Privacy policy

Last updated: 21 October 2026

This policy explains what personal data we process when you visit norlin.ai, try the live demo, talk to the chat assistant on this site or ask us for an agent.

Our customers use norlin on their own websites. For conversations on a customer's website, that customer is the controller and their privacy policy applies; we process that data on their behalf under a data processing agreement. The sub-processors involved are listed on our sub-processors page.

1. Controller

We have not appointed a data protection officer, as we are not legally required to. Please send any data protection question to the address above.

2. Hosting and technical data

This website and the norlin platform run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Falkenstein and Nuremberg. We have a data processing agreement with Hetzner.

When you open a page, your browser sends technical data such as your IP address and the page you requested. Our servers process it in memory to deliver the page and, for the request form, to limit how often one address can use it (see section 5). We do not keep access logs: your IP address is not written to any log file. Our services keep technical error logs without IP addresses, which are overwritten automatically as new entries arrive. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).

3. Information stored in your browser

We do not use cookies, analytics or advertising trackers. The site stores a few entries in your browser's local storage so that it works as you expect. The language comes from the page address and is not stored.

Legal basis: § 25(2) no. 2 TDDDG, as these entries are strictly necessary for features you use, and Art. 6(1)(f) GDPR for the related processing. Fonts are served from our own server; your browser does not connect to Google or other font providers.

4. Live demo and chat assistant

The demo at the top of the page and the chat assistant in the corner are norlin itself. They are AI systems, not people, and the conversation says so. To start the demo you enter your first name, optionally your last name, and your email address. norlin uses your first name to greet you; your name and email are used to book a call if you ask for one. The demo stays closed until you submit these details, so simply visiting the page starts nothing.

When you write a message, we process:

• the messages you write and the AI's replies, including anything you choose to share in them;
• for an automatic greeting, the page context: page address without query string, page title, visible headings, referring page, browser language, device type and campaign (UTM) parameters. This context is used for that one reply and is not stored.

To generate replies, the conversation is sent to our AI provider, Anthropic, PBC or OpenAI, Inc. (both USA), under the EU Standard Contractual Clauses. Email addresses and phone numbers are never added to the AI request by our system. The providers keep requests for abuse monitoring for a limited time (Anthropic 7 days, OpenAI up to 30 days) and do not use them to train models.

If you book a meeting in the chat, we pass your name, email address and time zone to HubSpot, Inc. (USA) to create the appointment, under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses. These details go straight from our database to HubSpot, not through the AI.

Conversations are stored on our servers in Germany. We keep them as long as we need them to answer your questions and to follow up on your request or booking, and delete them earlier if you ask us to. Legal basis: Art. 6(1)(b) GDPR where you ask about our services or book a meeting, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering questions about norlin).

5. Requesting an agent

If you send us your website and work email through the form on this site, we use them to build a demo agent from your public website and to email you when it is ready. We store your website address, your email address, the language of the page you sent the form from, the time of the request and whether the build was started. To build the agent, an automated process run by Anthropic, PBC (USA) under the Standard Contractual Clauses receives your website address, language and email address and reads your public website. The email is sent from our Google Workspace account (Google Ireland Limited, Dublin, Ireland, with Google LLC, USA, under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses).

Conversations with the demo agent and calls you book with us through it are processed as described in section 4, including the transfer of your name, email address and time zone to HubSpot, Inc. (USA) for the booking.

To prevent abuse, we count requests per IP address for 24 hours and build at most one agent per website and email address a day. The IP address is held in memory for this count only and is not stored with your request.

Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and, for the abuse limits, Art. 6(1)(f) GDPR (our legitimate interest in protecting the service). We delete your request after 90 days.

6. Contacting us by email

If you email us, we process your message and contact details to answer you. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once it is settled, unless statutory retention periods (for example under tax law) require us to keep it.

7. Recipients and transfers outside the EU

We share data only with the service providers named above, each under a data processing agreement. Providers in the USA receive data under the EU Standard Contractual Clauses (HubSpot additionally under the EU-U.S. Data Privacy Framework). The full list is on our sub-processors page. We do not sell personal data.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To use them, email us at the address above.

Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interest, you can object at any time for reasons arising from your particular situation.

You can also complain to a data protection authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

9. Other information

You are not obliged to provide personal data; without it you can still use the website, but not the chat or the form. We do not use automated decision-making within the meaning of Art. 22 GDPR. We update this policy when our processing changes; the date at the top shows the current version.

This English version is provided for convenience. The German version is legally binding.