1. Introduction
Narrative Consulting ("we," "us," or "our") operates the website at accessnarrative.com and provides identity governance consulting services. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have regarding your data.
By using our website or engaging our services, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of our website and services.
2. Data We Collect
We collect the following categories of personal information:
Information You Provide
- Contact details: name, email address, company name, and job title submitted through assessment intake forms, event registrations, newsletter sign-ups, or direct inquiries.
- Engagement data: information you provide during consulting engagements, including system configurations, access policies, and organizational structure relevant to identity governance.
- Payment information: billing details processed through Stripe. We do not store credit card numbers on our systems.
Information Collected Automatically
- Usage analytics: page views, session duration, referral source, and general geographic region collected via Google Analytics.
- Device information: browser type, operating system, and screen resolution for website optimization.
3. How We Use Your Data
- Service delivery: to perform identity governance assessments, buildouts, and advisory services you have engaged us for.
- CRM and communications: to manage our relationship with you, send engagement updates, and respond to your inquiries.
- Marketing: to send newsletters, event invitations, and relevant content about identity governance, and only with your consent. Every marketing email includes an unsubscribe link.
- Website improvement: to analyze usage patterns and optimize the user experience on our website.
- Legal compliance: to meet our legal obligations, enforce our terms, and protect against misuse.
4. Third-Party Services
We use the following third-party services that may process your data:
- Supabase: database hosting, authentication, and CRM data storage.
- Stripe: payment processing. Subject to Stripe's Privacy Policy.
- Resend: transactional and marketing email delivery.
- Anthropic: AI-assisted content generation. No client engagement data is sent to AI services.
- Google Analytics: website usage analytics and traffic measurement.
- LinkedIn API: social media content publishing and audience engagement.
- YouTube API: video content embedding and analytics. Subject to Google's Privacy Policy.
Each third-party service operates under its own privacy policy. We select vendors that maintain appropriate security controls and limit data sharing to what is necessary for the service provided.
5. Cookies and Tracking
Our website uses the following cookies:
- Google Analytics cookies (_ga, _gid) measure website traffic and usage patterns. These are analytics cookies that help us understand how visitors interact with our site.
- Session cookies: maintain your session state during a visit (e.g., form submissions, authentication). These are strictly necessary and expire when you close your browser.
We do not use advertising cookies or sell data to advertisers. You can disable cookies in your browser settings, though this may affect site functionality.
6. Data Retention
- Engagement data: all client data, working documents, and access artifacts are purged within 14 days of engagement closure. Written confirmation is provided upon completion of the purge.
- Subscriber data: newsletter and marketing contact information is retained until you unsubscribe. Upon unsubscribe, your data is removed from active marketing lists within 7 days.
- CRM records: basic contact information (name, email, company) for past clients is retained for business relationship management unless you request deletion.
- Analytics data:Google Analytics data is retained according to Google's standard retention settings (14 months) and is not linked to personally identifiable information.
7. Your Rights
Under GDPR (EU/EEA Residents)
If you are located in the European Economic Area, you have the right to:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data where there is no compelling reason for continued processing.
- Portability: request your data in a structured, machine-readable format for transfer to another service.
- Restrict processing: request that we limit how we use your data.
- Object: object to processing based on legitimate interests, including direct marketing.
Under CCPA (California Residents)
If you are a California resident, you have the right to:
- Know: request disclosure of the personal information we have collected, used, and shared about you in the preceding 12 months.
- Delete: request deletion of your personal information, subject to certain exceptions.
- Opt-out: opt out of the sale of your personal information. We do not sell personal information.
- Non-discrimination: we will not discriminate against you for exercising your privacy rights.
8. Exercising Your Rights
To exercise any of the rights described above, or to ask questions about this policy, contact us at hello@accessnarrative.com. We will respond to verified requests within 30 days. For GDPR requests, we may ask you to verify your identity before processing.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS 1.2+), full-disk encryption on all devices, access controls, and regular security reviews. For full details, see our Trust Center.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes constitutes acceptance of the updated policy.
11. Contact Information
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us: