Last Updated: October 30, 2026
Version: 1.4
Effective Date: 2026-10-30
This Cookie Policy applies to all visitors and users of the Norric websites operated by Norric, Inc. ("Norric," "we," "us," or "our"), including the marketing website at https://www.norric.ai, the authenticated product application at https://ddq.norric.ai, and its sign-in service at https://auth.norric.ai (collectively, the "Sites").
Capitalized terms used in this Cookie Policy but not defined here have the meaning set forth in the Norric Privacy Policy, which provides additional detail about the collection and use of personal information at Norric.
Cookies are small text files placed on your computer or mobile device when you visit a website. They allow the site to recognize your device and remember information about your visit. Session cookies last only while your browser is open and are deleted when you close it. Persistent cookies remain on your device until they expire or you delete them. This Cookie Policy also applies to similar technologies such as web beacons, pixels, local storage, and SDK identifiers, even where they are not technically "cookies".
Yes. Norric uses a small number of first-party cookies that are strictly necessary to operate the Sites and authenticate product users, together with optional analytics technologies that are loaded only after the visitor provides consent through the cookie banner (where consent is the legal basis under applicable law).
Where the EU GDPR, the UK GDPR, the ePrivacy Directive (and national implementations), K-PIPA, or other consent-based regimes apply, Norric stores and accesses cookies on your device on the following bases:
Where the CCPA/CPRA applies, Norric does not "sell" or "share" personal information as defined by California law. Norric also honors Global Privacy Control (GPC) signals as an opt-out of any processing that could be considered a "sale" or "sharing" under California law.
Norric uses cookies to keep authenticated users signed in to the product, to remember your cookie-consent choices, to protect the Sites against abuse, and — only with your consent — to understand how visitors use our marketing pages so we can improve them. Cookies set by Norric are not used to build behavioral profiles, are not sold to data brokers, and are not used for cross-site advertising.
Authentication. Cookies on ddq.norric.ai and auth.norric.ai keep you signed in to your Norric workspace.
Security. Norric uses cookies to enable session integrity and CSRF protection for the Sites.
Preferences. A cookie remembers your cookie-consent choices, so we do not have to ask you on every visit.
Analytics and product research (consent-gated). With your consent, Norric uses PostHog to understand aggregate usage of the Sites and to improve them.
Marketing. Norric does not currently use third-party advertising or retargeting cookies. Where we add such technologies in the future, they will appear in the cookie tables below and will be loaded only after you provide consent.
With your consent, Norric loads PostHog analytics. PostHog processes information as Norric's processor under a written agreement that includes the GDPR Article 28 clauses and an appropriate cross-border transfer mechanism (Standard Contractual Clauses, with the UK International Data Transfer Addendum where applicable). The current third-party cookies are listed in the cookie tables below; the list may change from time to time, and the in-product Cookie Preferences view always reflects the current state.
Norric does not use cookies, pixels, or similar technologies for cross-site advertising, retargeting, or audience-list building. We do not share cookie-derived data with advertising networks. If this changes, this Cookie Policy and the cookie banner will be updated before any such cookies are deployed.
You can withdraw or change your consent at any time through the "Cookie Preferences" link in the footer of the Sites. Disabling categories other than "Strictly Necessary" will not affect your ability to use the Sites.
Most browsers also let you block or delete cookies through their settings menu. Disabling strictly-necessary cookies through your browser may prevent you from signing in to the Norric product. Norric honors Global Privacy Control (GPC) signals: when GPC is enabled, non-essential cookies are not loaded and we do not share personal information for cross-context behavioral advertising.
Norric does not track visitors across third-party websites or services over time. Because there is no industry consensus on how to interpret "Do Not Track" (DNT) browser signals, Norric does not change its behavior in response to DNT. We do, however, honor Global Privacy Control (GPC) signals as described above.
The Sites are intended for business users and are not directed to children. Norric does not knowingly set cookies on the devices of children under the age of 16 (or the applicable minimum age in your jurisdiction).
