Privacy policy

1. Who we are

Narimato ("we", "us") operates narimato.com, a platform that lets organisations run preference surveys through swipe-and-rank interactions. For privacy enquiries contact contact@narimato.com.

2. Roles: controller vs processor

When you visit narimato.com as a survey participant, the organisation that issued your survey password is typically the data controller for survey content and results. Narimato acts as a data processor for that organisation, hosting the technical infrastructure. For questions about how your answers are used, contact your survey organiser first.

For website analytics, cookie preferences, and platform operations, Narimato is the controller.

3. Data we process

• Survey access: passwords are verified using salted hashes; plain passwords are not stored. A session cookie (`narimato-survey-access`) keeps you signed in to your survey for up to 30 days.
• Survey responses: ranking choices, swipe/vote actions, session identifiers, and timestamps needed to produce results.
• Technical data: browser type, device category, approximate usage metrics, and server logs for security and reliability.
• Analytics (optional): if you consent, Google Analytics 4 with IP anonymisation and Consent Mode v2.

4. Legal bases (EEA / UK GDPR)

• Contract / legitimate steps: providing survey access after you enter a valid password.
• Legitimate interests: securing the service, preventing abuse, and improving reliability.
• Consent: non-essential analytics cookies (you can withdraw consent at any time on the cookie preferences page).
• Organisation's legal basis: survey content and use of results are determined by the organising entity.

5. Cookies

Essential cookies are required for survey sessions. Analytics cookies are optional. Full details and controls are on our cookie preferences page.

6. Sharing & international transfers

We use infrastructure providers (e.g. hosting) that may process data in the EU and other regions. Analytics data may be processed by Google where enabled. We do not sell personal data.

7. Retention

Survey session cookies expire after 30 days of inactivity. Play and ranking records are retained according to each organisation's configuration on the Narimato platform. Server logs are kept for a limited period for security. Contact your organiser for survey-specific retention schedules.

8. Your rights

If you are in the EEA, UK, or similar jurisdictions you may have rights to access, rectify, erase, restrict, object, and port your data, and to withdraw consent where processing is consent-based. You may lodge a complaint with your local supervisory authority.

Submit requests to contact@narimato.com. We respond within one month where GDPR applies.

9. Children

Narimato is not directed at children under 16. Organisations must not invite minors to participate without appropriate parental authority and lawful basis.

10. Changes

We may update this policy. Material changes will be reflected on this page with a revised date.