Privacy Notice

The Service is operated by Aston Auto Innovation (trading as NarrateIQ). For personal data we collect about you in connection with the Service, Aston Auto Innovation acts as the data controller. You can reach us via the contact address listed on the Service.

• Account data: name, email address, hashed password (or OAuth identifier if you sign in with a third-party provider such as Google), and account preferences.
• User Content: text, documents, URLs, prompts, and other materials you submit, plus the audio lessons, transcripts, quizzes, and study artifacts generated from them.
• Support messages: the content of messages you send us and any attachments.
• Usage & telemetry: lesson counts, token and character usage, voice minutes, feature interactions, log data, and timestamps.
• Device & network data: device and browser information, device identifiers, IP address, and approximate location derived from IP.
• Billing data: plan, subscription status, and transaction identifiers. Payment card details are collected and processed by Paddle (see section 5) and are not stored on our servers.
• Cookies and similar technologies: strictly necessary cookies for authentication and session management, and limited analytics cookies to understand aggregate usage. See section 10.

• To create your account and provide the Service.
• To generate, store, and deliver lessons and related output.
• To authenticate you and secure your account against fraud and abuse.
• To bill you and comply with tax, accounting, and other legal obligations.
• To debug, monitor performance, and improve product quality and features.
• To provide customer support and communicate with you about your account, transactions, security, and material changes to the Service.
• To send marketing communications, where you have consented and can opt out.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal data, and we do not use your User Content to train foundation AI models.

Where GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for and to process your payments.
• Legitimate interests — to operate, secure, and improve the Service, prevent fraud, and communicate with our users, balanced against your rights and interests.
• Legal obligation — to meet tax, accounting, and other regulatory requirements.
• Consent — for non-essential cookies and, where required, marketing communications. You can withdraw consent at any time.

We share data only as needed to run the Service, with recipients acting as our processors under contractual confidentiality and security obligations:

• Cloud hosting, database, and storage providers that run our infrastructure.
• AI, text-to-speech, and language model providers used to generate lessons and audio.
• Paddle.com Market Ltd (“Paddle”), our Merchant of Record. Paddle handles checkout, payments, subscription management, tax compliance, invoicing, and refunds for all paid NarrateIQ orders. See Paddle’s Privacy Notice.
• Authentication providers — for example Google, if you sign in with OAuth.
• Analytics and error-monitoring providers that help us understand usage and diagnose issues.
• Professional advisers — legal, accounting, and audit advisers where necessary.
• Public authorities — where we are legally required to disclose data.

We may also disclose data in connection with a corporate transaction (such as a merger, acquisition, or sale of assets), with notice where required.

We may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms for transfers out of the EEA, UK, or Switzerland.

We retain account, User Content, and usage data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, security, and dispute-resolution obligations. You can delete lessons from within the Service and request account deletion at any time, after which we will delete or anonymize personal data unless we are required to retain it (for example, for tax records).

Depending on your jurisdiction, you may have the right to:

• access the personal data we hold about you;
• correct or update inaccurate or incomplete data;
• request deletion of your data;
• restrict or object to certain processing;
• request portability of data you provided to us;
• withdraw consent where processing is based on consent; and
• lodge a complaint with your local data-protection authority (such as your supervisory authority in the EEA or the ICO in the UK).

To exercise any of these rights, contact us at the address listed on the Service. We will verify your request and respond within the time required by applicable law (generally within one month under GDPR).

We use industry-standard technical and organizational measures — including encryption in transit, access controls, row-level database security, and least-privilege server-side credentials — to protect your data. No system is perfectly secure; you use the Service at your own risk and must safeguard your credentials.

We use a small number of cookies and similar technologies:

• Strictly necessary — required for sign-in, session management, and security. Disabling these will break the Service.
• Analytics — help us understand aggregate usage and improve the product. Where required, we ask for your consent before setting these.

You can manage cookies through your browser settings. Paddle may also set cookies on checkout pages that it operates; those are governed by Paddle’s privacy notice.

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Privacy Notice from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

Questions about this Notice or privacy requests may be sent to the contact address listed on the Service.