NoraLite Privacy Policy
Nora Comply Limited · Last updated 12 October 2026
1. Who we are
Nora Comply Limited (we, us) runs NoraLite. We are a company registered in Ireland under number 822895, with our registered office at 12 Liffey Street Lower, Dublin 1 D01 W9F2. For the personal data described in this policy, we are the controller.
Contact us about privacy at emily@noracomply.com or by post to our registered office. We reply within one month, as the GDPR requires. For complex requests this can be extended by up to two further months; we will tell you if so.
We have not appointed a Data Protection Officer because the GDPR does not require one for the kind of processing we carry out. Our privacy lead deals with all privacy questions.
2. What this policy covers
This policy explains how we use personal data about:
- people who sign up for, log in to or pay for NoraLite on behalf of their business (account users);
- people who visit our website or contact us;
- people who receive our emails.
If your employer uses NoraLite to record your AI training, your employer is the controller of that data and we process it on their behalf under a Data Processing Agreement. Your employer's own privacy notice explains how it uses your data. Please contact your employer first; we will help them respond to you.
3. What we collect, why, and our legal basis
We collect only what we need to run NoraLite. Most of it comes from you; some is generated as you use the service.
| Data | Examples | Why we use it | Legal basis (GDPR Art 6(1)) |
|---|---|---|---|
| Account details | Name, work email, business name, role, password (stored securely as a hash, never in plain text) | Create and run your account, sign you in | Contract with your business, and our legitimate interest in providing the service to the people it authorises |
| Billing details | Business name, billing email, VAT number, invoice history | Take payment, issue invoices, keep tax records | Contract; legal obligation (tax law) |
| Usage and technical data | IP address, browser, device, log-in times, pages and features used, error reports | Keep NoraLite secure and working, fix bugs, prevent misuse | Legitimate interest in a secure, reliable service |
| Support messages | What you write to us and our replies | Answer questions and resolve problems | Contract; legitimate interest |
| Service emails | Email address, whether emails are delivered | Send renewal reminders, security alerts and service notices | Contract; legitimate interest |
| Marketing emails | Email address, your preferences | Send product news, if you choose to receive it | Consent, or legitimate interest for existing customers, with an easy opt-out in every email |
You need to give us account and billing details to use NoraLite; without them we cannot provide the service. We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
AI features. Some NoraLite features use AI services from Anthropic and Cohere. When you use Ask Nora, the question you type and relevant details of your company's AI tools, uses and tasks are sent to Anthropic to write the answer, the question’s text, and any searches you run, are sent to Cohere to search our legal sources. We do not send your name or email address, but anything you type into a question is sent. We do not allow these providers to use your data to train their models.
4. Who we share data with
We do not sell personal data. We share it only with the service providers below, who act on our instructions under written contracts.
| Provider | What it does for us | Location of processing |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Vercel | Website and app hosting | EU (Frankfurt) for the app; global network for delivery |
| Cloudflare | Bot protection on sign-up and sign-in | Global network |
| Anthropic | AI features | United States by default |
| Cohere | AI search and retrieval features | Canada and the United States |
| Resend | Sending service emails | EU (Ireland) |
| Sentry | Error monitoring | EU (Frankfurt) |
| Inngest | Running background tasks | [Confirm with Inngest] |
Revolut processes your payments. Revolut acts as a separate controller for payment data under its own privacy notice.
We may also share personal data with our professional advisers (lawyers, accountants, auditors) under a duty of confidentiality; with authorities where the law requires; and with a buyer if we sell our business, under the same protections.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area, for example in the United States. Where they do, we protect the transfer with a recognised safeguard: an EU adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard at emily@noracomply.com.
6. How long we keep data
We keep personal data only as long as we need it, as set out below.
| Data | How long we keep it |
|---|---|
| Account details | While the subscription is active, then deleted within 90 days of it ending |
| Billing and invoice records | 6 years after the end of the financial year they relate to, as Irish tax law requires |
| Usage logs and error reports | Up to 90 days |
| Support messages | 2 years after the conversation ends |
| Marketing email data | Until you unsubscribe, then kept only on a suppression list so we do not email you again |
| Backups | Overwritten on a rolling cycle of 35 days |
7. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, where we no longer have a reason to keep it;
- restrict how we use it, or object to uses based on our legitimate interests;
- give you your data in a portable format;
- stop sending you marketing, at any time.
Where we rely on your consent, you can withdraw it at any time. Email emily@noracomply.com. We will reply within one month, and we may ask you to confirm your identity first.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission, Ireland's data protection regulator, or to the regulator where you live or work. We would appreciate the chance to resolve it first.
8. Cookies
We use only the cookies needed to sign you in, keep NoraLite secure, and remember your display settings. These do not need your consent. We also keep two small cookies that remember your display settings (dark mode and text size). We use no analytics, advertising or tracking cookies.
9. Security
We protect personal data with measures including encryption in transit and at rest, access controls, and monitoring. Your data is stored in the EU (Frankfurt), each customer's records are kept apart in the database itself, backups are encrypted, and error reports leave out personal details. No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Data Protection Commission as the law requires.
10. Children, and changes to this policy
NoraLite is a business service and is not intended for anyone under 18.
We may update this policy. We will post the new version here with its date and, for significant changes, tell account users by email.