Privacy Policy

Effective Date: September 8, 2026
Version: 1.0.0

NarrowStack Inc. ("NarrowStack", "we", "us", or "our") is dedicated to safeguarding your privacy and ensuring transparency regarding how we handle your information. This Privacy Policy describes how we collect, use, disclose, and protect personal and organizational data when you access or use the NarrowStack Cloud platform, client portal, APIs, and related web properties (collectively, the "Service").

By accessing or using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with any terms herein, please discontinue using the Service immediately.

1. Information We Collect

We collect information in several ways depending on how you interact with our platform:

1.1 Information You Provide Directly

• Account Registration & Profile: When you create an account or request access, we collect your name, business email address, company name, job title, and authentication credentials.
• Support & Inquiries: When submitting requests to our help desk or interacting with our customer engineering team, we collect communications records, ticket details, and diagnostic attachments you provide.
• Waitlist & Newsletter Submissions: When subscribing to preview releases or product announcements, we collect your contact email and notification preferences.

1.2 Information Collected Automatically

• System Telemetry & Device Data: IP addresses, browser user-agent strings, operating system details, device identifiers, and network connection characteristics.
• Portal Usage Logs: Timestamped records of portal logins, authentication events, page navigation sequences, resource allocations, and configuration modifications.
• Infrastructure Metrics: Cluster performance indicators, API request volumes, error codes, latency numbers, and resource utilization data necessary to maintain service stability.

1.3 Cookies and Storage Technologies

We use essential session cookies and local storage tokens strictly necessary for secure authentication, token refresh, and theme preference persistence. We do not sell your personal information or deploy third-party cross-site advertising trackers.

2. How We Use Your Information

We process collected information for the following business purposes:

• Service Delivery & Provisioning: To authenticate your access, administer client accounts, manage authorization scopes, and deliver requested cloud infrastructure services.
• System Reliability & Security: To monitor infrastructure health, prevent unauthorized intrusions, verify magic links, mitigate denial-of-service threats, and detect suspicious account activity.
• Platform Improvements: To analyze operational patterns, identify bottlenecks in our client control plane, and optimize user experience.
• Administrative Communications: To send service notifications, security alerts, scheduled maintenance advisories, and transactional updates regarding your cloud tenants.
• Legal Compliance: To comply with applicable statutory obligations, tax regulations, audit standards, and valid judicial orders.

3. How We Disclose and Share Information

NarrowStack does not sell, rent, or trade your personal data. We disclose information only under the following limited circumstances:

1. Vetted Infrastructure Partners & Sub-processors: We work with specialized third-party providers (such as hosting centers, database providers, and transactional email gateways) who process data on our behalf under strict data processing agreements and confidentiality obligations.
2. Organizational Administrators: If your account is provisioned under an enterprise subscription, your company's designated account administrators have access to your account profile, role assignments, and activity logs.
3. Legal Requirements & Protection: We may disclose information if required to do so by subpoena, court order, or applicable law, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of NarrowStack, our users, or the public.
4. Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business, client data may be transferred as an acquired business asset subject to this Privacy Policy.

4. Data Security and Storage

We implement rigorous technical, administrative, and physical measures designed to safeguard your information against unauthorized access, destruction, loss, or alteration:

• Encryption: All data in transit is encrypted using TLS 1.3, and data at rest is encrypted using AES-256 standard encryption algorithms.
• Access Control: Principle of least privilege (PoLP) and multi-factor authentication (MFA) are enforced across all internal administrative tools.
• Continuous Auditing: Regular vulnerability scanning, dependency patching, and automated configuration auditing across cloud environments.

While we strive to use commercially acceptable means to protect your data, no method of electronic transmission or cloud storage is 100% secure.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, provide our cloud services, resolve disputes, and comply with legal obligations. Upon termination of your client account, associated personal data and telemetry logs will be archived or permanently purged in accordance with our documented retention schedule.

6. Your Rights and Choices

Depending on your geographic location and applicable data privacy regulations (such as GDPR in the European Economic Area or CCPA/CPRA in California), you may have the following rights:

• Access & Portability: Request a copy of the personal data we hold about you in a structured, machine-readable format.
• Rectification: Request correction of any inaccurate or incomplete personal information.
• Erasure ("Right to Be Forgotten"): Request deletion of your personal data, subject to statutory retention requirements.
• Restriction & Objection: Object to or request restriction of certain processing activities.
• Consent Withdrawal: Withdraw consent at any time where processing was grounded in prior explicit consent.

To exercise any of these rights, please contact our privacy office at privacy@narrowstack.com.

7. International Data Transfers

NarrowStack operates infrastructure nodes and data centers primarily within the United States and selected global regions. If you access our Service from outside the United States, your information may be transferred to, stored, and processed in jurisdictions where data protection standards may differ from those in your home country. We implement Standard Contractual Clauses (SCCs) and appropriate transfer mechanisms where required.

8. Third-Party External Links

Our client portal and documentation may contain links to external sites or third-party documentation not operated by NarrowStack. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services.

9. Updates to This Privacy Policy

We may update our Privacy Policy from time to time to reflect modifications in our platform practices or regulatory requirements. We will notify you of any material changes by updating the "Effective Date" at the top of this document, posting an advisory notice on the portal, or sending an email notification to registered account owners.

10. Contact Us

If you have questions, feedback, or privacy-related concerns regarding this Privacy Policy, please contact:

• Privacy Office: privacy@narrowstack.com
• Support Portal: Support Console
• Postal Address: NarrowStack Inc., Data Privacy Office, 100 Montgomery St, Suite 1400, San Francisco, CA 94104