Privacy Policy

Last updated: October 21, 2026

1. Data Controller

Narron ("we", "us", "our") is the data controller responsible for your personal data. If you have questions about how we process your data, contact us at lens@narron.io.

2. Data We Collect

We collect the following categories of personal data:

Account data: email address, name, and authentication credentials when you create an account.
Usage data: pages visited, features used, session duration, and interaction patterns to improve our service.
Brand data: domain names, brand names, and business information you provide for AI visibility tracking.
Payment data: billing information processed securely through Stripe. We do not store credit card numbers.
Technical data: IP address, browser type, device information, and cookies for security and analytics.
Google Analytics data: only if a workspace connects a brand to Google Analytics. See section 7.
Google Search Console data: only if a workspace connects a brand to Google Search Console. See section 7.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR:

Contract performance: to provide the services you signed up for.
Legitimate interest: to improve our services, prevent fraud, and ensure security.
Consent: for marketing communications, which you can withdraw at any time.
Legal obligation: to comply with applicable laws and regulations.

4. How We Use Your Data

Provide, maintain, and improve The Lens platform.
Process payments and manage your subscription.
Send service-related notifications and updates.
Analyze usage patterns to improve user experience.
Detect and prevent fraudulent or unauthorized activity.

Free report results: improving our service and our marketing

The free report is offered on one condition, which you agree to with a checkbox before it starts: we may use its results about your brand to improve our service and in our marketing, such as case studies, benchmarks and social posts. That covers the brand's name and logo, its website address, its visibility score and ranking, the questions we asked and the AI Overview answers, and the competitors those answers named.

It never covers you as a person: not your name, your email address or anything else about you, and not the reports you run later on a paid plan. We record when you agreed and to which version of these terms.

You can withdraw at any time by contacting support; we then stop using your brand's results in new material.

5. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request correction of inaccurate personal data.
Right to erasure: request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.
Right to restrict processing: request that we limit how we use your data.
Right to data portability: receive your personal data in a structured, commonly used, machine-readable format and transfer it to another controller.
Right to object: object to processing based on legitimate interest or for direct marketing purposes.
Right to withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email us at lens@narron.io. We will respond within 30 days.

6. Data Sharing & Third Parties

We share personal data only with the following categories of recipients:

Payment processor: Stripe, for subscription billing.
Infrastructure: Google Cloud / Firebase, for hosting and data storage.
AI processing: questions about your brand, and the answers AI platforms give, are processed through OpenRouter, which routes them to the model providers we measure and use (OpenAI, Google, Anthropic, Perplexity); some calls go to Google's Gemini API directly. These requests carry brand and market information, not your personal data, apart from the Google Analytics page information described in section 7.
Website reading and web search: to read a brand's public website and search the public web we use Firecrawl and DuckDuckGo. They receive only public web addresses and search terms.
Email: the emails we send you (reports, notifications, invitations) go through Google Workspace.
Search-results data provider: to measure Google AI Overviews, the same queries are sent to DataForSEO, which retrieves the Google Search results page for us. Each request carries the query text and a country and language setting derived from the brand's market — never your personal data.
Analytics: Google Analytics 4 (Google Ireland Limited), for aggregated usage statistics — only if you have accepted analytics cookies. See section 10.

We do not sell your personal data to third parties.

7. Google Analytics and Search Console Data You Connect

When an owner or editor of a workspace connects a brand to Google Analytics, Lens asks Google for read-only access to that Google Account's Analytics data (the permission analytics.readonly). Lens cannot change anything in your Google Analytics account.

What we read: the names and IDs of the Analytics properties and web streams the account can see, so you can choose the stream of the brand's own website; the key events set up on it; and aggregated reports for the chosen stream: sessions, engaged sessions, key-event counts and rates, by traffic source, landing page and day, for the last 7, 28 and 90 days and the same periods before them for comparison. We do not read data about individual visitors. Page addresses that look like personal data (for example, ones containing an email address) are removed before they are stored.
How we use it: only to show the workspace how AI platforms send visitors to the brand's website, in Lens's own features: Mission Results → Pages, Actions, and the weekly report email for that brand. To suggest a question for a page that AI platforms send visitors to, we send the page's address, and the title and description the page shows publicly, to an AI model through our AI processing provider (listed in section 6), and we require providers that neither store nor train on that request. No visitor data is ever sent. The weekly report email carries the figures only to the workspace's own members, sent through our email provider (section 6).
Who sees it: members of the workspace who can see the brand. People at Narron do not read it, except with your permission, when needed for security, or when the law requires it. Narron support sees it only if a workspace owner allows it in Settings → Privacy and access, for 24 hours, 7 days or 30 days, after which access turns itself off; every view is recorded and shown to the workspace for 12 months.
How we store and protect it: the access Google gives us is stored encrypted (AES-256-GCM) on Google Cloud and is used only by our servers. Reports are stored in Google Cloud Firestore.
How long we keep it: reports are refreshed daily and each is kept for up to 180 days. When you disconnect Google Analytics, or delete the brand or the workspace, we delete that brand's reports at once, and delete the stored access and revoke Lens's access at Google as soon as no other brand in the workspace uses the same Google connection. Backup copies are erased within 90 days. You can also revoke access at any time at myaccount.google.com/permissions.
What we never do: we do not sell this data or transfer it to advertising platforms, data brokers or information resellers; we do not use it for advertising, or for credit or lending decisions; and we do not use, transfer or sell it, in raw, aggregated, anonymized or derived form, to develop, improve or train generalized or non-personalized AI or machine-learning models. We transfer it to no one except as described above, for security, or as required by law.
Legal basis: performance of our contract with you, because you chose to connect Google Analytics.

