Privacy policy

Who we are

Narivo is a product of Atlant Labs. The controller of the personal data this policy describes is Atlant Labs d.o.o., Dr. Ante Starčevića 24, Dubrovnik, Croatia, OIB 89890773092, MBS 090034310. For anything about your data, write to info@atlantlabs.com.

What this policy covers

This policy covers this website: the pages, the offer form and the e-mails we send when you use it. It also describes, in outline, how Narivo handles the data of people who call a business that uses the Narivo agent; see “Callers of businesses that use Narivo” below.

We do not sell personal data, show advertising or build profiles of visitors. No decision with legal or similarly significant effects on you is made by automated means alone.

E-mails you send to our addresses are used to answer you and kept as long as the matter needs. A customer’s account and billing data is covered by the customer agreement.

When you request an offer

When you send the offer form, we store what you enter: your name, your e-mail address, your phone number if you give one, the name and website of your business if you give them, the plan you are interested in, how you would like to be contacted, your type of business, roughly how many calls you get a day and any notes. If you choose “Call me”, a phone number is needed too; the form refuses the request without one. We also store the language of the page, the page you sent the form from, the time, and whether the spam check passed.

We use these details to prepare an offer and to contact you about it. The legal basis is steps taken at your request before a contract (Article 6(1)(b) of the GDPR).

Two e-mails follow: one to our sales team with your request, and a confirmation to you in your language.

The stored request is deleted automatically after 90 days. The sales e-mail in our mailbox is kept as long as the matter needs. The e-mail service that delivers the two e-mails keeps its copy of them for 30 days. If you become a customer, what the contract needs is kept for the contract and for as long as accounting and tax law require. Keeping the records the law requires rests on our legal obligation (Article 6(1)(c) of the GDPR).

Giving us your details is voluntary. Without a name and an e-mail address we cannot send you an offer. The form is meant for people acting for a business.

Protecting the form from abuse

To keep spam and abuse away from the form, we use three measures:

• A hidden field that people do not see and automated scripts fill in. A request that fills it is discarded.
• A limit on how many requests one IP address can send in a short time, both to the offer form and to the small visit counter the form sends. The address is used for counting only, is not stored with your request, and the counter forgets it within a minute.
• Cloudflare Turnstile, which checks that the form is used by a person. It reads signals from your browser and your IP address and is processed by Cloudflare on our behalf. It loads only when you start filling in the form. The data of this check is kept for the period Cloudflare sets for it.

The legal basis is our legitimate interest in keeping the website and the form secure and usable (Article 6(1)(f) of the GDPR). None of these measures is used to profile you.

Hosting, logs and analytics

This website runs on Cloudflare, which acts as our processor. Offer requests are stored in the EU. The site is served over HTTPS only.

To deliver and protect the pages, Cloudflare processes the technical data every request carries: your IP address, the address of the page, your browser’s identification and the time. These server logs are kept for the period Cloudflare sets as our processor. This is our legitimate interest in running a secure website (Article 6(1)(f) of the GDPR).

We count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not identify you or follow you across sites. Because nothing is stored on or read from your device for it, no consent banner is needed. We use the counts to see which pages help visitors, a legitimate interest (Article 6(1)(f) of the GDPR).

We also count, without any personal data, how often the offer form is seen, started and sent, by page and language.

Cookies and local storage

This website sets no cookies.

If you close the language strip at the top of a page, your browser remembers that in its local storage, so the strip stays closed. The entry holds no personal data, never leaves your browser and can be removed by clearing your browser’s site data.

Who receives your data

Our sales team reads your request. Beyond them, these processors handle personal data for us, under our instructions and a data-processing agreement:

• Cloudflare: hosting, the spam check and visit counts.
• Resend: delivery of the two e-mails.
• Google Workspace: the mailbox in which our sales team reads your request.

We do not sell or rent personal data, and we do not share it with advertisers.

Cloudflare, Resend and Google are companies based in the United States. Where they process personal data outside the EU, they do so under the safeguards the GDPR allows: the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. You can ask us for a copy of those safeguards at info@atlantlabs.com.

Callers of businesses that use Narivo

When you call a business that uses Narivo, that business decides how your call is handled and is the controller of your data. Atlant Labs processes the data on the business’s behalf, as its processor, under a data-processing agreement.

What is processed: your phone number, what you say on the call, the recording, its transcript and summary, and what the agent writes down for the business, such as a booking or a message. The data comes from the call itself.

The agent tells you that it is an AI assistant when it picks up, and you hear a notice that the call is recorded. Card numbers never appear in a transcript. The service is hosted in the EU. The sub-processors of the service are listed in the data-processing agreement.

The business gives its callers its own privacy notice. It is responsible for the lawful basis of what its callers share, including health data where callers may share it, at a clinic, for example. How long a business keeps your call is the business’s decision. For questions about how a business uses your data, or to exercise your rights, contact that business. If you write to us instead, we pass your request on to it. The AI transparency page explains how the agent works.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its use, to receive it in a portable form and to object to processing based on our legitimate interest.

To use any of these rights, write to info@atlantlabs.com. We answer within one month and may ask you to confirm who you are first. Using your rights is free.

If you think we handle your data unlawfully, you can complain to the Croatian data protection authority, Agencija za zaštitu osobnih podataka (AZOP), in Zagreb, or to the authority of the EU country where you live or work.

Changes to this policy

When this policy changes, we publish the new version on this page, and the date at the top shows when it was last updated. Questions are welcome on the contact page.