Privacy Policy

1. Who is responsible

The controller is GregLines Taldea, SARL (French limited liability company), 32 Rue Berjon, 69009 Lyon, France, SIREN 994 772 861, RCS Lyon, VAT FR08 994772861. For any privacy question or request, write to [email protected].

For content inside a workspace, the organization that owns the workspace decides what goes in and who sees it. It acts as the controller of that content, and Norc processes it on its behalf as a processor. We can provide a data processing agreement on request.

2. What we collect

Depending on how you use Norc, we process:

• Account data: your name, email address and profile picture from the identity provider you sign in with, your role, and sign-in and session records.
• Workspace content: tasks, projects, comments, files, agent runs and results, logs, and settings that you and your agents create.
• Connected tool data: the pages, comments, messages, issues or emails that a tool you connect sends to Norc, and the user names and email addresses Norc needs to match people across tools. With Notion, Norc only sees the pages you choose to share.
• Credentials you store: API keys and tokens for your tools and agents. They are encrypted at rest with a key specific to your workspace, and agents use them without seeing them where Norc supports it.
• Machine data: the name, status and version of the machines that run your agents, and the commands and results of their runs.
• Billing data, when paid plans apply: what our payment provider shares with us about your subscription. Card details stay with the payment provider.
• Technical data: IP addresses, browser information and request logs, which we keep to secure and operate the service.

3. Why we use it

We use personal data to provide the service you asked for (performance of a contract). We also use it to secure the service, prevent abuse, fix problems and keep backups (legitimate interest), to bill you and keep accounting records (legal obligation), and to answer your messages.

We do not sell personal data, do not show advertising, and do not use your content to train AI models. The website counts visits with Cloudflare Web Analytics, which sets no cookies, does not fingerprint visitors and does not follow you across sites. It remembers your language choice in your browser only. There are no advertising trackers.

4. AI providers

When your agents work on a task, Norc sends the task and the context you have attached to it to the agents and AI providers you configured, for example Anthropic or OpenAI, using your accounts. Those providers process that data under their own terms and privacy policies. Choose providers and settings that match your requirements.

5. Google user data (Gmail and Google Calendar)

You can connect a Google account in Integrations, Mail & calendar: your own mailbox, or a shared team mailbox if you are a workspace admin. Norc then asks Google for these permissions: read your email (gmail.readonly), create drafts and send email (gmail.compose), and see and create calendar events (calendar.events), plus your email address to know which account you connected.

Connecting an account gives no agent access by itself. You then choose, agent by agent, what each one may do: for email, nothing, read, write drafts, or send; for the calendar, nothing, read, write, or send invitations. You can limit an agent to one Gmail label. Only the owner of a personal mailbox can give agents access to it. Messages and invitations that leave your company wait for a person's approval in Norc, unless the owner of the workspace has explicitly allowed that agent to send that kind of message on its own.

Norc uses Google user data only to provide these features: an agent you allowed searches and reads the messages a task needs, prepares drafts, sends the messages you approved, and reads or creates the calendar events the task needs. What an agent reads is kept in your workspace only as part of the task (the agent's run, its comments and its results), under the retention rules in section 8.

To do the task, Norc sends that data to the AI provider that runs the agent, using the AI account your workspace configured (for example Anthropic or OpenAI). Norc sends no Google user data to anyone else, except where the law requires it.

Norc does not sell Google user data, does not use it for advertising, and does not use it to develop, improve or train generalized AI or machine learning models. Nobody at Norc reads it, unless you ask us to for a specific message, it is needed for security purposes such as investigating abuse, or the law requires it.

Your Google refresh token is encrypted at rest with your workspace's own key. On Norc Cloud, the token exchange with Google goes through our connection service, auth.getnorc.com, which holds Norc's Google client secret. It hands the token to your workspace within two minutes, then keeps only a fingerprint (hash) of it to know which workspace it belongs to. It never sees the content of your email or calendar.

You can disconnect an account at any time in Integrations, Mail & calendar. Norc then revokes the token at Google and deletes it. You can also remove Norc's access at myaccount.google.com/permissions.

Norc's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

6. Where data is stored and who helps us

Norc Cloud workspaces run in the European Union. Each one is a separate instance with its own database and encryption key. We use these sub-processors:

• Hetzner Online GmbH (Germany): servers in Finland that host the workspaces.
• Cloudflare, Inc.: DNS, network protection and secure tunnels; the sign-in and connection service (auth.getnorc.com) and the account service (app.getnorc.com); encrypted backups stored in the EU.
• Google LLC: sign-in with Google, if you use it, and Gmail and Google Calendar, if you connect them (see section 5).
• Amazon Web Services EMEA SARL: cloud machines in Stockholm, only if you rent a machine through Norc.
• Stripe Payments Europe, Ltd.: payments, once paid plans are enabled.

7. International transfers

Some of these providers are established in the United States or may process data outside the EU, for example Cloudflare's global network or Google sign-in. In those cases, the transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

8. How long we keep it

We keep workspace data for as long as the workspace exists. When a workspace is deleted, its live data is deleted within 30 days. Encrypted backups expire on a rolling schedule and are gone within 6 months. Billing records are kept for 10 years, as French accounting law requires.

Sign-in cookies last up to 30 days. Technical logs are kept for a short time, usually no more than 30 days.

9. Cookies

Norc only uses cookies that are needed for the service to work. Your workspace uses a session cookie and a short-lived cookie that protects sign-in and connection flows. auth.getnorc.com uses a cookie that remembers your sign-in for up to 30 days, so you do not have to sign in again for each workspace. These cookies need no consent, and we use no tracking or advertising cookies.

10. Security

Traffic is encrypted in transit, and stored secrets are encrypted at rest. Workspaces are isolated from each other, and backups are encrypted before they leave the server. Access to production systems is limited to the people who operate Norc. If a personal data breach affects you, we will notify you and the competent authority as the law requires.

11. Your rights

You have the right to access, correct, delete, or export your personal data, to object to or restrict its processing, and to withdraw consent where processing relies on it. You can also give instructions about what happens to your data after your death. To exercise these rights, write to [email protected]. We answer within one month. For content in an organization's workspace, we may forward your request to that organization.

You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority in the country where you live.

12. Changes

We will update this policy when our practices change, and change the date at the top. If a change is material, we will tell workspace owners in advance.