data portability
    You can request your data in a structured, commonly used format to transfer to another service provider.
    Right to object
    You can object to processing based on legitimate interests or for direct marketing purposes at any time.
    Rights related to automated decision-making
    You have the right not to be subject to decisions based solely on automated processing. Sada AI provides recommendations with human oversight. Sada is currently available only to invited pilot users.

    How to exercise your rights

    To exercise any of these rights, email us at impact@narrate.works with: • Your full name and email address • The specific right you wish to exercise • Any relevant details or documentation We will respond within one month. For complex requests, we may extend this by two months, keeping you informed.

    Right to complain

    If you believe we have not handled your data correctly, you have the right to lodge a complaint with: Autoriteit Persoonsgegevens Website: autoriteitpersoonsgegevens.nl Phone: +31 70 888 85 00 We encourage you to contact us first so we can address your concerns directly.

    Data breach notification

    A data breach may happen that poses a risk to your rights and freedoms. Then we notify you and the supervisory authority within 72 hours of finding out.

    Children’s privacy

    Our services are not directed at children under 16. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.

    7. Data retention

    This is how long we keep data. Active accounts: as long as you use the account, plus 1 year. Newsletter subscribers: until you unsubscribe. Contact form submissions: 2 years. Analytics data: 14 months. Legal records are kept as long as the law requires.

    8. Data security

    We take appropriate security measures, including encrypted data transmission (HTTPS), secure authentication, multi-factor authentication and access limited to Jeroen Wilms. See our security policy for details.

    9. International transfers

    We store data in the EU where we can. Some providers may process data outside the EEA, mainly in the United States. These are HubSpot, Google, Resend, Sembly, Notion, Anthropic and OpenAI. Any such transfer is covered by GDPR safeguards, such as standard contractual clauses or an adequacy decision.

    10. Contact & complaints

    For privacy questions or to exercise your rights, contact us at: impact@narrate.works. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).