Privacy Policy

1. Who This Policy Covers

This Policy applies to:

• Site visitors — anyone browsing our websites.
• Prospective customers — individuals who request a demo or contact us.
• Job applicants — individuals who apply to open roles or join our talent network.
• Product users — individuals who hold an account for our product applications.

Content and data that our customers submit to Norric products in the course of using them ("Customer Data") is processed on behalf of our customers under our customer agreements, including any applicable data processing addendum. Except as described in Section 4 (AI and Model Training), this Policy does not apply to Customer Data. If you have questions about how Customer Data is handled, please refer to your organization's agreement with Norric.

2. Personal Data We Collect

Data you provide to us

• Demo requests — name, email address, phone number, company, job title, country, and your message.
• Contact inquiries — name, email address, the type of inquiry, and your message.
• Job and talent-network applications — name, email address, the role or role type you are interested in, your resume or CV, and, if you choose to provide them, your LinkedIn profile URL, a portfolio, and any additional information you share with us.
• Newsletter subscriptions — email address.
• Product accounts — name, email address, and authentication and workspace information needed to operate your account.

Providing this data is voluntary. If you choose not to provide it, we may be unable to respond to your request, consider your application, or provide the Services.

Data collected automatically

• Server and network logs — IP address, browser type and version, pages visited, request identifiers, and timestamps. Website logs are collected by our hosting provider; product application and network logs are collected in our AWS environment for security, forensics, and reliability.
• Product usage analytics — information about how you interact with the Services (such as features used and actions taken) and diagnostic information about errors you encounter, collected through PostHog to help us improve the product.
• Cookies and similar technologies — described in our Cookie Policy, which also explains how to manage your choices. Where consent is required by applicable law, optional cookies are loaded only after you consent.

3. How We Use Personal Data

We use personal data for the following purposes. Where the EU or UK GDPR applies, the legal basis for each purpose is noted.

• Responding to demo requests and inquiries — to communicate with you about our products and services (steps taken at your request prior to entering into a contract, Art. 6(1)(b)).
• Providing and operating the Services — to authenticate users, maintain accounts, and deliver product functionality (performance of a contract, Art. 6(1)(b)).
• Evaluating job applications — to review candidates and manage our talent network (steps taken at your request prior to entering into a contract, and our legitimate interest in recruiting, Art. 6(1)(b) and (f)).
• Improving the Services — to understand how the Services are used and make them better (our legitimate interest, Art. 6(1)(f); consent where required for cookies or similar technologies, Art. 6(1)(a)).
• Security and abuse prevention — to protect the Services, our customers, and third parties (our legitimate interest, Art. 6(1)(f)).
• Marketing communications — to send you information about our products, only where permitted, and you may opt out at any time (consent, Art. 6(1)(a)).
• Legal compliance — to comply with applicable law and respond to lawful requests (legal obligation, Art. 6(1)(c)).

Where the Personal Information Protection Act of Korea (K-PIPA) applies, we collect and use personal data with your consent or on another basis permitted by K-PIPA, and only to the extent necessary for the purposes above.

4. AI and Model Training

Norric does not use Customer Data or personal data to train, fine-tune, or improve any foundation or proprietary AI models, and does not permit its AI providers to do so. Customer Data remains confidential and isolated to your environment, and is processed only to provide the Services in accordance with our customer agreements.

Delivering the Services requires sending content derived from Customer Data to third-party AI model providers for inference — document parsing, embedding generation, retrieval reranking, and answer suggestion. Those providers are engaged under written agreements with zero-data-retention terms or equivalent: they may not train on the content, and they retain nothing beyond the time needed to return a response. Retrieval is scoped to each customer's own workspace, so content is never surfaced across customers. The providers in use are listed in Section 5.

