Privacy Policy
Last updated: September 26, 2026
Introduction
NORA is a scheduling and booking platform for independent service professionals and their clients. It also lets these businesses communicate with their clients through messaging channels such as WhatsApp and Instagram, including with the help of an AI assistant. This Privacy Policy describes how we collect, use, store, and protect your personal data when you use our service. By using NORA, you agree to the practices described in this policy.
Who is responsible for your data
The controller of the data of website visitors and Nora users is the owner of the service, a natural person registered in Spain as self-employed (autónomo), based in Barcelona. Contact details are at the end of this page and on the "Legal" page.
If you are a client of a professional who works with Nora, your data is processed on that professional's behalf: they are the controller and we are the processor under the Data Processing Agreement. You can contact the professional or us about your data. Data Processing Agreement (DPA)
Data We Collect
Account Data
- Name
- Email address
- Hashed password (we never store plaintext passwords)
- Timezone
Google Account Data (optional)
- Google ID
- Avatar URL
- These are collected only if you choose to sign in with Google OAuth
Booking Data
- Lesson date and time
- Booking status (scheduled, completed, cancelled)
- Lesson notes
Payment Data
- Transaction records and payment status
- Actual payment card details are handled entirely by Stripe and never stored on our servers
Calendar Data (optional)
- Google Calendar events synced via Google Calendar API
- Only accessed when you explicitly connect your Google Calendar
Conversation data (Telegram, WhatsApp, Instagram, SMS)
- Messages you exchange with a professional via Telegram, WhatsApp, Instagram Direct or SMS, including text, images, voice messages and other files
- Your phone number, Telegram, WhatsApp or Instagram identifier (IGSID) and profile name, used to route and label the conversation
- Message metadata such as timestamps and delivery or read status
- This data is collected only when you message a professional who uses Nora, and only to deliver and reply within that conversation on the professional's behalf
How We Use Your Data
- Provide and maintain the scheduling and booking service
- Authenticate users via email/password or Google OAuth
- Synchronize your schedule with Google Calendar (only when you explicitly connect)
- Send transactional emails such as booking confirmations and reminders
- Improve the service and fix errors
- Sending and replying to client messages via Telegram, WhatsApp, Instagram and SMS on the professional's behalf, including with the Nora AI assistant
Legal bases for processing
- Performance of a contract (Art. 6(1)(b) GDPR): your account, subscription and operation of the service under the Terms of Service.
- Legitimate interests (Art. 6(1)(f) GDPR): service security, error monitoring, abuse prevention and service improvement.
- Consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE): marketing cookies and sending events to Meta. You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records of payments.
Google API Services — Limited Use Disclosure
- NORA’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We only access Google Calendar data when you explicitly connect your Google Calendar in Settings.
- Calendar data is used solely to display and synchronize your lesson schedule within NORA.
- We store OAuth refresh tokens securely to maintain your calendar connection.
- We do not sell, share, or use your Google data for advertising or any purpose unrelated to the service.
- You can disconnect your Google Calendar at any time from the Settings page in your dashboard.
Meta Platform Data: Limited Use Disclosure
- NORA integrates with the WhatsApp Business Platform and the Instagram Messaging API (Meta Platforms) so that businesses can communicate with their clients.
- We access messages and related identifiers only to deliver, display, and respond to conversations between a business and its clients.
- We do not sell Platform Data, and we do not use it for advertising or for any purpose unrelated to operating the messaging service.
- Message content is processed by our AI assistant solely to generate replies on behalf of the business that owns the conversation.
- Access tokens obtained through WhatsApp and Instagram are stored encrypted and are used only to send and receive messages for the connected business account.
- A business can disconnect its WhatsApp or Instagram account at any time from the dashboard, which revokes our access to that account.
Meta advertising: Meta Pixel and Conversions API
- We advertise on Instagram and Facebook. To understand which ads bring professionals to Nora, we send events to Meta Platforms Ireland Limited through the Meta Conversions API — only if you have consented to the "Marketing" category in the cookie settings. This category is off by default.
- Events: registration (CompleteRegistration), lead (Lead — for example a completed quiz), trial start (StartTrial), subscription (Subscribe), payment (Purchase), and Nora service events: channel connected, first client conversation, first booking.
- What is sent: email, phone, first and last name, city and internal account ID — only as SHA-256 hashes; browser IP address and user agent (for website events); the ad click ID (fbclid) and the Meta cookies _fbp/_fbc if present in the browser; for payments, the amount and currency; profession.
- This is data about the professional who uses Nora. Data about the professional's clients is not sent to Meta for advertising.
- The Meta Pixel script is not currently loaded on the website. With your consent we only use identifiers from the ad link and Meta cookies already present in the browser.
- Without consent no events are sent. You can withdraw consent at any time via the "Cookie settings" link at the bottom of the page; after that no new events are sent. Meta processes the data it receives under its Business Tools Terms and its privacy policy; data may be transferred to the United States (Meta Platforms, Inc. participates in the EU-U.S. Data Privacy Framework).
