naraa
    Legal

    Privacy Policy

    Last updated: August 2026

    This Privacy Policy applies specifically to the mobile application "naraa" (the "App"), operated by: naraa GmbH Lokstedter Steindamm 33a 22529 Hamburg Germany Registered in Germany HRB 199150 (Amtsgericht Hamburg) Managing Director: Pidder Seidl Email: contact@naraa.ai Website: www.naraa.ai

    1. Scope

    This Privacy Policy explains how personal data is collected, used, stored, and protected when you use the naraa mobile application.

    This policy applies only to the naraa App and does not replace the corporate naraa website privacy notice.

    2. Who We Are

    naraa is operated by naraa GmbH, a software company based in Germany.

    For the purposes of the GDPR, naraa GmbH acts as the data controller.

    3. Categories of Data We Process

    3.1 Account Information

    • Email address
    • Platform identifiers (Apple ID / Google account identifier)
    • Subscription status
    • Transaction identifiers (processed via Apple App Store or Google Play)

    We do not store full payment card details.

    3.2 User Content

    Chat Data
    • Text messages submitted in the App
    • AI-generated responses
    • Speech-to-text transcriptions

    Chat data is stored and associated with a pseudonymized user ID.

    Users may delete individual conversations or delete their account entirely.

    Voice Data

    When using real-time voice features:

    • Audio is processed for speech-to-text conversion
    • Audio files are not permanently stored
    • Only the resulting text transcription may be stored

    Voice processing may involve third-party providers (see Section 9).

    Avatar & Generated Images
    • System-generated avatar images
    • AI-generated visual content

    Images are stored to provide continuity of the user experience.

    If a user deletes their account, associated images are deleted.

    Users can delete generated avatar and image content at any time in the app, and all associated images are deleted when the account is deleted. Shared persona base artwork is not user-specific personal data and therefore remains part of the service.

    3.3 Usage & Technical Data

    We collect technical and usage information such as:

    • Device type
    • Operating system
    • App version
    • Crash logs
    • Session duration
    • Feature usage (e.g., voice feature usage)
    • Pseudonymized user identifier

    We do not use chat content or emotional keywords for advertising profiling.

    4. Analytics & Marketing

    We use analytics tools including:

    • Firebase
    • Google Analytics for Firebase
    • Attribution partners (e.g., Appsflyer, Adjust, Moloco)
    • Advertising platforms (e.g., Meta, Google Ads, TikTok Ads)

    4.1 Internal Analytics

    Used to:

    • Improve product performance
    • Understand feature usage
    • Optimize subscriptions and conversions

    Internal analytics may include session metrics and feature interaction.

    4.2 Advertising and Retargeting

    We work with advertising partners to measure conversions and optimise campaigns.

    We transmit only event-level data to advertising partners, namely:

    • App installation
    • Subscription activation
    • Credit purchase

    We do not transmit the following to advertising partners:

    • Chat content
    • Voice transcripts
    • Emotional conversation content
    • Persona selections
    • Individual usage intensity

    No profiling based on conversation content is shared with third parties.

    4.3 Apple App Tracking Transparency (ATT)

    On iOS devices, we request permission before tracking users across apps and websites.

    If you decline tracking:

    • We use Apple's SKAdNetwork for aggregated attribution.
    • No cross-app tracking occurs.

    4.4 EU/EEA Consent

    In the European Union and EEA:

    • Marketing and tracking technologies are activated only after explicit user consent.
    • Users may withdraw consent at any time within the App settings.

    5. Purpose of Processing

    We process personal data to:

    • Provide AI chat, voice, and image features
    • Manage subscriptions and credits
    • Ensure platform safety
    • Prevent abuse and misuse
    • Improve service performance
    • Comply with legal obligations

    We do not use user data to train AI models.

    6. Legal Basis (GDPR)

    Processing is based on:

    • Contract performance (Art. 6(1)(b))
    • Legitimate interests (Art. 6(1)(f))
    • Legal obligations (Art. 6(1)(c))
    • Consent (Art. 6(1)(a)) where required

    7. Data Retention

    • Account data: retained while account is active
    • Chat and transcription data: retained until user deletion
    • Audio recordings: not stored
    • Analytics data: retained according to provider policies
    • Billing records: retained as required by law

    Upon account deletion, personal data is deleted except where legal retention is required.

    8. International Data Transfers

    Data may be processed outside the EU/EEA.

    Where applicable, we rely on:

    • Standard Contractual Clauses
    • Adequacy decisions
    • Appropriate safeguards

    9. Service Providers (Sub-Processors)

    The authoritative and complete list of our sub-processors is maintained on our Sub-Processor List page. The providers below are an extract:

    • OpenAI (AI processing)
    • Whisper-based speech processing
    • ElevenLabs (text-to-speech)
    • AWS (infrastructure hosting)
    • Supabase (database services)
    • Firebase & Google Analytics
    • Advertising & attribution partners (e.g., Meta, Google, TikTok, Appsflyer, Moloco)

    All providers are subject to contractual data protection obligations.

    10. User Rights

    You have the right to:

    • Access your personal data
    • Correct inaccurate data
    • Request deletion
    • Restrict processing
    • Object to certain processing
    • Withdraw consent
    • Request data portability

    Requests may be sent to: contact@naraa.ai

    You may lodge a complaint with the competent supervisory authority. For naraa GmbH this is: Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Strasse 22, 20459 Hamburg, Germany. You may alternatively contact the supervisory authority of your habitual residence or place of work.

    11. Automated Decision-Making and Profiling (Art. 22 GDPR)

    AI-generated conversation content is produced automatically, but it does not constitute a decision that produces legal effects concerning you or similarly significantly affects you.

    We do not carry out automated decision-making, including profiling, within the meaning of Article 22(1) GDPR.

    • No automated creditworthiness, insurance, employment or eligibility scoring
    • No automated pricing based on individual behavioural profiles
    • No automated psychological or emotional profiling of individual users

    Automated safety filters may block content or restrict an account where abuse or a legal violation is detected. Any account suspension or termination is reviewed by a human before it becomes final, and you can contest the outcome via contact@naraa.ai and our internal complaint procedure.

    12. Data Security

    We implement appropriate technical and organizational safeguards including:

    • TLS encryption in transit
    • Role-based access control
    • Secure cloud infrastructure
    • Access logging and monitoring

    13. Children

    naraa is intended only for users aged 18 or older.

    We do not knowingly collect data from minors.

    14. Changes to This Policy

    We may update this Privacy Policy periodically.

    The "Last updated" date reflects the latest revision.