Legal

Privacy Policy

Last updated: September 2026

English courtesy translation of the German Datenschutzerklärung. The German version is the legally binding one.

This website processes as little personal data as possible. There are no analytics scripts, no tracking cookies, no advertising cookies and no visitor profiles. The following explains what data is nevertheless involved when you visit.

Controller

Paul Kahle · Nori Works
Storferwiesen 3
86956 Schongau, Germany
Phone: +49 8861 6995222
Email: hello@noriworks.de

Hosting

This website is hosted by Vercel Inc. (Vercel), 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you access the site, Vercel may process technical connection data (see server log files) to deliver the site securely and reliably. The legal basis is our legitimate interest in secure, fast hosting (Art. 6 (1) (f) GDPR).

A transfer to the USA cannot be excluded. Vercel refers to appropriate transfer mechanisms for such transfers, including Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. For more information, see the Vercel privacy policy.

Server log files

When you access the website, the hosting provider automatically processes data in so-called server log files that your browser transmits. This may include:

  • shortened or full IP address
  • date and time of access
  • the page or file requested
  • amount of data transferred and status message
  • referrer URL (the previously visited page)
  • browser type, version and operating system

This processing serves the technical delivery, stability and security of the website. The legal basis is our legitimate interest in a secure and functioning service (Art. 6 (1) (f) GDPR).

Contact by email

If you email us, we process the details you provide (e.g. email address, name and the content of your message) in order to respond to your request. The legal basis is the initiation or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in handling your enquiry (Art. 6 (1) (f) GDPR). We keep the data for as long as needed to handle it and delete it once no statutory retention obligations apply.

Contact form

You can send us a message via the contact form. We process the data you enter (name, email address, optionally company/project, voluntary information on how you heard about Nori Works, and your message) in order to handle your enquiry. The legal basis is the initiation or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in handling it (Art. 6 (1) (f) GDPR). Providing the data is voluntary; without a name, email and message we cannot respond. After submitting, you receive an automatic confirmation email.

Delivery: To deliver the form message to our inbox we use Resend (Plus Five Five, Inc. (Resend), USA). Resend processes the transmitted content on our behalf (Art. 28 GDPR); this may involve a transfer to the USA, safeguarded by appropriate measures (EU Standard Contractual Clauses). More information: Resend privacy policy and Resend Data Processing Addendum .

Storage: Form data is currently not stored in our own database. It is delivered to us only as an email and kept there for as long as needed to handle the enquiry.

Spam protection: The form uses a hidden field (honeypot) and a timing check to block automated submissions. No additional personal data is collected for this, and no external captcha services are used.

Newsletter

You may voluntarily subscribe to the Nori Works newsletter. The specific purpose is stated directly next to the signup form. It currently reads: Yes, I would like to receive the German-language newsletter “Nori Works · KI, Arbeit & Zukunft” from Paul Kahle · Nori Works by email – generally on Wednesdays and Sundays, plus one welcome email. Topics: AI, practical workflows and future perspectives, with occasional information about Nori Works content and services. I can unsubscribe at any time using the link in every email.. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw that consent at any time with future effect through the unsubscribe link in every newsletter email.

Double opt-in and evidence: After signup, we first send a confirmation email. Your address is enabled for delivery only after you explicitly confirm on the linked page. As evidence, we store the email address, request time and source, confirmation time, language, the version and wording of the consent, and a random confirmation identifier. The link contains those details only in encrypted form and expires after 48 hours.

Delivery and contact management: We use Resend ( Plus Five Five, Inc. (Resend), USA) for confirmation emails, the one-time welcome email, contact management and newsletter delivery. It processes, in particular, the email address, topic and segment assignment, consent evidence, and delivery, unsubscribe, bounce and complaint status on our behalf (Art. 28 GDPR). Possible transfers to the USA are safeguarded by EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Unsubscribes made through the link in every newsletter email are processed by Resend and stop further delivery. For more information, see the Resend privacy policy and the Resend Data Processing Addendum . Open and click tracking are disabled for the sending domain.

Retention: We store your email address and the documented consent data for as long as you receive the newsletter. After you unsubscribe, you will receive no further newsletters and your address will be removed from active distribution. We retain a record limited to what is necessary to demonstrate consent and unsubscribe, based on Art. 6(1)(f) GDPR, until the end of the third calendar year after you unsubscribe or the newsletter is permanently discontinued. This serves our accountability obligations and the defence of possible legal claims. We then delete the record unless a specific legal dispute or statutory obligation requires longer retention. Unconfirmed signups are not activated; the confirmation link expires after 48 hours.