These cookies are required for the Sites to function and to keep you signed in to the product. They are set without consent because they are necessary to deliver a service you have requested. Blocking them through your browser will break parts of the Sites.
| Domain | Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|---|
| auth.norric.ai | __Host-norric-sso-* | First party | Holds the state of a single sign-on (SSO) login while it is in progress. | 10 minutes |
| ddq.norric.ai | __Host-norric-app-session | First party | Short-lived credential for your signed-in product session. | 10 minutes (renewed while signed in) |
| ddq.norric.ai | __Host-norric-app-refresh | First party | Renews your session without asking you to sign in again. | Up to 8 hours from sign-in |
| ddq.norric.ai | __Host-norric-app-sso-verifier | First party | Protects single sign-on against interception. | 10 minutes |
| ddq.norric.ai | __Host-norric-app-mfa-challenge | First party | Holds a pending multi-factor authentication step. | 5 minutes |
| ddq.norric.ai | __Host-norric-email-login-attempt | First party | Ties an email sign-in link to the browser that requested it. | 5 minutes |
| ddq.norric.ai | __Host-norric-app-outlook-session, __Host-norric-app-outlook-refresh, __Host-norric-outlook-login, __Host-norric-outlook | First party | Signs you in to the Norric Outlook add-in, if you use it. | 5 minutes to 8 hours |
| .norric.ai (all Norric sites) | norric_consent | First party | Stores your cookie-consent choices on www.norric.ai so we do not re-prompt on every visit. | 12 months |
| ddq.norric.ai | norric.cookie-preferences.v1 (local storage) | First party | Stores your cookie-consent choices in the Norric product. | Until you clear it |
Norric does not currently set functional cookies. If this changes, the new cookies will be added to this table and will be loaded only after consent.
Norric uses PostHog to understand aggregate visitor and user behavior and improve the Sites. PostHog is not used for advertising or cross-site tracking. These cookies are loaded only after you provide consent through the cookie banner. To opt out at any time, change your choice in "Cookie Preferences".
| Domain | Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|---|
| .norric.ai (all Norric sites) | ph_<project-key>_posthog | PostHog (processor) | Distinguishes visitors and persists session state for aggregate product analytics. | Up to 12 months |
Norric does not currently set marketing, advertising, or retargeting cookies. If this changes, the new cookies will be added to this table and will be loaded only after consent.
When you follow links from the Sites to third-party services (for example, our Substack newsletter), or choose to load an embedded Google Map on a job posting, those services may set their own cookies. Norric does not control cookies set by other websites; review their respective cookie notices for details.
You can manage cookies through the "Help," "Tools," or "Settings" menu of your browser. Disabling a cookie through your browser does not delete cookies that were previously stored — you may need to clear them manually. If you delete cookies after visiting the Sites, the information already collected before the change may still be used. Once a cookie is disabled or its consent is withdrawn, Norric will stop using it to collect any further information from your visit.
Questions or complaints about this Cookie Policy can be sent to security@norric.ai. Where Norric is unable to resolve a complaint, EU/EEA and UK data subjects have the right to lodge a complaint with their competent supervisory authority; California consumers may contact the California Privacy Protection Agency or the California Attorney General; and Korean data subjects may contact the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA).
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.4 | 2026-10-30 | Updated the strictly necessary cookie table to the current sign-in system, including auth.norric.ai; removed the retired Auth.js cookies. | Security Lead | Chief Executive Officer |
| 1.3 | 2026-10-30 | Embedded Google Maps on job postings now load only after the visitor chooses to show the map; added the auth.norric.ai sign-in service to the Sites; corrected the description of what happens when cookies are disabled. | Security Lead | Chief Executive Officer |
| 1.2 | 2026-10-02 | Corrected the consent cookie domain; removed references to marketing technologies and language-preference cookies, which are not in use; removed internal document metadata. | Security Lead | Chief Executive Officer |
| 1.1 | 2026-07-15 | Replaced Google Analytics 4 with PostHog as the analytics provider; removed Cloudflare, which is no longer used; aligned cookie tables with an audit of the cookies actually set in production. | Security Lead | Chief Executive Officer |
| 1.0 | 2026-05-06 | Initial Cookie Policy. | Security Lead | Chief Executive Officer |
