Privacy Policy
Last updated: April 17, 2026
NPR Grenade ("we", "us") is operated by The Brand Arsenal. This policy explains what we collect, why we collect it, and the choices you have. If anything here is unclear, email privacy@nprgrenade.com.
1. What we collect
- Account data — name, work email, organization, hashed password, billing details (handled by Stripe — we never store full card numbers).
- Content you create — product imports, NPR drafts, brand assets, generated landing pages, PDFs, and social images.
- Connected services — encrypted API keys, OAuth tokens, and webhook secrets for Shopify, Mailchimp, Klaviyo, LinkedIn, and Bannerbear, when you connect them.
- Usage data — pages viewed, features used, render counts, error logs. Used to operate and improve the product.
2. How we use it
- Run the service you signed up for — generate NPRs, distribute content, send transactional email.
- Bill you (via Stripe) and prevent abuse.
- Improve features, debug issues, and respond to support requests.
- Send product announcements and marketing emails — only with consent, and you can unsubscribe at any time.
3. How we share it
We do not sell your data. We share it only with sub-processors required to run the service:
- Stripe — payments and subscription management
- Amazon Web Services — hosting, storage (S3), DNS
- Mailchimp / Klaviyo — only when you connect them and only the data you push
- Bannerbear — render social images on your behalf
- Google Workspace / SES — transactional and team email
- Sentry / log providers — error monitoring
4. Where data lives
Data is stored in AWS (United States, us-east-1). If you require a different region, contact us before signing up.
5. Security
All connections use TLS. API keys and tokens are encrypted at rest with AES-256-GCM. Database snapshots are encrypted. Access to production systems is restricted and logged.
6. Your rights
You can export, correct, or delete your account data at any time from the dashboard, or by emailing privacy@nprgrenade.com. We respond to GDPR / CCPA requests within 30 days.
7. Cookies
We use first-party cookies for authentication and session state. We use a small number of analytics cookies to understand product usage. We do not run ad-tracking pixels on app.nprgrenade.com.
8. Children
The service is not directed at children under 16. We do not knowingly collect data from minors.
9. Changes
If we make material changes to this policy we will notify account owners by email at least 30 days in advance.
10. Contact
The Brand Arsenal — privacy@nprgrenade.com