Privacy Policy
Last updated: 29 August 2026
Nora is an assistant that works on your data: your conversations, your documents, your mailboxes and your accounts if you connect them. This document states which data, why, where it goes, and what you can demand.
It is written to be read. If a passage seems unclear to you, write to us: that means we wrote it poorly.
Who is responsible
The data controller is Neoservice — [TO COMPLETE: exact legal name, address, UID number].
Contact for any question relating to your data: privacy@noraai.ch.
Where your data is located
In Switzerland, in Geneva, at Infomaniak. The application, the database, the workspaces, the files you upload and the voice infrastructure are hosted on servers located in Switzerland and operated by a Swiss company.
This is not a configuration detail: it is a choice, and it is verifiable. Only one category of processing falls outside this perimeter, described below — the language model.
What we process, and why
Your account
Email address, name, password (as a hash, never in clear text), membership in one or more workspaces. Without this, there is no account.
Legal basis: performance of the contract.
Your conversations with Nora
What you write, what Nora replies, the attached files, the images produced. Kept so that you can re-read them and so that Nora remembers one exchange to the next — this is the very function of the product.
This content is partitioned by workspace. One workspace cannot access another's data; we verify this with automated tests at every production release.
Legal basis: performance of the contract.
The accounts you connect
If you connect a Facebook page, an Instagram account, a LinkedIn page, a calendar or a mailbox, we keep the access token issued by these services, as well as the account name. We do not keep your password: these services never share it with us.
These connections are optional and can be removed at any time from the application. Removal deletes the token.
Legal basis: your consent, given at the time of connection.
Technical logs
IP address, date, page visited, type of error. Kept to diagnose outages and detect abuse.
Legal basis: legitimate interest in operating the service.
Billing
If you subscribe to a paid plan, the data necessary for billing. Card payment data never passes through our servers: it is processed by our payment provider.
Legal basis: performance of the contract and the legal accounting retention obligation.
The language model: what you need to know
Nora relies on a language model operated by OpenAI, a company established in the United States. To respond, it sends the model what is necessary for the current request: your message, the conversation context, and the content of the documents or tools it must consult to answer you.
We say this plainly, because it is the point that matters: part of your content leaves Switzerland at that moment.
What we do to frame this:
- access is via a professional subscription, whose terms exclude the use of your content to train models;
- we only send what is necessary for the request being processed, never all of your data;
- transfers rely on the contractual safeguards provided by Swiss and European law for transfers outside Switzerland and the EEA.
If this transfer is not acceptable for your data, tell us before subscribing: configurations without transfer exist, and it is better to discuss it beforehand rather than afterward.
Who else your data is shared with
We do not sell any data and do not share any of it for advertising purposes. The only third parties that process it are those that make the service work:
| Recipient | What it processes | Where | |---|---|---| | Infomaniak | Hosting, database, sending emails | Switzerland | | OpenAI | The content sent to the model to generate a response | United States | | Meta (Facebook, Instagram) | Only if you connect an account: the post and its visual | United States | | LinkedIn | Only if you connect an account: the post | United States | | Google, Apple | Only if you connect a calendar: the relevant events | United States | | Payment provider | Billing data, if you are a paying customer | [TO COMPLETE depending on the provider chosen] |
The last four rows only concern services that you choose to connect. Without a connection on your part, nothing is shared with them.
For how long
- Account and workspaces: for as long as the account exists.
- Conversations and files: for as long as the account exists, or until you delete them.
- Tokens of connected accounts: until the connection is removed, or until they expire.
- Technical logs: twelve months.
- Billing data: ten years, as required by Swiss accounting law.
When an account is closed, the workspace's data is deleted within thirty days, except for what the law requires us to retain.
Your rights
You can at any time:
- know what data we hold about you, and obtain a copy of it;
- have corrected what is inaccurate;
- have deleted your data, within the limits of our legal obligations;
- withdraw your consent to the connections you have authorized;
- object to processing based on our legitimate interest;
- obtain your data in a machine-readable format.
Write to privacy@noraai.ch. We respond within thirty days. The request is free of charge.
If our response does not satisfy you, you can refer the matter to the Federal Data Protection and Information Commissioner (FDPIC), in Bern. If you reside in the European Union, you can also refer the matter to the supervisory authority of your country.
Cookies and audience measurement
We use the minimum:
- Necessary cookies: your session, your language, your cookie choice. They do not require consent, because without them the site does not work.
- Audience measurement: set only if you accept it. Refusing removes no functionality.
Your choice can be changed at any time from the "Cookies" link in the footer. We use neither advertising cookies nor social network trackers on our pages.
Security
Exchanges are encrypted in transit. Passwords are stored as hashes. Workspaces are isolated from one another at the file system level, and this isolation is verified by automated tests at every production release.
No system is invulnerable. In the event of a data breach presenting a high risk to your rights, we will inform you, as well as the FDPIC, in accordance with the law.
Changes
We will publish any change on this page, with its date. If the change is significant, we will notify you by email before it takes effect.
This document faithfully describes the processing actually carried out by the service as of 29 August 2026. It has not yet been reviewed by legal counsel; this review is planned before the commercial launch.