Privacy Policy
Last updated: 29 September 2026
This policy explains which personal data NormHarbor processes when you visit the website, create an account, run scans or subscribe to our newsletter, why we do it, and what rights you have under the GDPR. NormHarbor is a service for businesses.
Controller
The service is operated under the brand NormHarbor; the operating company's registration details are being finalised and will be published in our legal notice. For any privacy request, write to hello@normharbor.com.
What we process, why, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data: email address, password (stored only as a salted hash), optional API key (stored hashed), alert webhook URL and branding you set | Creating and running your account, sign-in, service emails (password reset, alerts) | Art. 6(1)(b) GDPR (contract) | While your account exists. You can delete your account at any time on your account page (with an active paid plan, once the subscription has ended); this removes account, sites and scans from the live system immediately. Backup copies are overwritten within 14 days. Statutory retention obligations remain unaffected |
| URLs of sites you add or scan and the scan results | Running scans, history, monitoring and regression alerts | Art. 6(1)(b) GDPR (contract) | While your account exists; only the latest 30 scans per site are kept |
| Technical data: IP address and request metadata | Security, abuse prevention, rate limiting and error diagnosis | Art. 6(1)(f) GDPR (legitimate interest in a secure service) | IP addresses are held in memory for rate limiting for about one minute and are not stored in our database. Application logs (which may contain technical request data in error cases) are rotated automatically and overwritten on a rolling basis |
| Internal event log: event type and time; internal user ID for account actions and sign-ups (never your email address); for scans the scanned URL; for plan changes the plan | Security and abuse detection, fraud prevention, and understanding which features are used | Art. 6(1)(f) GDPR (legitimate interest in a secure, improving service) | Deleted automatically after 90 days; entries linked to your account are deleted when you delete your account |
| Data you enter into our free tools (e.g. organisation name and contact email in the accessibility statement generator) and URLs scanned without an account | Generating the requested result | Art. 6(1)(b) GDPR (pre-contractual request) or (f) | Not stored, except the scanned URL in the internal event log |
| Billing data: email, plan, subscription status and identifiers received from our payment provider (we never see card data) | Granting and ending paid plans, handling refunds | Art. 6(1)(b) and (c) GDPR | Subscription status while your account exists; the payment provider keeps transaction records for the statutory period |
| Newsletter: email address, language, consent text, time of request and confirmation | Sending occasional accessibility and compliance updates | Art. 6(1)(a) GDPR (consent, double opt-in) | Until you unsubscribe; unconfirmed requests are deleted after 14 days. After unsubscribing we keep only the address and timestamps as proof of your opt-out (Art. 6(1)(f)) |
| Messages you send us | Answering your request | Art. 6(1)(b) or (f) GDPR | As long as needed to handle the request, then according to statutory retention rules |
| Anonymous visit counter (daily totals only) and anonymous product-film interaction events (play, completion, button click); no IP address, no cookie | Understanding overall usage | No personal data processed | Daily totals and event counts only |
Cookies
We only use cookies that are strictly necessary to provide the service you request (Art. 5(3) ePrivacy Directive and its national implementations, e.g. § 25(2) no. 2 TDDDG in Germany and Art. 122 of the Italian Privacy Code). We do not use advertising or analytics cookies or similar tracking technologies, so no consent banner is required.
| Cookie | Purpose | Duration |
|---|---|---|
| nh_lang | Remembers your language choice | 1 year |
| ag_session | Keeps you signed in (HttpOnly, Secure) | 30 days |
| ag_oauth_state | Protects the Google sign-in flow; only set when you choose Google sign-in | 10 minutes |
Recipients and sub-processors
We share personal data only with the service providers below, who process it on our behalf or, where stated, as independent controllers. Where a provider is located outside the EU/EEA, the transfer relies on the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework, unless the table states otherwise.
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, database and server logs | Germany (EU) |
| Creem | Merchant of Record: payment processing, invoicing, VAT and refunds. It acts as an independent controller for payment data | See the provider's own privacy policy; may involve transfers outside the EEA under its safeguards |
| Resend | Sending transactional and newsletter emails | United States; Standard Contractual Clauses / EU-US Data Privacy Framework |
| Telegram | Internal operational alerts to our team (e.g. new sign-up, sale, cancellation); no email addresses are included | Outside the EEA, no adequacy decision; for this reason only the plan, the event type and a short internal ID (first 8 characters of an internal user ID) are sent, never an email address |
| Optional sign-in with Google; used only if you choose it, we receive your email address | Google acts as an independent controller for its sign-in service; transfers under its own safeguards |
Security
We use encrypted connections (TLS), store passwords only as salted hashes, and restrict access to personal data to what is necessary.
Is providing your data required?
Providing an email address and a password (or using Google sign-in) is necessary to conclude and perform the contract for an account; without it we cannot create an account. Scanning without an account, the free tools and the newsletter are optional. You are not legally obliged to provide personal data to us.
Your rights
You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15-20 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future; this does not affect the lawfulness of processing before the withdrawal.
Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You can object to the newsletter at any time without giving reasons.
To exercise your rights, write to hello@normharbor.com. We will answer within one month.
Right to lodge a complaint
You can lodge a complaint with the data protection supervisory authority of your habitual residence or place of work, or of the place of the alleged infringement.
Automated decisions
We do not carry out automated decision-making or profiling that produces legal effects concerning you.
Changes
We update this policy when our processing changes. The date above shows the current version.