Privacy Policy

1. Overview

NorPal ("we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal information when you use NorPal, our websites, mobile applications, customer support channels, and any related services that link to this Privacy Policy (collectively, the "Services").

By using the Services, you acknowledge that we may process your information as described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

This Privacy Policy is intended to be read together with any in-app disclosures, permission prompts, notices at collection, cookie banners, and region-specific notices that we may provide at the time we request or collect information from you.

2. Information We Collect

The information we collect depends on how you use the Services, the features you enable, the permissions you grant, and the settings on your device or account.

We may collect information that you provide directly to us, such as your name, username, email address, phone number, profile information, account credentials, customer-support messages, survey responses, feedback, and any other content or information you choose to submit.

We may collect information generated through your use of the Services, such as app activity, feature usage, session events, preferences, interactions with content, search history within the Services, device identifiers, IP address, browser type, operating system, app version, language, time zone, referral information, approximate location inferred from IP address, and diagnostic, crash, or performance data.

We may also collect information from third parties that you choose to connect to the Services, such as sign-in providers, payment providers, app stores, device platforms, or other integrations that you authorize.

If you submit content to the Services, that content may include personal information depending on what you choose to upload, enter, or share. Please do not provide sensitive information unless it is necessary for the feature you are using and you are comfortable doing so.

3. Sources of Information

We collect personal information from several sources: directly from you; automatically from your device, browser, or app usage; from vendors and service providers that help us operate the Services; from authentication, payment, or platform partners that you choose to use; and, where relevant, from other users or publicly available sources when that information is lawfully made available to us.

4. How We Use Information

We use personal information to provide, maintain, operate, troubleshoot, personalize, and improve the Services; create and manage accounts; authenticate users; process transactions and requests; communicate with you about the Services; send service-related messages and, where permitted, marketing communications; analyze usage trends; measure performance; protect the security and integrity of the Services; detect, investigate, and prevent fraud, abuse, or other harmful activity; enforce our terms and policies; comply with legal obligations; and establish, exercise, or defend legal claims.

Where required by applicable law, we rely on an appropriate legal basis to process personal information. Depending on the context, those bases may include performance of a contract, compliance with a legal obligation, our legitimate interests, or your consent.

5. How We Disclose Information

We may disclose personal information to service providers, contractors, and processors that perform services on our behalf, such as cloud hosting, infrastructure, analytics, customer support, communications delivery, fraud prevention, security monitoring, error logging, content delivery, and other operational functions.

We may disclose information to platform providers, app stores, payment processors, identity or authentication providers, and other third parties when needed to provide functionality that you request.

We may disclose information to professional advisers, auditors, insurers, regulators, law enforcement, courts, or other parties where we believe disclosure is necessary to comply with law, protect rights or safety, investigate misconduct, or respond to lawful requests.

We may also disclose information in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to applicable confidentiality and legal requirements.

If you choose to post or share information in public or community-facing areas of the Services, that information may be visible to others depending on the product design.

We do not sell your personal information or share it for cross-context behavioral advertising unless this Privacy Policy or a just-in-time notice specifically says otherwise.

6. International Transfers

We may process and store personal information in countries other than the country where you live. Those countries may have data protection laws that are different from the laws in your jurisdiction.

When required by applicable law, we use appropriate safeguards for cross-border transfers, such as contractual protections, adequacy-based transfer mechanisms, or other lawful transfer tools.

7. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain your account, comply with legal, tax, accounting, and regulatory obligations, resolve disputes, enforce agreements, protect the security and integrity of the Services, and establish or defend legal claims.

Retention periods may vary by category of data and by the context in which the data was collected. For example, we may retain account information while your account remains active, support communications as needed to manage your request history, technical logs for security and troubleshooting, and transaction records for the period required by applicable financial, tax, and audit rules. We may also retain backup copies for a limited period as part of our business continuity and disaster recovery processes.

8. Security

We use administrative, technical, organizational, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no security measure is perfect, and we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and for using the Services in a secure manner, including by protecting your device and using strong passwords or other supported authentication measures.

9. Your Privacy Rights and Choices

Depending on where you live and subject to applicable law, you may have rights to access, know, correct, update, delete, or obtain a copy of your personal information; withdraw consent; object to or restrict certain processing; receive a portable copy of certain data; opt out of certain disclosures, sales, sharing, targeted advertising, or profiling; and limit the use or disclosure of sensitive personal information.

