Privacy Policy

Normora is the trade name of Generalytics B.V., Biesboschstraat 63-3, 1078 Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 90450213 ("Normora", "we", "us"). We provide a platform and services for financial analysis and bookkeeping support, including a financial dashboard and AI co-pilot. This policy explains what data we collect, why we collect it, where we store it, and the choices and rights you have. It applies to our website, application and related services (together, the "Service"). In this policy:

• ERP means the software your company uses to manage and process its financial and administrative processes and data, such as Exact Online.
• Customer data means the financial and administrative data of your company that we store and process to provide the Service, including data from your ERP and the invoices and documents you supply. It can include personal data, such as names or contact details that appear in invoices or administrative records; everything this policy says about customer data applies to that personal data too.

1. Overview

We process customer data on behalf of your company, exclusively to provide the Service to it: we retrieve and analyze data from your ERP, process the invoices and documents you supply (where applicable), support your bookings, and provide reports and co-pilot functionality. The Service writes to your ERP only what you confirm: in Exact Online, the bookings, ledgers, relations and fixed assets you confirm in the Service. We store and process customer data only on our own servers in the Netherlands, where our AI models run too, and we never sell it. We only collect the data reasonably necessary to operate and secure the Service.

2. Data we collect

Account & profile data

• Name, email address and hashed password when you register.
• Company details you provide, and your role within a company (owner, admin, accountant, viewer).
• Billing information, handled by our payment processor — we do not store full card numbers.

Customer data

• Chart of accounts, ledger balances, transactions, invoices and bills imported from your ERP or other connected systems you authorize. We store this data in our database so we can compute and display it back to you.
• Invoices and documents you supply, for example by upload or by e-mail, and the data we read from them.
• Personal data that is part of this data, such as names or contact details that appear in invoices or administrative records.
• Metrics we compute from that data — cash position, EBITDA, working capital, AR/AP aging and similar figures.

Usage & device data

• Log data such as IP address, browser type, pages visited and timestamps.
• Questions and messages you send to the AI co-pilot, so we can generate and, where needed, troubleshoot responses.

3. How we use your data

We process customer data on behalf of your company and exclusively to provide the Service to it. This includes:

• Retrieving, reconciling and analyzing data from your ERP, and mapping your chart of accounts to standard financial categories.
• Processing the invoices and documents you supply, where applicable.
• Supporting your bookings, which the Service writes to your ERP only once you confirm them.
• Providing dashboards, reports and the AI co-pilot, and detecting anomalies such as duplicate bills or unusual postings.

We do not use customer data for our own purposes. We use account and usage data:

• To authenticate you, secure your account, and enforce role-based access within your company.
• To communicate with you about your account, changes to the Service, or in response to support requests.
• To monitor, debug and improve the reliability and performance of the Service.

4. Storage & AI

We store customer data and its backups exclusively on servers under our own management in the Netherlands, and process it only on those servers. We do not use cloud services for this.

The AI models behind the Service, such as those of the co-pilot and of the processing of invoices and documents, run only locally on servers under our own management. Customer data is not shared with external or cloud-based AI services, and it is not used to train models for other purposes.

5. Sharing

We do not sell your data. We do not provide customer data to third parties unless the law requires us to; in that case, we inform your company in advance, to the extent the law allows. We share data only with:

• Other members of your company workspace, according to the role and permissions assigned to them.
• Our payment processor, which receives the billing details it needs to handle billing, never customer data.
• Authorities, where required by law, regulation or valid legal process.

6. Confidentiality & security

• We treat customer data as confidential and give access to it only to the people who need it to provide the Service as described in Section 3.
• We take appropriate technical and organizational security measures, including encryption of data in transit, access restrictions, separation of each customer's data, logging, secured backups and timely security updates.
• The Service writes to your ERP only what you confirm.
• No method of transmission or storage is 100% secure; we cannot guarantee absolute security of your data.

7. Data breaches

If a data breach affects your company's data, we report it to your company without undue delay and at the latest within 24 hours of discovering it. We provide the relevant information available to us, limit the consequences and cooperate in investigating and handling the breach. Your company is responsible for any notifications to supervisory authorities and to the people concerned.

8. Data retention & deletion

We retain account data and customer data for as long as your company maintains an active connection, plus a limited period afterward to allow reconnection and to meet accounting and legal record-keeping obligations. You can request removal of this data at any time by contacting us (see Section 11):

• We delete the data concerned from our production systems within two working days of your request.
• Data in backups is deleted automatically after 90 days. Until then it stays secured and is not actively used. If a backup is restored, data deleted earlier is deleted again.
• On request, we confirm the deletion in writing. Statutory retention obligations continue to apply.

Everything this policy commits to on customer data applies for as long as we process it on your company's behalf, also after your company stops using the Service.

9. Your rights

Depending on your location, you may have the right to access, correct or erase your data, request a portable copy of it, object to or restrict certain processing, and withdraw consent at any time. You may also lodge a complaint with your local data protection authority.

Where your personal data is part of a company's customer data, for example as a contact person on an invoice, we process it on behalf of that company. We forward your request to that company within two working days, and support it where reasonably necessary in meeting its obligations under the GDPR.

To exercise any of these rights, contact us using the details in Section 11.

10. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before the change takes effect. The "Last updated" date above reflects the most recent revision.

11. Contact

Questions about this policy or how we handle your data can be sent via our contact page.