Privacy Policy
Effective date: April 19, 2026. Summarizes typical practices for a beta; align with counsel and your Clerk / hosting DPAs before production claims.
1. Who we are
NORA Foundation operates public-interest web properties and may offer account-based features. This policy describes how we collect, use, and share personal information in connection with those services.
2. Information we collect
Account & authentication.If you create an account, our authentication provider (Clerk) processes identifiers such as email address and profile details you supply. See Clerk's privacy notice for processor-side details.
Content you submit. Documents or messages you upload or send through the workspace may be stored and processed to provide the service (including search, retrieval, and AI-assisted features).
Technical data. We collect standard server logs, device/browser metadata, and diagnostics as needed for security and reliability (including error reporting tools such as Sentry when enabled).
3. How we use information
We use information to operate and improve the services, authenticate users, prevent abuse, comply with law, and communicate with you about the service.
4. Sharing & subprocessors
We use infrastructure and service providers (for example hosting, database, email, payments, and AI providers when you invoke those features). Those providers process data under their terms and, where applicable, as subprocessors under our agreements with you or standard industry terms.
5. Retention & deletion
We retain information as long as needed to provide the service and meet legal obligations. You may request deletion of your account subject to lawful exceptions (e.g., fraud prevention, backups). Specific retention mechanics may evolve during beta.
6. International transfers
If you access the service from outside the United States, your information may be processed in the U.S. or other jurisdictions where we or our providers operate.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, or port your personal data, and to object to certain processing. Contact us via the contact page to exercise rights; we will verify requests as permitted by law.
8. Children's privacy
The services are not directed at children under 13 (or the age required in your jurisdiction). Do not provide personal information if you are not of legal age to consent.
9. Changes to this policy
We may update this policy. We will post the revised policy on this page and update the effective date when practicable.