Privacy Policy

Last updated: July 2026 (version 2026-07)

This Privacy Notice for Norian(“we”, “us”, or “our”) describes how and why we access, collect, store, use, and share your personal information when you use our services (“Services”). This notice applies when you visit norian.ai, use the Norian application, or otherwise engage with us.

Norian is a SaaS application that connects to your email account (Gmail and Microsoft Outlook) in read-only mode. It monitors email conversations with your clients, automatically detects unresolved commitments and requests, and sends you a daily digest notification. Norian never sends, modifies, or deletes emails on your behalf.

Questions or concerns? Contact us at privacy@norian.ai.

SUMMARY

What we collect:Your email address and job title (from our waitlist form); your account name and email address (via OAuth from Google or Microsoft); subscription status from Stripe; usage analytics via PostHog; email metadata derived from your connected email account; and - when the “Scan contacts using personal email addresses” setting is enabled (on by default) - the email addresses of contacts who communicate with you via personal email services such as Gmail or Outlook.

What we do not collect: Raw email bodies (processed in memory only, never stored); sensitive personal data; payment card details (handled by Stripe directly).

Who we share it with: Only the service providers listed in section 4, under written data processing agreements. We never sell your data.

How long we keep it: For as long as your account is active. Data held by Norian is deleted within 60 seconds of account deletion, and access to your inbox is revoked within 24 hours.

Your rights: Access, rectify, erase, port, or object to processing of your data at norian.ai/settings or by emailing privacy@norian.ai.

TABLE OF CONTENTS

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share your information?
5. Do we use cookies and tracking technologies?
6. Do we use artificial intelligence?
7. Email provider data and limited use disclosure
8. Is your information transferred internationally?
9. How long do we keep your information?
10. How do we keep your information safe?
11. What are your privacy rights?
12. Do United States residents have specific rights?
13. Beta programme and feedback
14. How do we update this notice?
15. How can you contact us?

1. WHAT INFORMATION DO WE COLLECT?

Information you provide directly

• Waitlist form: email address, job title
• Support or feedback contact: any information you include in messages to us

Information collected automatically

• Log and usage data: IP address, browser type, pages visited, features used, timestamps - collected via PostHog (EU-hosted)
• Approximate location: derived from your IP address for aggregate analytics only. We do not collect GPS or precise location data.
• Email metadata: from your connected email account (Gmail or Outlook) - email frequency per client domain, response time patterns, thread length. Computed automatically during processing. No raw email bodies are ever stored. This metadata also powers the per-organisation and per-contact activity and response-time insights shown to you in the app.
• Contact email addresses (personal providers): When the “Scan contacts using personal email addresses” setting is enabled (default on), the full email address of each contact who emails you from a personal email service (e.g. gmail.com, outlook.com, icloud.com) is stored in our database to enable per-contact monitoring. These addresses are retained until you delete your account. You can disable this at any time in your account settings.

Information from third parties

• Google (via OAuth): your Gmail address and Google account name, used to create and manage your Norian account
• Microsoft (via OAuth): your Outlook email address and display name, used to connect your Outlook account to Norian
• Stripe: customer reference ID and subscription status only. We never receive or store your card details or billing address.
• UniPile: acts as an intermediary for email API access (Gmail and Outlook). Email message content (bodies) is accessed transiently in memory only - UniPile does not persistently store email bodies. To maintain the connection, UniPile holds an encrypted OAuth token and message-level metadata - recipients, message and thread identifiers, timestamps, and whether a message has attachments - for as long as your email account stays connected. This metadata is deleted when the connection is revoked (when you disconnect your inbox or delete your account).

Payment data. All payment processing is handled by Stripe. You can find their privacy notice at stripe.com/privacy. Norian receives only a customer ID and subscription status.

Sensitive information. We do not process sensitive personal information (health data, ethnicity, religion, biometrics, etc.).

Google API. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process your personal information for the following purposes:

• Create and manage your account; authenticate your identity
• Connect to your email account (Gmail or Outlook) and monitor email threads for unresolved commitments and requests (core service functionality)
• Send daily digest email notifications containing flagged items
• Send administrative communications (system alerts, policy updates, account notices)
• Respond to your support enquiries
• Analyse anonymised usage patterns to improve the service (via PostHog)
• Detect and prevent fraud or abuse
• Improve extraction accuracy by analysing feedback signals (items marked “not relevant” or added manually) - using account IDs only, no email content
• Identify inactive accounts for capacity management and beta programme administration
• Request feedback from beta users in accordance with the beta participation agreement
• Comply with legal obligations

3. WHAT LEGAL BASES DO WE RELY ON?

This section is primarily relevant to EEA, UK, and Swiss residents under the GDPR and equivalent laws.

Our role - controller and processor.For the core monitoring of your mailbox, you are the data controller of your clients' personal data and Norian acts as your processor, handling that data only on your instructions under a data processing agreement (see our Data Processing Agreement). For our own purposes - product analytics, security, and service improvement - Norian is an independent controller and relies on the legal bases below.

