Privacy Policy

English courtesy translation of the German Datenschutzerklärung. The German version is the legally binding one.

This website processes as little personal data as possible. There is no tracking, no analytics tools, no advertising cookies and no embedded third-party services. The following explains what data is nevertheless involved when you visit.

Controller

Paul Kahle · Nori Works
Storferwiesen 3
86956 Schongau, Germany
Phone: +49 8861 6995222
Email: hello@noriworks.de

Hosting

This website is a static site hosted by Vercel Inc. (Vercel), 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you access the site, Vercel may process technical connection data (see server log files) to deliver the site securely and reliably. The legal basis is our legitimate interest in secure, fast hosting (Art. 6 (1) (f) GDPR).

A transfer to the USA cannot be excluded. Vercel refers to appropriate transfer mechanisms for such transfers, including Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. For more information, see the Vercel privacy policy.

Server log files

When you access the website, the hosting provider automatically processes data in so-called server log files that your browser transmits. This may include:

• shortened or full IP address
• date and time of access
• the page or file requested
• amount of data transferred and status message
• referrer URL (the previously visited page)
• browser type, version and operating system

This processing serves the technical delivery, stability and security of the website. The legal basis is our legitimate interest in a secure and functioning service (Art. 6 (1) (f) GDPR).

Contact by email

If you email us, we process the details you provide (e.g. email address, name and the content of your message) in order to respond to your request. The legal basis is the initiation or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in handling your enquiry (Art. 6 (1) (f) GDPR). We keep the data for as long as needed to handle it and delete it once no statutory retention obligations apply.

Contact form

You can send us a message via the contact form. We process the data you enter (name, email address, optionally company/project, and your message) in order to handle your enquiry. The legal basis is the initiation or performance of a contract (Art. 6 (1) (b) GDPR) or our legitimate interest in handling it (Art. 6 (1) (f) GDPR). Providing the data is voluntary; without a name, email and message we cannot respond. After submitting, you receive an automatic confirmation email.

Delivery: To deliver the form message to our inbox we use Resend (Plus Five Five, Inc. (Resend), USA). Resend processes the transmitted content on our behalf (Art. 28 GDPR); this may involve a transfer to the USA, safeguarded by appropriate measures (EU Standard Contractual Clauses). More information: Resend privacy policy and Resend Data Processing Addendum .

Storage: Form data is currently not stored in our own database. It is delivered to us only as an email and kept there for as long as needed to handle the enquiry.

Spam protection: The form uses a hidden field (honeypot) and a timing check to block automated submissions. No additional personal data is collected for this, and no external captcha services are used.

AI-assisted process assessment

The services page may optionally offer an AI-assisted first assessment of a described process. This feature is active only when it is visible on the website. In the first step, we process your process description and optional details about tools and frequency to create a first assessment. The legal basis is your consent (Art. 6 (1) (a) GDPR). Name, email address and optionally company/project are processed only if you choose to speak to Paul after seeing the assessment. You can use the website and contact us directly by email without this AI processing.

AI processing: To create the first assessment, we use Google Vertex AI (Google Cloud EMEA Limited, Ireland / EU region). Processing is configured for an EU region. Where processing outside the European Economic Area is required as part of providing the service, Google states that it relies on appropriate transfer mechanisms. For more information, see the Google Cloud privacy information , the Google Cloud Data Processing Addendum and the Vertex AI data governance information .

The enquiry and the AI-assisted assessment are emailed to us only if you enter your contact details after seeing the assessment and trigger the send step. In that case, you also receive a copy by email. The email delivery service named above applies to this delivery. If you do not want AI processing, you can email us directly at hello@noriworks.de.

Abuse protection: To protect against automated or repeated use, short-lived counters are kept through Upstash Redis (Upstash, Inc., USA, Redis database in EU region). Only HMAC hashes of the email address or IP address and counters with expiry times are stored. The generation step is limited by IP address; the send-to-Paul step is also limited by email address. Raw values, names and process descriptions are not stored in Redis. More information: Upstash Redis privacy information and the Upstash Data Processing Addendum .

Storage: The content of the process assessment is currently not stored in our own database. It is delivered only as email and kept there for as long as needed to handle the enquiry. Abuse-protection counters contain no plain-text content and expire automatically.

Cookies and local storage

This website sets no tracking or advertising cookies. Your browser's local storage (localStorage) holds only two technical preferences, and only if you change them:

• nw-lang – your preferred language (German or English)
• nw-theme – your preferred appearance (light or dark)

These values stay on your device, are not transmitted to us or any third party, and serve convenience only. Storing them is necessary for the function you requested (§ 25 (2) TDDDG); where required, we additionally rely on our legitimate interest (Art. 6 (1) (f) GDPR). You can delete this data at any time via your browser settings.

Fonts

Fonts are served locally from this website. There is no connection to external font services (such as Google Fonts).

Analytics and tracking

No web analytics take place. No analytics, statistics or tracking services are used.

Embedded third-party content

No third-party content is embedded (no maps, videos, font CDNs, social media plugins or similar). Should such services be added in future, this policy will be updated beforehand.

Your rights

Under the GDPR you have, in particular, the following rights:

• access to the data stored about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing (Art. 21)

To exercise your rights, an informal email to hello@noriworks.de is enough.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Deutschland
https://www.lda.bayern.de