Lens's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Search Console

When an owner or editor of a workspace connects a brand to Google Search Console, Lens asks Google for read-only access to that Google Account's Search Console data (the permission webmasters.readonly). Lens cannot change anything in your Search Console account, and it shows no Search Console report.

What we read: the Search Console properties the account can see and its permission on each, so you can choose the property of the brand's own website; aggregated search data for that property: the searches that showed the site, the pages they showed, clicks, impressions and average position, and impressions by country, for the last 90 days and the 28 days before the last 28; and Google's index status of the pages AI answers cite and the pages the brand's finished actions produced. Google does not give us data about individual searchers and hides rare searches.
How we use it: only to find what the workspace should act on in Lens's own features: questions worth tracking, pages Google does not index, pages Google ranks that AI answers do not cite, AI answers above the brand's pages, rivals searched together with the brand, and whether a finished action's page reached Google. To group searches into questions to track, we send the searches and the pages they showed to an AI model through our AI processing provider (listed in section 6), and we require providers that neither store nor train on that request. A new question is written; no search is copied into the brand's questions.
Who sees it: members of the workspace who can see the brand, as Lens's findings. People at Narron do not read it, except with your permission, when needed for security, or when the law requires it; the support access described above covers Search Console data in the same way.
How we store and protect it, and how long we keep it: as for Google Analytics above: the access Google gives us is stored encrypted, each brand's current data is refreshed daily and kept for up to 180 days, and disconnecting, or deleting the brand or the workspace, deletes it at once and revokes Lens's access at Google as soon as no other connection in the workspace uses the same Google access.
What we never do: the same commitments as for Google Analytics above apply, including the Limited Use requirements of the Google API Services User Data Policy.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our infrastructure providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with GDPR requirements.

9. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. After account deletion, we retain data for up to 90 days for backup and legal compliance purposes, after which it is permanently deleted. Anonymized analytics data may be retained indefinitely.

10. Cookies & Analytics

We use a small number of cookies and equivalent browser storage. Strictly necessary storage is used without consent because the service cannot be delivered without it. Everything else — currently analytics only — is placed only after you opt in through our cookie banner. Declining is a single click and has no effect on your access to the service.

Name	Category	Purpose	Retention
Firebase authentication session	Strictly necessary	Keeps you signed in between page loads.	Session / until sign-out
cookieConsent	Strictly necessary	Records the cookie choice you made, so we do not ask again and do not act against it.	6 months, then we ask again
theme, uiLocale	Strictly necessary	Remembers the appearance and language you chose.	Until you clear browser storage
_ga, _ga_<property>	Analytics (consent required)	Google Analytics 4: distinguishes visitors and sessions so we can count visits and see which pages are used.	Up to 2 years

Who runs the analytics: Google Analytics 4, provided by Google Ireland Limited, acting as our processor under a data processing agreement. The GA4 property belongs to our own Firebase project.
Consent Mode: before any Google tag loads, we signal that analytics, advertising and personalisation storage are denied. Nothing is read from or written to your device for measurement until you opt in.
No advertising: we run no advertising or remarketing tags. The Google advertising signals stay denied even if you accept analytics, Google Signals is not enabled, and we do not sell or share this data for advertising.
IP addresses: Google Analytics 4 does not log or store IP addresses; they are used in transit for coarse geolocation and then discarded.
Retention: event-level analytics data is retained for 14 months, after which only aggregate reports remain.
Data transfer: analytics data may be processed in the United States under the EU-U.S. Data Privacy Framework, to which Google LLC is certified, with Standard Contractual Clauses as an additional safeguard.
Legal basis: your consent, under art. 6(1)(a) GDPR and art. 5(3) of the ePrivacy Directive, for analytics storage; our legitimate interest in operating a working service for strictly necessary storage.

Changing or withdrawing your choice. Select "Cookie settings" in the footer of any page at any time. Withdrawing is as easy as giving consent, takes effect immediately for this browser, and does not affect the lawfulness of processing carried out before you withdrew. You can also opt out of Google Analytics across all websites using Google's browser add-on.

Your choice is stored in this browser only. If you use another browser or device, or clear your browser storage, we will ask again.

11. Data Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews to protect your data.

12. Supervisory Authority

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting a notice on our website or sending you an email. Your continued use of the service after changes constitutes acceptance of the updated policy. Before we use Google user data in a new way, we will ask for your consent.

Questions? Contact us at lens@narron.io