5. How We Share Personal Data

We do not sell personal data, and we do not share personal data for cross-context behavioral advertising. We share personal data only in the following circumstances:

• Service providers acting on our behalf under written agreements:
  • Google — business email and productivity (form submissions are delivered to and stored in our email system)
  • Vercel — hosting for the website and the web tier of our product applications (requests and uploads pass through without being stored)
  • Amazon Web Services — product infrastructure and data storage
  • OpenAI, Anthropic, Google, and xAI — AI model inference for product features, under zero-data-retention terms
  • Slack — operational alerts that carry pseudonymous identifiers only
  • PostHog — usage analytics
• Legal requirements — where disclosure is required by law, regulation, or a valid legal process.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to notice where required by law.
• With your consent — for any other purpose you approve.

For Customer Data, the authoritative list of subprocessors, with their processing locations and transfer mechanisms, is set out in our data processing addendum, and customers receive advance notice of changes as described there.

6. International Data Transfers

Our production environment operates in the United States (AWS us-east-1, with a disaster-recovery replica in us-west-2), and our development environment in the Republic of Korea (AWS ap-northeast-2). The web tier of our product applications runs on Vercel and handles each request in the United States or, for requests from nearby locations, in the Republic of Korea; it stores no Customer Data. The AI model providers listed in Section 5 process inference requests in the United States. Our other service providers may process personal data in the countries where they operate. Where we transfer personal data from the EU, EEA, or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum where applicable.

For data subjects in Korea, we transfer personal data overseas as follows:

• Recipients and country — Norric, Inc. and the service providers listed in Section 5, in the United States.
• Data transferred — the personal data described in Section 2.
• Timing and method — transmitted over encrypted network connections when you submit a form or use the Services.
• Purpose and retention — the purposes described in Section 3, for the periods described in Section 7.

You may refuse this transfer by not providing your personal data or by contacting us at security@norric.ai. If you refuse, we may be unable to respond to your request, consider your application, or provide the Services.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, and then delete or anonymize it. As a general rule:

• Demo requests and inquiries — up to 24 months after our last interaction with you.
• Job and talent-network applications — up to 12 months after submission, unless you consent to a longer period or we hire you.
• Newsletter subscriptions — until you unsubscribe.
• Server and network logs — up to 12 months.
• Product account data — for the life of the account, plus any period required by law or our customer agreements.

We may retain data for longer where required by law or necessary to establish, exercise, or defend legal claims.

When personal data is no longer needed, we delete electronic records using methods that prevent recovery and shred any paper records. Copies in encrypted backups are removed as backups expire on our standard cycle, within 35 days after deletion.

8. Your Rights

EU, EEA, and UK

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your supervisory authority.

California

Under the CCPA/CPRA, you have the right to know, correct, and delete personal information we hold about you, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information as defined by California law, and we honor Global Privacy Control (GPC) signals. You can manage optional cookies at any time on the Cookie Preferences page.

Korea

Under K-PIPA, you have the right to access, correct, delete, and suspend the processing of your personal data. You may also contact the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency (KISA) for dispute resolution.

To exercise any of these rights, contact us at security@norric.ai. We may need to verify your identity before acting on a request, and we will respond within the timeframe required by applicable law (one month under the GDPR; 45 days under the CCPA; 10 days under K-PIPA; each extendable as permitted).

9. Children's Privacy

The Services are intended for business users and are not directed to children. We do not knowingly collect personal data from children under 16 (or the applicable minimum age in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Do Not Track and Global Privacy Control

We do not track visitors across third-party websites, and we do not permit third parties to use our Services to do so. Because there is no industry consensus on how to interpret "Do Not Track" browser signals, we do not respond to them. We do, however, honor Global Privacy Control (GPC) signals as described in our Cookie Policy.

11. Security

We apply technical and organizational measures appropriate to the sensitivity of the data we process, including encryption in transit, access controls operated under zero-trust principles, and isolation of customer environments. You can read more about our security practices on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or by a notice on the Services before the changes take effect. The "Last Updated" date at the top of this Policy indicates when it was last revised.

13. Contact Us

For questions, concerns, or requests relating to this Policy or your personal data, contact us at:

Email: security@norric.ai

Mail: Norric, Inc., 135 Madison Ave, New York, NY 10016, United States

Privacy Officer (Korea, 개인정보 보호책임자): Security Lead, security@norric.ai