Privacy Policy

Nota para lectoras y lectores en español: parte de este sitio está en español, pero esta Política de privacidad y la Política de cookies se publican únicamente en inglés, y el texto en inglés es el que rige. Preferimos decirlo con claridad antes que publicar una traducción que no podamos mantener sincronizada con el original: dos versiones de una política de privacidad que discrepan en silencio son peores que una sola que haya que leer en un segundo idioma. Tus derechos son idénticos en cualquier caso. Si algo no queda claro, escríbenos a [email protected] y te lo explicamos en español.

Last updated 8 August 2026. Applies to the website narrativetrace.ai.

This policy covers the website at narrativetrace.ai. It does not cover the NarrativeTrace software libraries themselves: those run inside your own systems, on your own infrastructure, and send us nothing. Nothing you trace with NarrativeTrace reaches us.

1. Who is responsible

This site is operated by Empower Agile, a company established in the United States (the "we" throughout this policy). We decide why and how the personal information described here is processed.

• Contact for anything in this policy: [email protected]
• Legal entity type and state of registration: to be confirmed
• Postal address: to be confirmed

California law allows a business that operates exclusively online, and that has a direct relationship with the consumer, to offer a single email address as its contact method. We do that. Email is the fastest route to a person either way.

2. What this site collects

There are no accounts on this site, no login, no contact form, no payment, no comment section, and no advertising. As of the date above the site sets no cookies from the server at all — a request to narrativetrace.ai returns zero Set-Cookie headers.

2.1 Delivery and security logs

The site is hosted on Cloudflare Pages. Delivering a page necessarily discloses your IP address to our host, and Cloudflare records standard request data — IP address, the page requested, timestamp, browser user-agent string, and approximate country derived from the IP. This exists so the site can be served and so we can absorb attacks and abuse.

• Purpose: delivering the site; network security and abuse prevention.
• Basis (for EU/UK visitors): legitimate interests — running a website you asked to see, and keeping it available.
• Retention: Cloudflare log retention for our plan — to be confirmed

2.2 Aggregate page counts

We use Cloudflare Web Analytics to see which pages are read. It is deliberately chosen over the usual alternatives because of what it does not do: it stores nothing on your device, sets no cookie, uses no fingerprint, assigns you no identifier, and does not follow you to other sites. It reports totals, not people.

Because it places nothing on your device, there is no permission for us to ask about it, and it is not one of the switches in the cookie settings dialog. Putting it behind a consent toggle would imply a legal basis it does not use. For EU/UK visitors it runs on legitimate interests, and you have the right to object — see section 5.

2.3 Your own preferences, kept on your device

Three values are stored in your browser and never transmitted to us: your light/dark theme choice, your language choice, and the record of your cookie-settings decision. All three exist only because you acted. The Cookie Policy lists them individually with names and durations.

2.4 Choosing which language to show you

This site is published in English and Spanish. To decide which version to show on a first visit, the page reads the language preferences your browser already sends with every request. That happens entirely in your browser, reveals nothing new about you — the header was already in the request — and stores nothing. Only an actual choice, made with the language switcher, is remembered.

Deciding whether to ask for consent uses a similar principle: we ask our own host for a country code rather than an outside geolocation service, so working out which privacy rules apply to you does not itself involve a third party.

2.5 If you email us

This site has no contact form, but it does publish [email protected] and links that open a pre-addressed message. Publishing an address is itself what creates the processing: people write in, and their address and whatever they choose to tell us gets stored in our mailbox.

• Purpose: answering you.
• Basis (for EU/UK visitors): legitimate interests, or steps taken at your request before entering a contract, depending on why you wrote.
• Retention: maximum period after the last message — to be confirmed

2.6 Links that are only links

Links to GitHub, and any other outbound link on this site, make no request and reveal nothing about you until you click them. They are ordinary links, not embedded content. Once you follow one, that site's own privacy policy governs what happens next.

