Privacy Policy

1. Who we are

NarraFlect creates decision-ready communication toolkits for biotech researchers, scientific founders, consultants and early-stage teams. NarraFlect is run by an individual sole proprietor based in Taiwan, who is the controller of the personal data described in this policy.

Questions about this policy or requests about your data can be sent to hello@narraflect.com.

2. What we collect

• Messages you send us: your name, email address and the content of your message.
• NarraFlect Insights subscription: your first name, email address, the date and time you subscribed and confirmed, your email preferences, and whether you open our emails and which links you click (see section 5).
• Purchases: from Polar, our merchant of record, we receive your email address, the product and license tier, the order status, your country and a transaction reference. We never receive or store full payment card details.
• Technical and security data: IP address, browser and device type, pages requested and timestamps, recorded in server logs and by the spam protection on our sign-up form.
• Analytics data, only with your consent: if you accept analytics cookies, Google Analytics records how pages are used, such as pages viewed, approximate location, device type and referring site.

3. Why we use it and our legal basis

• Delivering purchases, licenses, downloads and support: performance of a contract (GDPR Art. 6(1)(b)).
• Sending NarraFlect Insights and the resources you request, and recording whether these emails are opened and which links are clicked: your consent (Art. 6(1)(a)), given through double opt-in.
• Measuring site use with Google Analytics: your consent (Art. 6(1)(a)), given through the cookie banner.
• Replying to your messages: our legitimate interest in answering enquiries (Art. 6(1)(f)).
• Keeping the website and sign-up form secure and preventing spam and fraud: our legitimate interest in security (Art. 6(1)(f)).
• Keeping tax and accounting records: legal obligation (Art. 6(1)(c)).

We do not sell your personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Payment processing

Purchases are processed by Polar, which acts as the merchant of record and handles payment processing, applicable sales tax, receipts and related transaction services. Polar processes payment data as an independent controller under its own terms and privacy policy presented during checkout.

5. Email subscriptions

NarraFlect Insights subscriptions are managed through Brevo under its privacy policy. After you sign up you receive one confirmation email. Nothing else is sent, including any resource you requested, unless you confirm.

Brevo records whether each email is opened and which links are clicked, using a small image in the email and links that pass through Brevo before reaching the page. We use these records to see which topics and resources readers find useful and to check that our emails are delivered. Links to our website also carry campaign tags, which Google Analytics reads only if you have accepted analytics cookies. You can block the open record by turning off images in your email client, and unsubscribing stops all of it.

Every email includes an unsubscribe link. When you unsubscribe we stop sending emails but keep a record of your consent and unsubscribe for the period in section 9, so we can show that we respected your choice.

6. Cookies and analytics

• Necessary cookies keep the website secure, remember your cookie choice and support checkout. They do not require consent.
• Analytics cookies from Google Analytics (_ga and _ga_*) are set only if you select Accept All or allow Analytical cookies in the cookie settings. You can change your choice at any time through the cookie icon at the bottom of each page.
• Google reCAPTCHA on the sign-up form checks that sign-ups come from people, not bots. It loads only when you open the sign-up form, and Google processes the related data under its Privacy Policy and Terms of Service.

7. Free tools

The Milestone Scenario Planner runs entirely in your browser. The therapeutic area, stages and values you choose, and the charts you create, are not sent to us or stored by us. Downloading a chart does not require an email address.

If you accept analytics cookies, Google Analytics records that the tool was used, for example that a chart was downloaded, but not the area, stages or values you chose.

If you choose to sign up for The Decision Story Checklist from the tool, the sign-up form and its spam protection load only when you open them, and the sign-up works as described in section 5.

8. Who receives your data

We share personal data only with service providers that help us run NarraFlect, and only as needed for the purposes above:

• Polar: payments, sales tax and receipts.
• Brevo: email sign-up, delivery, and open and click records.
• Google: Google Analytics (only with your consent) and reCAPTCHA.
• Our web hosting provider: hosting the website, files and server logs.

We may also disclose information when required by law or to protect our legal rights.

International transfers. NarraFlect is run from Taiwan, and our providers may process data in the European Union, the United States and other countries. Where personal data from the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, our providers rely on safeguards such as the European Commission's Standard Contractual Clauses or, for certified US companies, the EU-US Data Privacy Framework.

9. How long we keep it

• Subscription data: until you unsubscribe. After that, a record of your consent and unsubscribe is kept for up to 3 years.
• Email open and click records: kept with your subscription data, for the same periods.
• Messages: up to 2 years after our last exchange, unless they relate to a purchase.
• Purchase records: as long as tax and accounting rules require.
• Analytics data: no more than 14 months in Google Analytics.
• Server logs: for the short period set by our hosting provider.

We use reasonable technical and organisational safeguards, but no online system can be guaranteed completely secure.

10. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its use, and to withdraw consent at any time without affecting earlier processing. Email hello@narraflect.com to make a request. We may need to confirm your identity, and we reply within one month.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

11. Children

NarraFlect is a business service and is not directed to anyone under 16. We do not knowingly collect their personal data.

12. Changes to this policy

We update this policy when our services, tools or the law change. The current version and its effective date always appear on this page.