Last Updated: July 15, 2026
Norric — GDPR / UK GDPR / CCPA-CPRA / K-PIPA
Document ID: NRC-POL-CKE-001
Version: 1.1
Effective Date: 2026-05-06
Next Review: 2027-05-06
Policy Owner: Security Lead (security@norric.ai)
This Cookie Policy applies to all visitors and users of the Norric websites operated by Norric, Inc. ("Norric," "we," "us," or "our"), including the marketing website at https://www.norric.ai and the authenticated product application at https://ddq.norric.ai (collectively, the "Sites"). It also applies to all Norric employees, contractors, and vendors who design, deploy, or maintain cookies and similar technologies on the Sites, including in connection with personal data of data subjects in the European Union, the European Economic Area, the United Kingdom, California, the Republic of Korea, and other jurisdictions with cookie or tracking-technology requirements.
Capitalized terms used in this Cookie Policy but not defined here have the meaning set forth in the Norric Privacy Policy, which provides additional detail about the collection and use of personal information at Norric.
Cookies are small text files placed on your computer or mobile device when you visit a website. They allow the site to recognize your device and remember information about your visit. Session cookies last only while your browser is open and are deleted when you close it. Persistent cookies remain on your device until they expire or you delete them. This Cookie Policy also applies to similar technologies such as web beacons, pixels, local storage, and SDK identifiers, even where they are not technically "cookies".
Yes. Norric uses a small number of first-party cookies that are strictly necessary to operate the Sites and authenticate product users, together with optional analytics and marketing technologies that are loaded only after the visitor provides consent through the cookie banner (where consent is the legal basis under applicable law).
Where the EU GDPR, the UK GDPR, the ePrivacy Directive (and national implementations), K-PIPA, or other consent-based regimes apply, Norric stores and accesses cookies on your device on the following bases:
Where the CCPA/CPRA applies, Norric does not "sell" or "share" personal information as defined by California law. Norric also honors Global Privacy Control (GPC) signals as an opt-out of any processing that could be considered a "sale" or "sharing" under California law.
Norric uses cookies to keep authenticated users signed in to the product, to remember interface preferences such as language, to protect the Sites against abuse, and — only with your consent — to understand how visitors use our marketing pages so we can improve them. Cookies set by Norric are not used to build behavioral profiles, are not sold to data brokers, and are not used for cross-site advertising.
Authentication. Cookies on ddq.norric.ai keep you signed in to your Norric workspace and remember the workspace you are currently using.
Security. Norric uses cookies to enable session integrity and CSRF protection for the Sites.
Preferences and features. Cookies remember interface preferences such as language and your cookie-consent choices, so we do not have to ask you on every visit.
Analytics and product research (consent-gated). With your consent, Norric uses PostHog to understand aggregate usage of the Sites and to improve them.
Marketing. Norric does not currently use third-party advertising or retargeting cookies. Where we add such technologies in the future, they will appear in the cookie tables below and will be loaded only after you provide consent.
With your consent, Norric loads PostHog analytics. PostHog processes information as Norric's processor under a written agreement that includes the GDPR Article 28 clauses and an appropriate cross-border transfer mechanism (Standard Contractual Clauses, with the UK International Data Transfer Addendum where applicable). The current third-party cookies are listed in the cookie tables below; the list may change from time to time, and the in-product Cookie Preferences view always reflects the current state.
Norric does not use cookies, pixels, or similar technologies for cross-site advertising, retargeting, or audience-list building. We do not share cookie-derived data with advertising networks. If this changes, this Cookie Policy and the cookie banner will be updated before any such cookies are deployed.
You can withdraw or change your consent at any time through the "Cookie Preferences" link in the footer of the Sites. Disabling categories other than "Strictly Necessary" will not affect your ability to use the core product, but some marketing-site features may behave differently.
Most browsers also let you block or delete cookies through their settings menu. Disabling strictly-necessary cookies through your browser may prevent you from signing in to ddq.norric.ai or from completing forms on the Sites. Norric honors Global Privacy Control (GPC) signals: when GPC is enabled, non-essential cookies are not loaded and we do not share personal information for cross-context behavioral advertising.
Norric does not track visitors across third-party websites or services over time. Because there is no industry consensus on how to interpret "Do Not Track" (DNT) browser signals, Norric does not change its behavior in response to DNT. We do, however, honor Global Privacy Control (GPC) signals as described above.
The Sites are intended for business users and are not directed to children. Norric does not knowingly set cookies on the devices of children under the age of 16 (or the applicable minimum age in your jurisdiction).
These cookies are required for the Sites to function and to keep you signed in to the product. They are set without consent because they are necessary to deliver a service you have requested. Blocking them through your browser will break parts of the Sites.
| Domain | Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|---|
| ddq.norric.ai | __Secure-authjs.session-token | First party | Authenticated user session for the Norric product. | Up to 24 hours (renewed while signed in) |
| ddq.norric.ai | __Host-authjs.csrf-token | First party | CSRF token used to protect sign-in and API submissions. | Session |
| ddq.norric.ai | __Secure-authjs.callback-url | First party | Stores the sign-in redirect destination. | Session |
| www.norric.ai, ddq.norric.ai | norric_consent | First party | Stores your cookie-consent choices so we do not re-prompt on every visit. | 12 months |
Norric does not currently set functional cookies. If this changes, the new cookies will be added to this table and will be loaded only after consent.
Norric uses PostHog to understand aggregate visitor and user behavior and improve the Sites. PostHog is not used for advertising or cross-site tracking. These cookies are loaded only after you provide consent through the cookie banner. To opt out at any time, change your choice in "Cookie Preferences".
| Domain | Cookie name | Provider | Purpose | Expiry |
|---|---|---|---|---|
| .norric.ai (all Norric sites) | ph_<project-key>_posthog | PostHog (processor) | Distinguishes visitors and persists session state for aggregate product analytics. | Up to 12 months |
Norric does not currently set marketing, advertising, or retargeting cookies. If this changes, the new cookies will be added to this table and will be loaded only after consent.
When you follow links from the Sites to third-party services (for example, Norric's documentation, status page, or external integrations), those services may set their own cookies. Norric does not control cookies set by other websites; review their respective cookie notices for details.
You can manage cookies through the "Help," "Tools," or "Settings" menu of your browser. Disabling a cookie through your browser does not delete cookies that were previously stored — you may need to clear them manually. If you delete cookies after visiting the Sites, the information already collected before the change may still be used. Once a cookie is disabled or its consent is withdrawn, Norric will stop using it to collect any further information from your visit.
Questions or complaints about this Cookie Policy can be sent to security@norric.ai. Where Norric is unable to resolve a complaint, EU/EEA and UK data subjects have the right to lodge a complaint with their competent supervisory authority; California consumers may contact the California Privacy Protection Agency or the California Attorney General; and Korean data subjects may contact the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA).
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.1 | 2026-07-15 | Replaced Google Analytics 4 with PostHog as the analytics provider; removed Cloudflare, which is no longer used; aligned cookie tables with an audit of the cookies actually set in production. | Security Lead | Chief Executive Officer |
| 1.0 | 2026-05-06 | Initial Cookie Policy. | Security Lead | Chief Executive Officer |