People who email you (your contacts). Your clients and contacts did not sign up for Norian. We process their names, email addresses, subject lines, and one-line summaries of their messages solely to surface commitments and requests to you. In the core monitoring flow we do this as your processor, on your legal basis as their controller; where Norian acts as its own controller (for example, security), the basis is our legitimate interest, balanced against their rights and freedoms.

• Performance of a contract (Article 6(1)(b) GDPR): Processing your Gmail data and sending digest notifications is necessary to deliver the service you signed up for. This is our primary legal basis for core processing activities.
• Legitimate interests (Article 6(1)(f) GDPR): Analytics, fraud prevention, service improvement, extraction accuracy optimisation, inactive account management, and short-term retention of pseudonymised waitlist data to prevent invitation abuse. We have assessed that these interests do not override your fundamental privacy rights, given the limited and anonymised or pseudonymised nature of the data involved.
• Consent (Article 6(1)(a) GDPR): Beta feedback communications, where free beta users have explicitly opted in. You can withdraw consent at any time by contacting privacy@norian.ai.
• Legal obligation (Article 6(1)(c) GDPR): Where processing is required by applicable law.

Canada: We process your information on the basis of express or implied consent, or where otherwise permitted under applicable Canadian privacy law (PIPEDA / Law 25). You may withdraw consent at any time by contacting us.

4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

We share personal information only with the sub-processors listed below, under written data processing agreements. We do not sell, rent, or trade your personal information.

We may also disclose your information: (a) if required by law, court order, or governmental authority; (b) to protect the rights, property, or safety of Norian, our users, or the public; or (c) in connection with a merger, acquisition, or sale of assets, in which case we will notify you and require the receiving party to honour this policy.

5. DO WE USE COOKIES AND TRACKING TECHNOLOGIES?

We use two categories of cookies:

• Strictly necessary: Session and authentication cookies (Supabase Auth). Required for the application to function. Cannot be disabled.
• Analytics: PostHog cookies to track anonymised usage patterns for product improvement only - not for advertising.

We do not use advertising, targeting, or social media tracking cookies.

For full details, see our Cookie Notice: norian.ai/cookie-policy.

6. DO WE USE ARTIFICIAL INTELLIGENCE?

Yes. We use OpenAI's GPT-4o-mini to analyse email content and extract structured data about commitments and requests. This is central to the core functionality of Norian.

What happens to your email data during AI processing:

• Raw email bodies are sent to the OpenAI API transiently for analysis, then immediately discarded. They are never stored in our database.
• Only the extracted one-line summary and structured metadata (commitment type, confidence score) are stored - not the original email text.
• OpenAI does not use API-submitted data to train its models under our API agreement.
• We do not use Gmail data to train, fine-tune, or improve any AI or machine learning model.

No automated decisions with legal effect. Norian's AI flags items for your review. You always decide what action to take. No automated decisions with legal or significant personal effects are made.

Opting out: AI processing is necessary to deliver the core service. To stop all processing, disconnect your email account or delete your account from norian.ai/settings.

7. EMAIL PROVIDER DATA AND LIMITED USE DISCLOSURE

Google (Gmail)

We access your Gmail account via read-only OAuth authentication using the gmail.readonly scope - the minimum necessary to provide the service. We access your emails solely to detect unresolved commitments and requests between you and your clients.

Specifically:

• We do not store raw email bodies permanently. Email content is processed transiently in memory and immediately discarded after extraction.
• We store only structured summaries, email metadata (sender domain, timestamp, response times), account settings, and - when the personal email contacts setting is enabled - sender email addresses of contacts who use personal email providers.
• We do not use Gmail data to develop, improve, or train any AI or machine learning model.
• We do not use Gmail data for advertising.
• We do not sell, rent, or share Gmail data with third parties, except as strictly necessary to provide the service: UniPile (email access intermediary) and OpenAI (text analysis, under strict data processing terms).
• No human at Norian accesses your email data except where required for security investigations, legal compliance, or at your explicit request.
• Gmail data is used exclusively to provide the Norian monitoring service described in this policy.

Microsoft (Outlook)

We access your Microsoft account via read-only OAuth authentication using the Mail.Read scope - the minimum necessary to provide the service. The same data handling principles apply:

• Raw email bodies are processed transiently in memory and immediately discarded after extraction.
• Only structured summaries and metadata are stored - not the original email text.
• We do not use Outlook data to develop, improve, or train any AI or machine learning model.
• We do not use Outlook data for advertising.
• Outlook data is used exclusively to provide the Norian monitoring service described in this policy.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

Our primary infrastructure is EU-based (Netherlands). We transfer data to the United States via sub-processors including OpenAI (AI text analysis), Stripe (payment processing), Microsoft (Outlook mail and Microsoft Teams chat access via Graph), and Slack (Slack Connect channel access, via Slack Technologies, LLC, a Salesforce company).

