Privacy Policy

Controller

The controller responsible for data processing within the meaning of the revFADP and the GDPR is:

What data we process

When you use Norano, we process the following categories of personal data:

• Account data: name, email address, and authentication details created when you register through our authentication provider.
• Uploaded plans and assets: the floor plans, drawings, images, and reference files you upload, stored in our object storage.
• Generated outputs: the plans, visualizations, and 3D tours generated from your inputs.
• Usage data: technical log data such as IP address, device and browser details, timestamps, and error and performance data used to keep the service running.

Purposes of processing

We process this data for the following purposes:

• Providing and operating the Norano platform and managing your account.
• Processing your uploaded plans to generate plans, visualizations, and tours.
• Analyzing and improving the features, quality, and reliability of our services.
• Ensuring security, stability, and abuse prevention, and diagnosing errors.
• Complying with legal obligations and establishing or defending legal claims.

Legal bases

Where the GDPR applies, we rely on the performance of a contract (Art. 6(1)(b) GDPR), our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR), your consent (Art. 6(1)(a) GDPR) where obtained, and compliance with legal obligations (Art. 6(1)(c) GDPR). Under the revFADP, processing is carried out in good faith and proportionately.

Processors and services we use

To provide Norano we use carefully selected service providers that process personal data on our behalf. We have the required data-processing agreements in place with them.

• Clerk · Clerk, Inc.Authentication and account management (account and sign-in data).
• Neon · Neon, Inc.Managed database for application and account data.
• Cloudflare R2 · Cloudflare, Inc.Object storage for uploaded plans, assets, and generated outputs.
• Upstash · Upstash, Inc.Queues and caching that coordinate processing jobs.
• Vercel · Vercel, Inc.Hosting and delivery of the web application.
• Railway · Railway Corp.Hosting of the background services that process your plans.
• Google Gemini · Google LLCAI model used to generate and edit visualizations.
• World Labs Marble · World Labs Technologies, Inc.AI service used to generate 3D tours from your plans.
• Sentry · Functional Software, Inc.Error and performance monitoring used to keep the service running.

International transfers

Some of the providers listed above are based outside Switzerland and the EEA, in particular in the United States. Where data is transferred there, we rely on appropriate safeguards such as standard contractual clauses or recognized adequacy decisions.

Retention

We retain personal data only for as long as necessary for the purposes described or as required by statutory retention obligations. Account data and project content are stored for the lifetime of your account; after you delete it, the data is deleted or anonymized within a reasonable period. Technical log data is kept only for a short period.

Your rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access to whether and which data we process about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, unless a statutory retention obligation applies.
• Restriction of processing in the cases provided for by law.
• Receipt of your data in a common, machine-readable format (data portability).
• Objection to certain processing, and withdrawal of any consent given with effect for the future.
• Complaint to the competent supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU your local data protection authority.

Privacy requests

To exercise your rights or for any privacy-related questions, you can reach us at:

Email: hello@norano.ai

Note on this draft

This privacy policy is a baseline draft and will be reviewed and finalized by legal counsel before the public launch.