Privacy Policy
Last updated: 3 November 2026
1. Who we are
Nora Comply Limited (we, us) runs NoraLite. We are a company registered in Ireland under number 822895, with our registered office at 12 Liffey Street Lower, Dublin 1 D01 W9F2. For the personal data described in this policy, we are the controller.
Contact us about privacy at emily@noracomply.com or by post to our registered office. We reply within one month, as the GDPR requires. For complex requests this can be extended by up to two further months; we will tell you if so.
We have not appointed a Data Protection Officer because the GDPR does not require one for the kind of processing we carry out. Our privacy lead deals with all privacy questions.
2. What this policy covers
This policy explains how we use personal data about:
- people who sign up for, log in to or pay for NoraLite on behalf of their business (account users);
- people who visit our website or contact us;
- people who receive our emails.
If your employer uses NoraLite to record your AI training, your employer is the controller of that data and we process it on their behalf under a Data Processing Agreement. Your employer's own privacy notice explains how it uses your data. Please contact your employer first; we will help them respond to you.
3. What we collect, why, and our legal basis
We collect only what we need to run NoraLite. Most of it comes from you; some is generated as you use the service.
When you join our waitlist or get in touch through our website, we collect the information you give us directly (such as your name, email address and company) so we can respond to you and, if you joined the waitlist, keep you updated.
| Data | Examples | Why we use it | Legal basis (GDPR Art 6(1)) |
|---|---|---|---|
| Account details | Name, work email, business name, role, password (stored securely as a hash, never in plain text) | Create and run your account, sign you in | Contract with your business, and our legitimate interest in providing the service to the people it authorises |
| Billing details | Business name, billing email, VAT number, invoice history | Take payment, issue invoices, keep tax records | Contract; legal obligation (tax law) |
| Usage and technical data | IP address, browser, device, log-in times, pages and features used, error reports | Keep NoraLite secure and working, fix bugs, prevent misuse | Legitimate interest in a secure, reliable service |
| Support messages | What you write to us and our replies | Answer questions and resolve problems | Contract; legitimate interest |
| Service emails | Email address, whether emails are delivered | Send renewal reminders, security alerts and service notices | Contract; legitimate interest |
| Marketing emails | Email address, your preferences | Send product news, if you choose to receive it | Consent, or legitimate interest for existing customers, with an easy opt-out in every email |
You need to give us account and billing details to use NoraLite; without them we cannot provide the service. We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
AI features. Some NoraLite features use AI services from Anthropic and Cohere. When you use Ask Nora, the question you type and relevant details of your company's AI tools, uses and tasks are sent to Anthropic to write the answer, the question’s text, and any searches you run, are sent to Cohere to search our legal sources. We do not send your name or email address, but anything you type into a question is sent. We do not allow these providers to use your data to train their models.
4A. Shadow AI: data from Microsoft 365 and Google Workspace
If your company connects Shadow AI, NoraLite reads records your company's Microsoft 365 or Google Workspace already keeps, to show which AI tools your team uses. We do this for your company, which decides to connect and can disconnect at any time. For this data we act as your company's processor.
What we read. The list of apps people in your company have connected to their work accounts, what access each app was given, and how many people connected each one; counts of Microsoft Copilot or Google Gemini use; and the total number of staff accounts. From Google we also read the company's domain, to check the account belongs to your company.
What we never read. Emails, files, calendars, chats, meetings, prompts typed into AI tools and their answers, browsing history, personal accounts, or anything on a device.
What we keep. For each AI tool: its name, how many people connected it, what access it has, when we first and last saw it, and your company's decision about it. We do not keep employees' names, email addresses, ids or IP addresses from these records. Where Google or Microsoft would send them, we ask for the records without them or delete them as soon as the count is made. For Google, we keep the connection token, encrypted, until the connection ends.
How long. Until your company disconnects or its account ends. A broken Google connection not repaired within 30 days is removed.
Google user data. NoraLite's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy). In particular, we use Google data only to provide Shadow AI to your company. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train any AI or machine-learning model. No person at NoraComply reads it, except where your company asks us to, for security, to comply with the law, or as anonymous totals across companies to keep our catalogue of AI tools up to date (an app's name and how many companies use it, never which company).
Disconnecting. Your company can disconnect in NoraLite (Settings, Connections). For Google, disconnecting also withdraws NoraLite's access at Google. For Microsoft, your administrator removes the NoraLite app in Microsoft Entra.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area, for example in the United States. Where they do, we protect the transfer with a recognised safeguard: an EU adequacy decision (including the EU-US Data Privacy Framework for certified US companies) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard at emily@noracomply.com.
6. How long we keep data
We keep personal data only as long as we need it, as set out below.
| Data | How long we keep it |
|---|---|
| Account details | While the subscription is active, then deleted within 90 days of it ending |
| Billing and invoice records | 6 years after the end of the financial year they relate to, as Irish tax law requires |
| Usage logs and error reports | Up to 90 days |
| Support messages | 2 years after the conversation ends |
| Marketing email data | Until you unsubscribe, then kept only on a suppression list so we do not email you again |
| Backups | Overwritten on a rolling cycle of 35 days |
7. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data;
- correct data that is wrong or incomplete;
- delete your data, where we no longer have a reason to keep it;
- restrict how we use it, or object to uses based on our legitimate interests;
- give you your data in a portable format;
- stop sending you marketing, at any time.
Where we rely on your consent, you can withdraw it at any time. Email emily@noracomply.com. We will reply within one month, and we may ask you to confirm your identity first.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission, Ireland's data protection regulator, or to the regulator where you live or work. We would appreciate the chance to resolve it first.
9. Security
We protect personal data with measures including encryption in transit and at rest, access controls, and monitoring. Your data is stored in the EU (Frankfurt), each customer's records are kept apart in the database itself, backups are encrypted, and error reports leave out personal details. No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Data Protection Commission as the law requires.
10. Children, and changes to this policy
NoraLite is a business service and is not intended for anyone under 18.
We may update this policy. We will post the new version here with its date and, for significant changes, tell account users by email.
11. Using this site
The AI tool catalogue, use-case library and risk assessments on this site are Nora Comply's own work and are protected by copyright and database rights. You may use them to assess your own organisation. You may not copy, scrape, extract or reuse them, in whole or in part, by hand or by automated means, or use them to build or train another product or service.