3. What we never do

• We do not sell personal information, and have not in the preceding 12 months.
• We do not share it for cross-context behavioural advertising, and have not in the preceding 12 months.
• We collect no sensitive personal information as California defines it.
• We build no profiles, run no advertising, and make no automated decisions that produce legal or similarly significant effects.
• We knowingly collect nothing from children under 16, and this site is not directed at them.

4. Your rights if you are in the United States

California's CCPA/CPRA, and the comparable laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states, give you rights over personal information about you. Regardless of which state you are in, we will handle your request the same way.

4.1 Categories, in the statutory language

The business purposes are the ones in section 2: serving the site, keeping it secure, and counting page views in aggregate. Nothing is disclosed to anyone outside that.

4.2 The rights themselves

• Know and access — what we collect about you, why, and who receives it.
• Delete — subject to the exceptions the statute allows.
• Correct — inaccurate personal information.
• Opt out of sale or sharing — we do neither, so there is nothing to opt out of, but the right is yours and we will confirm that in writing if you ask.
• Limit the use of sensitive personal information — we collect none.
• Non-discrimination — the site behaves identically whether or not you exercise any of this. Declining every optional category changes nothing about what you can read.
• Appeal — if you are in a state that provides it (including Virginia, Colorado, Connecticut and Texas) and we refuse your request, you may appeal by replying to our refusal. We will respond with a written explanation.

To exercise any of it, email [email protected]. You may use an authorised agent; we will ask for proof that you authorised them. We respond within 45 days, extendable once by a further 45 days where the request is complex, and we will tell you if we need the extension.

4.3 Global Privacy Control

We honour the Global Privacy Control signal automatically. If your browser or extension sends GPC, we treat it as an opt-out for every optional category the moment the page loads — you do not have to find a dialog or click anything. This is a legally recognised opt-out mechanism in California, Colorado and Connecticut, and we apply it to every US visitor who sends it.

5. Your rights if you are in the EU, the EEA or the UK

We are established in the United States, but this site is readable worldwide, so we apply GDPR and UK GDPR standards to visitors there. Optional measurement is opt-in for you: nothing beyond what is strictly necessary runs until you actively accept it, and if we cannot determine where you are we treat you as if you were covered.

You have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected, and incomplete data completed;
• have data erased where the grounds in Article 17 apply;
• restrict processing while a dispute about it is resolved;
• object to processing based on legitimate interests, including the aggregate page counts described in section 2.2;
• receive data you provided in a portable form, where it was processed by automated means on the basis of consent or contract;
• withdraw consent at any time, as easily as you gave it — the "Cookie settings" link sits in the footer of every page and is styled exactly like the links beside it;
• complain to your national supervisory authority, or in the UK to the Information Commissioner's Office (ico.org.uk). You may complain in the country where you live or work.

We respond within one month, extendable by two further months for complex requests.

5.1 Where your data goes

We are a US company and our host is a US company, so a page you request from us is served from, and logged in, the United States. Under the EDPB's guidance this direct collection by a controller outside the EEA is not a "transfer" in the Chapter V sense — there is no exporter established in the EEA — but the practical consequence is the same and you should know it: US authorities can compel access to data held by US providers under legal process that differs from EU law. Our arrangement with Cloudflare is a data processing agreement incorporating the European Commission's standard contractual clauses.

The honest mitigation is not more paperwork but less data. That is why this site collects as little as it does.

5.2 EU and UK representative

Article 27 requires controllers outside the EU to designate a representative there, unless the processing is occasional, involves no large-scale special-category data, and is unlikely to result in a risk to people's rights. A brochure and documentation site with no accounts, no forms and no profiling is a plausible fit for that exemption, but it is a judgement call with consequences, so we record it as a decision rather than an assumption.

Status: whether to appoint an Article 27 representative — decision pending

6. A limit we would rather state than hide

7. Changes

If we introduce a measurement tool, or anything else that changes what is collected, this policy and the Cookie Policy change with it, the date at the top changes, and anyone whose consent was recorded under the old set of categories is asked again rather than assumed to agree.