Privacy Policy

Cloud Ninja Consulting ApS is the data controller for the processing of your personal data on Norly.io.

We do not have a formal Data Protection Officer (DPO), as we do not meet the criteria in GDPR Article 37. However, enquiries about personal data are always answered within 30 days, in accordance with GDPR.

We only process data for specific purposes with a clear legal basis.

We do not process your data for marketing without your active consent, and we never sell or rent data to third parties.

• Account data (email, name, profile): for as long as your account is active. If you delete your account, this data is removed within 48 hours.
• Financial records (transactions, amounts, timestamps): 5 years after the end of the financial year, in accordance with the Bookkeeping Act. This data is anonymised when the account is deleted — name, email, and other PII is removed, but the raw transaction figure (anonymous) is retained.
• Stripe tokens: deleted upon account deletion by contacting Stripe directly.
• IP addresses in logs: 30 days, after which they are aggregated into daily counts without personal reference.
• Webhook events from Stripe: 90 days — we use them to debug payment issues and reconcile data.

We only share data with the data processors necessary to operate Norly. Each of them has a data processing agreement with us and is obliged to process data in accordance with GDPR.

We do not share data with advertising networks, data brokers, or other third parties for marketing purposes.

Some of our data processors (Stripe, Supabase, Vercel) are US-owned. To ensure your data is protected to the same level as under EU law, transfers are made exclusively under the EU Commission's Standard Contractual Clauses (2021/914), and — where relevant — under the EU-US Data Privacy Framework where the sub-processor is certified.

You can request a copy of these agreements by writing to hey@norly.io.

As a data subject you have the following rights under GDPR. Most of them can be exercised directly in the app under My subscriptions → My data.

• Access — you can download a JSON file with all the data we hold about you directly from the app.
• Rectification — update your name and email under account settings; for other corrections, write to us.
• Erasure — delete your account directly from the app. Active support is cancelled, your personal data is removed, and only anonymised accounting figures are retained (legal requirement).
• Restriction of processing — contact us if you want to temporarily pause the processing of your data.
• Objection — particularly against processing based on legitimate interests. Write to us and we will stop the specific processing, unless we can document compelling reasons that override your interests.
• Data portability — the JSON export is in a machine-readable format and can be imported elsewhere.
• Withdrawal of consent — to the extent our processing is based on consent (rare, as we primarily rely on contract and legitimate interests), you can withdraw it without affecting prior lawful processing.

Norly uses two kinds of cookies. Strictly necessary cookies (login and your cookie banner choice) are always set, since the platform cannot function without them. Google Analytics 4 cookies are set only if you click "Accept all" in the cookie banner — otherwise GA does not load at all. We have enabled IP anonymisation on GA, so Google does not receive your full IP. We do not set marketing cookies or other third-party trackers.

You can withdraw your GA consent at any time by clicking "Cookie settings" at the bottom of any page. See the full per-cookie inventory and management instructions at /en/cookies.

We take security seriously. In concrete terms:

• All communication to/from Norly is TLS 1.2+ encrypted
• Passwords are stored as bcrypt hashes via Supabase Auth — we never have your password in plaintext
• Card data is handled exclusively by Stripe (PCI-DSS Level 1 certified)
• Database access is restricted by Row-Level Security policies; even our own staff cannot read a fan's data without it being logged
• We review all changes before deployment and run automated tests to catch regressions

Should a data breach occur that could pose a high risk to you, we are obliged to notify you and the Danish Data Protection Authority within 72 hours in accordance with GDPR Articles 33–34.

If you believe we are processing your data in violation of GDPR, we would like to hear from you first so we have the chance to put things right: hey@norly.io.

You can also lodge a complaint directly with the Danish Data Protection Authority (Datatilsynet):

If we update the policy — for example because we add a new data processor or expand the service — we will send a notice to the email associated with your account at least 14 days before the change takes effect, so you have the opportunity to object or delete your account.

The date at the top of the page shows when the policy was last updated.