Abuse protection: Short-lived counters containing HMAC hashes of the email and IP address are kept through Upstash Redis for signup attempts. Plain-text email addresses are not stored there.

Online scheduling

This website may optionally offer a link to book an appointment via Cal.eu. Booking is voluntary; you can always contact us by email or through the contact form instead. The booking link is an external link to Cal.eu. No Cal.eu content is embedded on noriworks.de, and no Cal.eu script is loaded on this website.

If you book an appointment via Cal.eu, Cal.com processes the details you enter, in particular your name, email address, appointment time and voluntary notes, to arrange and prepare the appointment. The legal basis for our use of those details is the initiation or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in simple appointment scheduling (Art. 6 (1) (f) GDPR). According to Cal.com, scheduling data in the Cal.eu environment is stored and processed within the European Union. For more information, see the Cal.com privacy policy .

Video appointments with Google Meet

Individual appointments may take place via Google Meet if requested or mutually agreed. In that case, you receive a meeting link. Google Meet is voluntary; a phone call is available as an alternative. The provider is Google Ireland Limited.

When Google Meet is used, data such as name, email address, meeting metadata, technical connection data and audio, video or chat content may be processed, depending on how the meeting is used. Recordings, transcripts or automatic notes are not used without prior express agreement. For more information, see the Google Meet security and privacy information and the Google Privacy Policy .

AI-assisted process assessment

The services page may optionally offer an AI-assisted first assessment of a described process. This feature is active only when it is visible on the website. In the first step, we process your process description and optional details about tools and frequency to create a first assessment. The legal basis is your consent (Art. 6 (1) (a) GDPR). Name, email address and optionally company/project are processed only if you choose to speak to Paul after seeing the assessment. You can use the website and contact us directly by email without this AI processing.

AI processing: To create the first assessment, we use Google Vertex AI (Google Cloud EMEA Limited, Ireland / EU region). Processing is configured for an EU region. Where processing outside the European Economic Area is required as part of providing the service, Google states that it relies on appropriate transfer mechanisms. For more information, see the Google Cloud privacy information , the Google Cloud Data Processing Addendum and the Vertex AI data governance information .

The enquiry and the AI-assisted assessment are emailed to us only if you enter your contact details after seeing the assessment and trigger the send step. In that case, you also receive a copy by email. The email delivery service named above applies to this delivery. If you do not want AI processing, you can email us directly at hello@noriworks.de.

Abuse protection: To protect against automated or repeated use, short-lived counters are kept through Upstash Redis (Upstash, Inc., USA, Redis database in EU region). Only HMAC hashes of the email address or IP address and counters with expiry times are stored. The generation step is limited by IP address; the send-to-Paul step is also limited by email address. Raw values, names and process descriptions are not stored in Redis. More information: Upstash Redis privacy information and the Upstash Data Processing Addendum .

Storage: The content of the process assessment is currently not stored in our own database. It is delivered only as email and kept there for as long as needed to handle the enquiry. Abuse-protection counters contain no plain-text content and expire automatically.

Cookies and local storage

This website sets no tracking or advertising cookies. Your browser's local storage (localStorage) holds only two technical preferences, and only if you change them:

  • nw-lang – your preferred language (German or English)
  • nw-theme – your preferred appearance (light or dark)

These values stay on your device, are not transmitted to us or any third party, and serve convenience only. Storing them is necessary for the function you requested (§ 25 (2) TDDDG); where required, we additionally rely on our legitimate interest (Art. 6 (1) (f) GDPR). You can delete this data at any time via your browser settings.

Fonts

Fonts are served locally from this website. There is no connection to external font services (such as Google Fonts).

Analytics and tracking

No visitor analytics or behavioural tracking take place. Nori Works uses no analytics, statistics or tracking services. This is distinct from Vercel's technical hosting logs and strictly operational metrics for delivery, stability and security, as described under “Hosting” and “Server log files”.

Embedded third-party content

No third-party content is embedded (no maps, videos, font CDNs, social media plugins or similar). External links may lead to third-party services; their own privacy notices apply there. Should embedded services be added in future, this policy will be updated beforehand.

Your rights

Under the GDPR you have, in particular, the following rights:

  • access to the data stored about you (Art. 15)
  • rectification of inaccurate data (Art. 16)
  • erasure (Art. 17)
  • restriction of processing (Art. 18)
  • data portability (Art. 20)
  • objection to processing (Art. 21)

To exercise your rights, an informal email to hello@noriworks.de is enough.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Deutschland
https://www.lda.bayern.de