Privacy Policy

1. Who we are

narrlit is operated by Filip Đorđević, an individual creator based in Belgrade, Serbia. The full postal address is disclosed upon a verified written request sent to the email below. For privacy matters, contact us at filip.djordjevic447@gmail.com.

For the purposes of the EU GDPR and the Serbian Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti), Filip Đorđević is the data controller for all personal data processed by narrlit.

2. What data we collect

We collect only what we need to run the service.

• Account data, email address, display name, optional avatar, hashed password (or Google OAuth identifier).
• Subscription data, current plan, billing period start and end, monthly token usage, Lemon Squeezy customer and subscription identifiers.
• Library data, which books you have unlocked, favourite marks, playback progress.
• Payment data, processed by Lemon Squeezy (see section 4). We never see or store your card details.
• Technical data, IP address, browser user-agent, and server logs kept for up to 30 days for debugging and abuse prevention.

3. Why we process this data (legal basis)

• Contract performance, account, subscription, library, and playback data are needed to deliver the service you signed up for.
• Legal obligation, invoice and transaction records are kept for tax and accounting law.
• Legitimate interest, technical logs for security and debugging; anonymised usage analysis to improve the product.
• Consent, if we add marketing emails or optional product analytics in the future, we will ask for explicit opt-in.

4. Third-party processors

We use the following service providers to run narrlit. Each acts as a data processor under our instructions and has signed a GDPR-compliant Data Processing Agreement (DPA) with us or publishes standard contractual clauses.

Google Tag Manager and PostHog only load if you have explicitly accepted the corresponding cookie category. Any tag configured inside Google Tag Manager (such as Google Analytics 4 or Meta Pixel) inherits the same consent signal and therefore does not fire until you opt in. You can change your preferences at any time from Settings → Privacy preferences, or by re-opening the cookie banner from the Cookie Policy.

AI content pipeline. AutoContent API, Deepgram, and Google Gemini are used by us on the production side to create the podcasts, transcripts, and episode metadata that you listen to and read. They do not receive any personal data about listeners. No account information, email address, IP, playback history, or identifiers are sent to these services, only the source book content or topic we curate, and the finished podcast audio for transcription. The providers are contractually prohibited from using the inputs to train their own models (per their current enterprise/API terms).

If we add new processors in the future, we will update this list and, where the law requires it, ask for your consent.

5. Your rights

Under the GDPR and the Serbian Personal Data Protection Act you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data (subject to legal retention of billing records).
• Receive your data in a machine-readable format (portability).
• Restrict or object to processing based on legitimate interest.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) or with your local EU supervisory authority.

To exercise any right, email filip.djordjevic447@gmail.com. We respond within 30 days.

6. How long we keep data

• Account data, while your account is active; deleted within 30 days of account deletion.
• Billing records, retained for 10 years as required by Serbian accounting law.
• Server logs, up to 30 days.
• Support emails, up to 24 months after the last message.

7. Security

Data is encrypted in transit (TLS) and at rest where supported by our processors. Passwords are stored as salted hashes by Supabase. Access to production systems is limited to the operator and protected with 2FA. In the unlikely event of a breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours.

8. Cookies

We use a small set of strictly necessary cookies to keep you signed in and to remember your current playback session. See the Cookie Policy for the full list.

9. Children

narrlit is not directed to children under 16. If you believe a child under 16 has created an account, email us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy when our processors, features, or legal obligations change. When we make material changes we will notify you by email or an in-app banner at least 14 days before they take effect. The “Last updated” date at the top always reflects the latest version.

11. Contact

For any privacy question or request: filip.djordjevic447@gmail.com.