Processors and third-party services
We use the following providers to run Nora. Some process data on our behalf (processors); others — messaging platforms and payment systems — act as independent operators under their own terms. Where a provider is outside the European Economic Area, transfers rely on a European Commission adequacy decision (including the EU-U.S. Data Privacy Framework for companies certified under it) or on the EU Standard Contractual Clauses (SCC).
| Service | Purpose | Location and safeguards | Privacy Policy |
|---|---|---|---|
| Railway | Application hosting, database and job queues | Railway Corporation (USA) — EU Standard Contractual Clauses (SCC) | View Policy |
| Cloudflare | File storage (photos, message attachments) and website network infrastructure | Cloudflare, Inc. (USA), global network — EU-U.S. DPF and SCC | View Policy |
| Google Cloud — Vertex AI (Gemini) | Gemini AI models (Vertex AI): Nora's replies, message understanding, voice message transcription, image recognition | Google Cloud; global endpoint — processing may take place outside the EEA (incl. USA) — EU-U.S. DPF and SCC | View Policy |
| Sign in with Google, Google Calendar sync, Google review link (Places API), maps on public pages | Google Ireland Limited / Google LLC (USA) — EU-U.S. DPF and SCC | View Policy | |
| Stripe | Nora subscription payments and professionals' payment links | Stripe Payments Europe, Ltd. (Ireland); Stripe, Inc. (USA) — EU-U.S. DPF and SCC | View Policy |
| Twilio | SMS, WhatsApp (for some connections), phone AI assistant and call recording — if the professional has enabled them | Twilio Inc. (USA) — EU-U.S. DPF and SCC | View Policy |
| SendGrid (Twilio) | Sending email and receiving inbound email | Twilio Inc. (SendGrid, USA) — EU-U.S. DPF and SCC | View Policy |
| Telegram | Main channel: the Nora bot, professionals' bots, Telegram Business; at the professional's request, a one-time import of chat history | Independent platform operator; processes messages under its own privacy policy | View Policy |
| WhatsApp Business Platform (Meta) | Conversations with clients on WhatsApp; connecting a number through Meta (Facebook JS SDK in the dashboard) | Meta Platforms Ireland Limited / WhatsApp Ireland Limited; possible transfer to the USA — EU-U.S. DPF | View Policy |
| Instagram (Meta) | Conversations with clients in Instagram Direct and replies to comments | Meta Platforms Ireland Limited; possible transfer to the USA — EU-U.S. DPF | View Policy |
| Meta Conversions API | Ad measurement (Conversions API) — only with consent to marketing cookies | Meta Platforms Ireland Limited; possible transfer to the USA — EU-U.S. DPF | View Policy |
| Sentry | Error and performance monitoring, including session replay for a share of sessions and on errors | Functional Software, Inc. (Sentry, USA) — SCC | View Policy |
| Altegio | Altegio booking-journal integration, if the professional connected it: client import and booking sync | Data is sent to the professional's Altegio account and processed under Altegio's terms | View Policy |
| PayPal | Clients paying a professional through the professional's PayPal account, if connected | PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — independent payment operator | View Policy |
| FastSpring | Certain one-time purchases | FastSpring (USA) — independent payment operator | View Policy |
| OpenStreetMap Nominatim | Turning a map pin the professional sent during setup into an address | OpenStreetMap Foundation (United Kingdom) — EU adequacy decision | View Policy |
| Web Push | Delivering push notifications to the browser and app | Browser push services (Google, Mozilla, Apple), depending on the device | — |
| goQR.me (api.qrserver.com) | Generating a QR code with the professional's link | goQR.me — receives only the public link and the browser IP address | View Policy |
We notify professionals who use Nora of changes to this list in advance, as set out in the Data Processing Agreement.
Data Storage & Security
- The application and database are hosted on Railway servers
- Data stored in a PostgreSQL database
- Passwords hashed with bcrypt
- All traffic encrypted via HTTPS
- JWT tokens used for session authentication
- HttpOnly secure cookies for sensitive tokens
Your Rights (GDPR)
If you are located in the EU/EEA, you have the following rights under the General Data Protection Regulation:
- Access your personal data
- Correct inaccurate personal data
- Delete your account and all associated data
- Export your data in a portable format
- Withdraw consent at any time (e.g., disconnect Google Calendar)
- Lodge a complaint with a data protection supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es)
Your Rights (CCPA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act:
- Know what personal information is collected about you
- Request deletion of your personal data
- Non-discrimination for exercising your privacy rights
- We do not sell your personal information to third parties
Data Retention
- Account data is retained until you delete your account
- Booking records are retained for financial and legal record-keeping purposes
- Server logs are retained for 30 days
- WhatsApp and Instagram message records are kept in an append-only audit log for security and legal record-keeping, and can be deleted on request
Children’s Privacy
NORA is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us so we can delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.
Contact
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:
Email: privacy@hey-nora.online
Website: https://hey-nora.online