Privacy Policy

1. Introduction

Welcome to Norahelp. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI chatbot platform and services.

By using Norahelp, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

Name (first and last name)
Email address
Company information (optional)
Billing information (for paid plans)

2.2 Usage Data

We automatically collect information about how you use our service:

Widget creation and configuration
Chat conversations and messages
API usage statistics
Analytics and performance metrics

2.3 Technical Data

IP address
Browser type and version
Device information
Cookies and tracking technologies

2.4 Approximate Location Data (Widget Analytics)

To help widget owners see roughly where their chat visitors are writing from, we resolve the visitor's IP address to a country using a GeoIP database hosted on our own servers — no third-party lookup service is contacted and no data is sent outside our infrastructure for this purpose.

Only the resulting two-letter country code (e.g. "DE") is stored against the conversation.
The visitor's IP address itself is never written to our database — it is used momentarily for the lookup and then discarded.
No city-level, street-level, or GPS location is ever collected — only country.
This data is shown to the widget owner as an aggregated map/list in their dashboard, to understand where their audience is located.

If you operate a widget on your own website, you should mention this approximate, country-level analytics in your own privacy notice to your visitors.

2.5 Phone Call Data (AI Phone Agent)

If your plan includes the AI Phone Agent, we process the following data for calls made or received through your provisioned number:

The caller's phone number
A text transcript and AI-generated summary of the call
Call metadata (duration, status, timestamps) and any appointment booked during the call

We do not store an audio recording of the call. Call audio is processed in real time by our telephony and AI providers (see Section 6) to generate the transcript, and is not retained by us as a separate audio file.

3. Data Processing Roles — Controller vs. Processor

This distinction is important and affects who you should contact about certain data.

For your own account data (registration, billing, login), Norahelp is the data controller.
For data about the people who chat with your AI Chat Widget or call your AI Phone Agent (your website visitors and callers), you — our business customer — are the data controller, and Norahelp acts only as your data processor, processing that data on your instructions to provide the service.

What this means for you as a customer

You are responsible for your own legal basis, privacy notice, and any consent required towards your website visitors and callers — including informing callers that they may be speaking with an AI system and, where legally required, that the call is being transcribed. A data processing agreement (Art. 28 GDPR) is available on request.

4. How We Use Your Information

We use the collected information for various purposes:

To provide and maintain our service
To process your transactions and manage subscriptions
To send you service-related notifications
To provide customer support
To improve and optimize our platform
To detect and prevent fraud or abuse
To comply with legal obligations

Your Data Protection

We never sell your personal information to third parties. Your data is used solely to provide and improve our services.

5. Data Storage & Security

We implement industry-standard security measures to protect your data:

SSL/TLS encryption for data transmission
Encrypted storage of sensitive information
Regular security audits and updates
Access controls and authentication
Data backup and disaster recovery

Data Retention

We retain your data for as long as your account is active or as needed to provide services. You can request deletion of your data at any time.

6. Third-Party Services

We use the following third-party services:

OpenAI API - For AI chatbot and AI phone agent functionality
Twilio - For provisioning phone numbers and processing calls made through the AI Phone Agent
Stripe - For payment processing
PayPal - For payment processing
Email service providers - For transactional emails

These services have their own privacy policies. We recommend reviewing them. Some of these providers are based outside the EU/EEA (e.g. in the United States); where that is the case, data transfers are safeguarded using EU Standard Contractual Clauses (Art. 46 GDPR) or an equivalent legal transfer mechanism.

7. Cookies & Tracking

We use cookies and similar tracking technologies to:

Keep you logged in
Remember your preferences
Analyze website traffic and usage
Improve user experience

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our service.

8. Your Rights (GDPR Compliance)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right to Access - Request a copy of your personal data
Right to Rectification - Correct inaccurate data
Right to Erasure - Request deletion of your data
Right to Restrict Processing - Limit how we use your data
Right to Data Portability - Receive your data in a machine-readable format
Right to Object - Object to certain types of processing
Right to Withdraw Consent - Withdraw consent at any time

How to Exercise Your Rights

To exercise any of these rights over your own account data, please contact us at privacy@noras.ai or use the contact form below. If you are a website visitor or caller and want to exercise these rights over data collected through a chat widget or phone agent, please contact the business that operates that widget or phone number directly — as described in Section 3, that business is the data controller for that data.

9. Children's Privacy

Our service is intended exclusively for business customers and is not directed at or intended for use by children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

Posting the new Privacy Policy on this page
Updating the "Last Updated" date
Sending you an email notification (for significant changes)

We encourage you to review this Privacy Policy periodically for any changes.