Privacy Policy for Normi

1. About this Privacy Policy
   
   

   This privacy policy applies to the Normi platform ("Service"), provided by Normi Labs AS, org.no. 931 848 291 ("we", "us", or "Provider").
   

   We process personal data as a service provider, for marketing purposes, and in connection with visits to our website www.normi.no.
   

2. What Information We Process
   
   
   Information you provide

   
   

   When registering and using Normi, we collect:
   

   1. Name
   2. Email
   3. Address
   4. Phone number
   5. Profile picture, if you upload one
   6. Skills added to profile
   7. Roles and goals added to profile
   8. Experience added to profile
   9. Education added to profile
   10. Documents you upload, such as CVs and certificates
   11. Content you write in the service, including messages to the AI assistant
   Documents and health data

   
   

   Documents uploaded to your Normi profile, such as CVs and certificates, may contain health information. Before any AI processing of a document on your profile, it is checked for health-related content. If it may contain health data, your explicit consent as the person the document concerns is required before it is stored or processed (GDPR Art. 9). An organization cannot give that consent on your behalf. Where an organization uploads documents about you as data controller, for example a CV when registering a candidate, the organization is responsible for the lawful basis of that processing (see 'Candidate Data Processed for Organizations').
   

   Information we collect automatically

   
   

   We also collect the following information about your use of Normi:
   

   1. Searches in the service: When a user performs a search, we log date/time, search terms, search type, and a unique alphanumeric ID for the user. This ID alone cannot identify the user.
   2. Login activity
   3. Number of skills and roles added
   4. Number of pages visited

   This data is used to produce relevant user statistics and industry insights about skill trends. Personal data will not be linked to individual users in the statistics.
   

3. Purpose of Processing
   
   

   Personal information is collected and processed to:
   

   1. Deliver and manage the Normi service
   2. Fulfill the agreement with you as a user
   3. Extract skills and experience from documents and text you provide, with AI assistance
   4. Improve the service and provide better recommendations
   5. Produce anonymized statistics and industry insights about skill trends
   6. Send newsletters and marketing (only with your consent)
4. Legal Basis
   
   

   The legal basis for processing is:
   

   1. Performance of contract (GDPR Art. 6(1)(b)) - to deliver core service such as skills mapping and matching
   2. Consent (GDPR Art. 6(1)(a)) - for marketing, newsletters, and optional analytics
   3. Explicit consent (GDPR Art. 9(2)(a)) - for storing and processing documents that may contain health data
   4. Legitimate interest (GDPR Art. 6(1)(f)) - for service improvement, aggregated statistics, and industry insights

   You can withdraw your consent for marketing, optional analytics, and health data processing at any time.
   

5. Sharing of Personal Information
   
   

   We do not share your personal information with others unless there is a legal basis. We use the following data processors under data processing agreements:
   

   Technical service providers

   
   

   1. Vercel: Hosting and server operations in EU/EEA
   2. Neon: Database hosting in the EU (Frankfurt, Germany)
   3. Exoscale: Storage of uploaded documents, such as CVs, certificates, and organization documents, in an EU data center. Project documents are currently being moved from UploadThing to Exoscale.
   4. UploadThing: Upload and storage of profile pictures, logos, and other images
   5. OpenAI: AI services for search and skills matching. No user data is used to train their models.
   6. Vercel AI Gateway: Routes certain AI tasks to AI model providers such as OpenAI and Anthropic, under terms that prohibit the use of our data for training
   7. PostHog: Product analytics, hosted in the EU. Used only with your consent.
   8. Resend: Sending emails from Normi, such as verification and notification emails
   9. Pusher: Real-time status updates in the application
   Payment providers

   
   

   1. Stripe: Handles payments and subscriptions. Normi does not store full card details; payment information is handled by Stripe. Read their privacy policy for more information.
   2. Vipps: Handles payments where offered. We are not responsible for personal information you share directly with Vipps. Read their privacy policy for more information.
6. Candidate Data Processed for Organizations
   
   

   Organizations using Normi can register information about candidates - for example by uploading a CV - before the candidate has a Normi account. For such data, the organization is the data controller and Normi processes the data on the organization's behalf under a data processing agreement (GDPR Art. 28).
   

   If an organization has registered a profile for you, you can take it over at any time by creating a Normi account with the same email address: we then send you a link to verify your email and take over the profile. The organization can also choose to have us notify you by email when the profile is created. Once the profile is yours, you can review and correct it. You can also contact us or the organization at any time to exercise your rights, including to request that information about you be corrected or deleted.
   

7. Cookies
   
   

   We use different types of cookies in Normi:
   

   Necessary cookies

   
   

   These are essential for the service to function and cannot be disabled:
   

   1. Authentication: First-party session cookies that keep you logged in
   2. Security: To protect against fraud attempts
   3. User preferences: To remember your choices (e.g., language)
   Optional cookies

   
   

   You can choose whether to allow these:
   

   1. Analytics (PostHog): To understand how the service is used and improve it. Off by default and only enabled if you accept.

   You can change cookie settings in your browser.
   

8. Storage and Security
   
   
   Storage location

   
   

   1. The database is hosted with Neon in the EU (Frankfurt, Germany)
   2. Uploaded documents are stored with Exoscale in an EU data center; profile pictures, logos, and other images are stored with UploadThing. Project documents are currently being moved from UploadThing to Exoscale.
   3. The application is hosted by Vercel with server operations in EU/EEA
   4. We take regular backups of all data
   Storage period

   
   

   1. Basic contact information is retained until the user relationship ends
   2. Personal data you provide as a Normi user is deleted when you withdraw your consent or request deletion
   3. Information an organization has registered about you is retained on the organization's instructions as data controller; requests about it can be directed to the organization or to us
   4. Anonymized statistics are stored indefinitely
   Security

   
   

   Normi Labs AS ensures that information is stored securely in accordance with applicable privacy legislation, with necessary technical and organizational security.
   

9. Your Rights
   
   

   You have the following rights under privacy legislation:
   

   1. Access: Right to know what information we have about you
   2. Rectification: Right to correct inaccurate information
   3. Erasure: Right to have your personal data deleted
   4. Restriction: Right to limit processing
   5. Data portability: Right to receive your data in a structured format
   6. Object: Right to object to processing. You can request at any time that we stop using your data for statistics and service improvement.

   To exercise your rights, contact us at contact@normi.no. You can also export your data by contacting the same email address.
   

10. Changes to the Privacy Policy
    
    

    We may update this privacy policy when there are changes to the service or regulations. We will notify you of significant changes at least 14 days before they take effect via email and/or notification in the Normi platform.
    

11. Right to Complain
    
    

    If you believe that our processing of personal data does not match what we have described here or that we are otherwise violating privacy legislation, you may file a complaint with your local data protection authority.
    

12. Contact Information
    
    

    For questions about our processing of personal data, contact us at:
    

    Normi Labs AS, Org.no: 931 848 291, Email: contact@normi.no, Phone: +47 413 08 097, Address: Høgskoleringen 4, 7034 Trondheim
    

By using the Normi service, you confirm that you have read and understood this privacy policy.