When NarrEx is a data processor: For investment materials, financial models, and deal-related documents uploaded to the platform for analysis, NarrEx acts as a data processor on behalf of the uploading firm (the data controller). The uploading firm determines the purposes of that processing and is responsible for ensuring it has the right to submit those materials. NarrEx processes those materials on the firm's behalf in order to provide the hosted analysis service.
When NarrEx is a data controller: For account registration data (name, firm name, email address, access credentials) and platform usage data (login records, session data), NarrEx acts as the data controller and is directly responsible for this data under applicable data protection law, including GDPR where applicable.
Data We Collect
When you request access to NarrEx, we collect your name, firm name, and email address. When you use the platform, we process the documents you upload (investment materials and financial models) for the purpose of generating analysis. We also collect basic usage data including login records, analysis timestamps, and analysis results in order to operate, secure, and improve the platform.
How We Use Your Data
Your name, firm, and email are used to manage access to the platform and to communicate with you about your access status and platform updates. Uploaded documents are processed solely to generate the credibility analysis you requested. NarrEx does not sell your personal data or uploaded documents. Where necessary to operate the service, NarrEx uses third-party service providers including hosting, database, AI processing, and contact-form providers acting under contractual data protection terms. Details are provided on the Security page.
Document Retention
By default, uploaded documents are processed and discarded immediately after analysis completes. Raw investment materials and financial models are not retained after processing unless a firm has expressly enabled secure retention for audit purposes. Analysis outputs including credibility scores, extracted claims, and IC Memo reports are retained in the firm account for the duration of the arrangement unless deleted earlier.
Data Security
NarrEx is deployed on secure cloud infrastructure. All data is transmitted over encrypted connections (HTTPS). Access to the platform is protected by authenticated user sessions. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.
Cookies
NarrEx uses a single authentication cookie to maintain your session after you enter your access code. This cookie is essential for platform function and does not track your activity across other websites. No third-party tracking, analytics, or advertising cookies are used.
Your Rights
You have the right to request access to, correction of, or deletion of any personal data we hold about you. To exercise these rights, contact us at contact@narrex.app. We will respond within 30 days.
Your Privacy Rights
You may request access to, correction of, or deletion of your personal data. If you are located in the European Union or European Economic Area, the following rights apply under the General Data Protection Regulation (GDPR):
- Right of access — You may request a copy of the personal data NarrEx holds about you.
- Right to rectification — You may request correction of inaccurate personal data.
- Right to erasure — You may request deletion of your personal data where there is no legitimate reason for continued processing.
- Right to restriction — You may request that NarrEx restricts processing of your data in certain circumstances.
- Right to data portability — You may request your data in a structured, machine-readable format.
- Right to object — You may object to processing of your personal data in certain circumstances.
How to exercise your rights:
To exercise any of these rights, submit a written request to contact@narrex.app with the subject line 'Privacy Rights Request'. Please include your name, firm name, and a description of your request. NarrEx may need to verify your identity before processing the request — we will ask for confirmation of your registered email address.
NarrEx will respond within 30 days. In complex cases this may be extended by a further 60 days with notice. There is no charge for exercising your rights. If your request is manifestly unfounded or excessive, NarrEx may charge a reasonable fee or refuse the request with explanation.
For data portability requests, data will be provided in JSON or CSV format by secure email. If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority. For Luxembourg operations, this is the CNPD at cnpd.public.lu or +352 26 10 60-1.
Legal Basis for Processing
NarrEx processes personal data under the following legal bases, mapped to specific processing activities:
- Contract performance (Article 6(1)(b)) — processing your account registration data (name, firm name, email) to provide access to the NarrEx platform; delivering analysis results and IC reports under the applicable service arrangement.
- Legitimate interests (Article 6(1)(f)) — platform security monitoring; fraud and abuse prevention; maintaining service reliability; improving platform stability. NarrEx's legitimate interests do not override your fundamental rights.
- Legal obligation (Article 6(1)(c)) — processing required to comply with applicable Luxembourg and EU law, including data protection, financial services, and anti-money laundering regulations where applicable.
For deal materials processed on behalf of customer firms, the legal basis is determined by the uploading firm as data controller.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of material changes by email. Continued use of the platform after changes constitutes acceptance of the updated policy.
Contact
For privacy-related questions or requests, contact us at contact@narrex.app. NarrEx is operated from Luxembourg.