Privacy Notice

The data controller is normic inc., 2810 N Church St STE 90883, Wilmington, DE 19802, USA. normic processes its users’ personal data under Türkiye’s Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR, 2016/679).

Contact: info@normic.ai

• Identity: your email address, and the name and profile details you enter in your profile.
• Contact: email address.
• Activity: session history, query logs, team memberships, invitations.
• Technical: IP, user-agent, request_id (for audit + security).
• Content: the questions you ask and the answers, queries and result rows shown to you; ratings and comments you give; files you upload; and, where your organization turns memory on, facts kept from your conversations.
• Access requests: work email, company, role and what you would like to ask.
• Cookie choice: your decision, saved in this browser.

We collect this data directly from you (what you enter and ask) and automatically through the service (activity and technical data).

• Providing the service (performance of a contract — KVKK Art.5/2-c, GDPR Art.6/1/b).
• Security and fraud prevention (legitimate interest — KVKK Art.5/2-f, GDPR Art.6/1/f).
• Legal obligations (tax, requests — KVKK Art.5/2-ç, GDPR Art.6/1/c).
• Measuring visits to the normic.ai marketing pages, only with your consent (consent — KVKK Art.5/1, GDPR Art.6/1/a).

How long data is kept is set by each organization’s retention terms. Questions, answers and query results are kept for the periods set for your organization. Where an organization uses our standard retention terms, conversations are deleted after 30 days, query results after 1 day, generated files after 90 days and the audit log after 1 year (up to 7 years where an agreement requires it). Where your organization turns memory on, personal memory is deleted after 365 days; team and organization memory stays for the life of the organization. Security events are deleted after 400 days, and the comment and copy of what was shown that are kept with feedback you give are cleared after 400 days. Operational records of runs and usage may be kept longer while the organization uses the service, and are deleted when the organization’s data is deleted. Uploaded files are kept until their workspace is deleted. When an organization leaves, its data is deleted. When you delete your account, it is erased 30 days after your request; the audit log keeps the account identifiers, IP addresses and browser details recorded with your actions, for security, until its own term ends.

Our database and sign-in run in the EU (Frankfurt), and our application servers in Germany (EU). To answer a question, the question, the relevant schema and result rows are sent to large-language-model providers whose processing may take place outside the EU, including the US (see Sub-processors). Where personal data is transferred outside the EU or Türkiye, we rely on the safeguards available under applicable law; contact info@normic.ai for details.

Under Article 11 of KVKK you may apply to us to learn whether your personal data is processed; to request information about it if it is; to learn the purpose of the processing and whether the data is used in line with that purpose; to know the third parties in Türkiye or abroad to whom it was transferred; to request its correction if it is incomplete or inaccurate; to request its erasure or destruction under the conditions of Article 7; to request that correction or erasure be notified to the third parties it was transferred to; to object to a result against you that arises from analysis of the data exclusively by automated systems; and to claim compensation if you suffer damage because it was processed unlawfully. We decide on your application within thirty days at the latest, free of charge; where the action itself has a cost, a fee in the Board’s tariff may apply. If your application is refused, our answer is insufficient or it is not answered in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of applying. Under the GDPR you also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), and the right to lodge a complaint with a supervisory authority (Art. 77). In account settings, “Download my data” exports your data and “Delete my account” erases the account 30 days after the request. Written applications: info@normic.ai.

Analytics cookies (Google Analytics `_ga`) are used only on the normic.ai marketing pages and only after you choose “Accept all”; never in the app (app.normic.ai), and they are not sent to it. Your choice is saved in this browser. Withdrawing stops the measurement and removes the cookies.

You can change your cookie choice at any time:

• Supabase (database and sign-in; AWS eu-central-1, Frankfurt)
• netcup (application servers, Germany, EU)
• The large-language-model providers that answer and index questions, such as OpenRouter (which forwards a request to the model’s own provider), Anthropic and Google (Gemini API). Processing may take place outside the EU.
• Our email service provider (sign-in and notification emails)
• Google Analytics (on the normic.ai marketing pages only, with your consent; US)
• Integrations your organization enables, such as Slack, Microsoft Teams, WhatsApp or Google Cloud Storage export
• Observability providers, where enabled

Personal data requests: info@normic.ai