These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) in accordance with GDPR Article 46. Our SCCs and sub-processor agreements can be provided upon request at privacy@norian.ai.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

We retain personal information only for as long as your account is active. Specific retention periods:

• Raw email bodies: Never stored - discarded in memory immediately after processing
• Extracted summaries and metadata: Until account deletion
• Digest action tokens: 48 hours (single-use, expire on use or timeout)
• Digest inbox tokens:72 hours from issue. When we send your daily digest, we issue a single short-lived token that lets you triage items from the email link without logging in. The raw token is sent only in the email URL; we store a SHA-256 hash of it. We retain a hashed IP for the same 72-hour window to limit abuse on the triage endpoint. The token grants triage on your account's open inbox only - it does not grant access to settings, billing, your connected inboxes, or any account-level controls.
• Account deletion log: Up to 12 months after deletion, for fraud prevention and security purposes only
• Waitlist application email: Retained in irreversibly hashed (SHA-256) form for 90 days after account deletion, solely to prevent abuse of the invitation system (e.g. repeated sign-ups to obtain additional free access). After 90 days the hashed value is automatically deleted by a scheduled process. The hash cannot be reversed to recover your email address.
• Analytics data (PostHog):Per PostHog's retention policy, linked to anonymised account IDs only

When you delete your account, all personal data held by Norian is permanently deleted within 60 seconds, and access to your inbox (via UniPile) is revoked within 24 hours. The only exception is the waitlist application record described above, which is pseudonymised (irreversibly hashed) immediately upon deletion and fully removed after 90 days. No other personal data is retained after account deletion, except where required by applicable law (e.g. tax or accounting obligations).

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

Our security measures include:

• Encryption in transit: All connections use HTTPS. No unencrypted connections are permitted.
• Row Level Security (RLS):Enforced at the database level on every table. Users cannot access each other's data - this is architecturally enforced.
• EU-only primary storage: All data at rest is stored in EU-based infrastructure.
• No permanent email storage: Raw email bodies are processed in memory only and immediately discarded.
• Restricted service credentials: The database service role key is restricted to server-side background jobs only. It is never exposed to client-side code.
• Single-use tokenised action links: Digest email action links are cryptographically signed, single-use, and expire after 48 hours.
• Per-digest inbox tokens: 32-byte URL-safe tokens that grant logged-out triage on your open inbox for 72 hours. Stored only as SHA-256 hashes, scoped to your account, rate-limited per token and per IP.

No electronic transmission or storage can be guaranteed 100% secure. If you become aware of a potential security issue, please notify us at privacy@norian.ai.

11. WHAT ARE YOUR PRIVACY RIGHTS?

Under the GDPR and equivalent laws (EEA, UK, Switzerland, Canada), you have the right to:

• Access - request a copy of the personal data we hold about you
• Rectification - correct inaccurate or incomplete data
• Erasure - request deletion of your personal data
• Restriction - ask us to limit how we process your data
• Portability - receive your data in a structured, machine-readable format
• Objection - object to processing based on legitimate interests
• Withdraw consent - at any time, for consent-based processing (e.g. beta feedback emails)

To exercise your rights, visit norian.ai/settings or email privacy@norian.ai. We will respond within 30 days in accordance with GDPR Article 12.

If you believe we are unlawfully processing your personal data, you have the right to lodge a complaint with the Dutch data protection authority: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). UK residents may contact the ICO.

Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC RIGHTS?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional rights including the right to know, access, correct, delete, and port your personal information, and to opt out of profiling or sale of personal data.

We do not sell personal data, use it for targeted advertising, or create consumer profiles.

Categories of personal information collected (past 12 months)

To exercise your rights, visit norian.ai/settings or email privacy@norian.ai. To appeal a decision, email privacy@norian.ai. If your appeal is denied, you may contact your state attorney general.

California “Shine the Light”: We do not disclose personal information to third parties for their direct marketing purposes.

13. BETA PROGRAMME AND FEEDBACK

Free beta users have agreed, as a condition of free access, to participate in occasional feedback requests. This may include email surveys or short interviews. Participation in individual activities is voluntary beyond the initial consent. Beta access may be deactivated for accounts inactive for an extended period, in accordance with the beta participation agreement accepted at signup.

14. HOW DO WE UPDATE THIS NOTICE?

We may update this notice from time to time. The version date at the top of this document identifies the current version (format: YYYY-MM). We conduct an annual review in line with CASA recertification requirements.

For material changes - particularly those affecting how we process your email data or that require fresh consent under GDPR - we will notify you by email and display a notice within the application before changes take effect. Continued use of the service after notification constitutes acceptance. If you do not accept material changes, you may disconnect your email account or delete your account from norian.ai/settings.

15. HOW CAN YOU CONTACT US?

For privacy-related enquiries, data subject requests, or questions about this notice:

Email: privacy@norian.ai
Post: Norian, Ruyschstraat 31A, Amsterdam, Noord-Holland 1091 BS, Netherlands

We aim to respond to all privacy enquiries within 30 days. For data subject access requests under GDPR, you may also use the self-service tools at norian.ai/settings.

To report a security vulnerability or suspected data breach, email security@norian.ai immediately. We are required to notify the Autoriteit Persoonsgegevens of qualifying breaches within 72 hours.