This policy explains what data Natter collects, why we collect it, and what we do with it. We've written it in plain English because legal jargon is the enemy of trust.
Natter ("we", "us", "our") is operated by Bright Digital Limited, registered in New Zealand. Contact: hello@natter.solutions.
When you use the free AI citation check, you give us:
When you pay for a full report, Stripe processes the payment. We receive the payment status and your email from Stripe but we never see or store your card details.
We also collect standard web analytics data: your IP address (hashed and truncated), browser type, the pages you view, the time you spend on each page, and which ad or link brought you to us. This is collected via Google Analytics 4 and Google Tag Manager, and only when you have given consent via our cookie banner.
We share the minimum necessary data with the following third parties, all of which have their own privacy policies:
We do not sell your personal information. In the narrower definition used by the California Consumer Privacy Act (CCPA/CPRA), some advertising cookies may qualify as "sharing" personal information with Google for cross-context behavioural advertising. You can disable these at any time via the cookie banner.
| Data type | Retention period |
|---|---|
| Your scan results and brand profile | 24 months after your last scan, then deleted or anonymised |
| Payment records | 7 years (required by accounting law) |
| Waitlist email | Until you unsubscribe, or 3 years of inactivity |
| Google Analytics data | 14 months (GA4 default) |
| Support emails | 2 years |
You can ask us to delete your data at any time (see "Your rights" below).
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights over your personal information.
| Category (CCPA terminology) | Examples | Source |
|---|---|---|
| Identifiers | Email address, IP address (hashed) | You, your browser |
| Commercial information | Payment history, subscription status | You, via Stripe |
| Internet activity | Pages viewed, referring URL, session duration | Your browser (only with consent) |
| Geolocation data | City and country (approximate, no precise GPS) | You (entered in form) or IP-based lookup |
| Inferences | Brand visibility score, competitor patterns | Derived from scan results |
Email hello@natter.solutions with the subject line "California Privacy Request" and tell us which right you want to exercise. We will verify your identity by confirming the email matches an email in our records. We respond within 45 days.
We do not sell personal information for money. However, advertising cookies on our site (Google Ads, Google Analytics) may constitute "sharing" under California's CPRA definition. You have two ways to opt out:
| Cookie / technology | Purpose | Category | Duration |
|---|---|---|---|
| natter_consent (localStorage) | Stores your cookie consent choice | Essential | 1 year |
| Scan session token (URL hash) | Lets you return to your scan results | Essential | Session |
| _ga, _ga_* | Google Analytics 4, distinguishes users and sessions | Analytics (optional) | Up to 13 months |
| _gcl_au | Google Ads conversion tracking | Advertising (optional) | 90 days |
| NID, SID (via Google Ads) | Google advertising attribution | Advertising (optional) | Varies (see Google) |
Analytics and Advertising cookies only load after you accept them via the cookie banner. You can change your choice at any time:
Depending on where you live, you also have rights under GDPR (Europe/UK), the Privacy Act 2020 (New Zealand), the Privacy Act 1988 (Australia), and other state laws such as Virginia's VCDPA, Colorado's CPA, Connecticut's CTDPA, Utah's UCPA, and Texas's TDPSA. These generally include:
Email hello@natter.solutions with the subject line "Data request" and we'll respond within 30 days.
Natter is operated from New Zealand, but our third-party service providers are largely based in the United States. By using Natter, you acknowledge that your data will be processed in countries outside your own. Where applicable, we rely on the Standard Contractual Clauses or equivalent transfer mechanisms offered by each provider.
Natter is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe we have, email us and we will delete it.
We take reasonable technical and organisational measures to protect your data: encryption in transit (HTTPS everywhere), access controls on our infrastructure, and regular review of third-party providers. No system is 100% secure, but we take this seriously.
If we materially change this policy, we'll email users we have email addresses for and update the "Last updated" date at the top. We won't use your data in materially new ways without giving you the chance to opt out.