If you would like to exercise a privacy right, you can contact us using the contact details below. We may need to verify your identity before processing certain requests. You may also be able to designate an authorized agent where permitted by law.

If we deny your request, you may have the right to appeal that decision depending on your jurisdiction. If you are dissatisfied with our response, you may also have the right to lodge a complaint with a supervisory authority or regulator in the place where you live.

You can also control certain data practices through your device or browser settings, such as disabling push notifications, managing permission settings, limiting ad tracking where supported, or using available browser-based opt-out preference tools.

We will not discriminate against you for exercising privacy rights that are provided by law.

10. Third-Party Services and Links

The Services may contain links to websites, SDKs, integrations, or services operated by third parties. We are not responsible for the privacy, security, or business practices of those third parties. We encourage you to review the privacy policies of any third-party service that you use or connect to the Services.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or product features. When we do, we will revise the Effective Date above. If changes are material, we may provide additional notice through the Services or by other appropriate means as required by law.

12. Contact Us

13. Social Sign-In and Connected Accounts

If you choose to sign in or connect an account through a third-party provider, we may receive information such as your name, email address, profile identifier, or other account details that the provider makes available based on your settings and permissions. We use that information to authenticate you, create or link your account, and support the features you request.

14. Payments and Transaction Information

If you make purchases or subscribe to paid features, payment processing may be handled by an app store, payment processor, or billing partner. We may receive transaction metadata such as purchase status, subscription tier, renewal dates, receipt identifiers, and limited billing details necessary to manage your purchase and provide support. We do not store full payment card numbers unless expressly stated at the time of collection.

15. Location Information

If you grant location permissions, we may collect precise or approximate location information to provide location-based functionality you request. You can control location permissions at the device level. Disabling location access may affect certain features.

16. Cookies and Similar Technologies

On our websites and web-based Services, we and our service providers may use cookies, local storage, pixels, SDKs, and similar technologies to remember settings, keep you signed in, understand usage, improve performance, measure campaigns, and maintain security.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies. You can manage certain preferences through your browser settings, consent tools, or other controls we make available.

17. Analytics, Diagnostics, and Service Improvement

We may use analytics, logging, and diagnostic tools to understand how the Services are used, identify bugs or crashes, measure performance, improve stability, and develop new features. These tools may collect device, usage, and event data. Where required by law, we provide additional choices or obtain consent before using these tools for non-essential purposes.

18. Push Notifications and Communications

If you enable notifications, we may send push notifications or similar messages about account activity, product updates, reminders, security events, or other service-related information. You can manage notifications through your device settings or, where available, your in-app preferences. If you opt in to marketing communications, you can unsubscribe using the method provided in the message or by contacting us.

19. Advertising and Related Disclosures

If we use advertising, ad measurement, attribution, retargeting, or cross-context behavioral advertising tools, we may allow advertising or measurement partners to receive identifiers, event data, device data, approximate location, or similar information as described in our notices at collection and consent tools.

If applicable law gives you the right to opt out of sale, sharing, targeted advertising, or profiling, you may exercise those rights through the methods described in this Privacy Policy and any region-specific notices we provide. We also process qualifying browser or device-based opt-out preference signals where required by law.

20. Sensitive Information

We only collect sensitive personal information when it is reasonably necessary for a disclosed purpose, when you choose to provide it, or when you explicitly enable a feature that requires it. Depending on the feature, this may include information such as precise geolocation, biometric information, health-related information, or other sensitive categories recognized by applicable law.

Where required by law, we will obtain consent or provide a right to limit certain uses before collecting or using sensitive personal information. We ask that you do not submit sensitive information unless it is specifically requested or needed for the feature you are using.

21. Automated Decision-Making

We may use automated processing, including profiling, to support fraud prevention, security monitoring, personalization, moderation, eligibility checks, or other product operations. Where we make solely automated decisions that produce legal or similarly significant effects, we will provide any additional notices, rights, or safeguards required by applicable law.

22. Children's Privacy

If the Services are directed to children or we knowingly collect personal information from children, we will provide the additional notices and parental controls required by applicable law. Where required, we will obtain verifiable parental consent before collecting, using, or disclosing personal information from children. Parents or guardians may review, delete, or request that we stop further processing of a child's information by contacting us.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 unless expressly stated in a separate product notice. If you believe a child has provided personal information to us in violation of this policy, please contact us and we will take appropriate steps to investigate and, where required, delete the information.