Privacy Policy
Last updated: 21 August 2026 (DRAFT — not yet counsel-reviewed)
This policy explains what personal data Normfluss processes, why, on what legal basis, and the rights you have. Normfluss is an EU-resident document accessibility software platform; we take the confidentiality of the documents you test seriously.
Who we are
The data controller is Nikola Innovations Limited, 40 Sobo Arobiodu Street, Ikeja GRA, Lagos, Nigeria. For any privacy question, or to exercise your rights, contact hello@normfluss.com.
What we process and why
- Account data (email, name, hashed password) — to create and secure your account. Legal basis: performance of a contract.
- Documents you upload (including free anonymous checks) — processed solely to run the accessibility check you requested and produce your results. Legal basis: performance of a contract / your request.
- Lead / contact data (email, company, message) — to respond to enquiries. Legal basis: our legitimate interest in responding, or your consent for marketing (see below).
- Operational logs — to keep the service secure and reliable. Legal basis: legitimate interest.
Data residency
Personal data and uploaded documents are processed within the EU. Our data region is EU by default.
Retention
- Anonymous free-check documents are held only briefly and are automatically and permanently purged if the session is not converted into an account (a short window, on the order of days).
- Documents in an account are retained while your account is active, and per your account settings and applicable law.
- Account and billing records are kept as long as legally required.
Sub-processors
- Resend — transactional and authentication email delivery (e.g. password reset, verification codes, report links).
- Paddle — payment processing and billing (Merchant of Record).
- Cloudflare R2 — EU-region object storage for uploaded and remediated documents (zero-egress, data kept in the EU).
- Datalix — EU (Frankfurt, Germany) server hosting for the application, database, and AI processing.
Marketing consent
We send marketing email only if you have given specific, opt-in consent (an unticked checkbox you actively select). You can withdraw consent at any time via the unsubscribe link in any marketing email or by contacting us — this does not affect transactional email needed to run the service.
Your rights
Subject to applicable law you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise any right, contact hello@normfluss.com. You also have the right to lodge a complaint with your supervisory authority.
Cookies
We use only the cookies strictly necessary to run the service (e.g. your session). We do not use non-essential tracking cookies without consent.