# Privacy policy

Last updated: October 3, 2026

The [French version](https://norenso.fr/privacy.md) of this page is the authoritative text, and the legal references it cites are French.

## Data controller

- Controller: Bruno Seilliebert, for Norenso, a project still being set up: Norenso is not yet a registered business
- Contact: [contact@norenso.fr](mailto:contact@norenso.fr)

## In short

This page explains what information Norenso processes, where it comes from, why, how long it is kept and how to object, if:

- we contacted you to offer your business a website;
- you asked us for a preview with the form on this website;
- you opened the client area of your business.

We do not sell, rent or give away any data, and none of it is used for advertising. The application sends no data to an artificial intelligence; to prepare a mock-up, Norenso uses a professional artificial intelligence tool, with only the public information of the business.

## If we contacted you to offer you a website

Norenso looks for neighbourhood businesses with no website, or an outdated one, to offer them a website. This information was not collected from you. We keep:

- the identity of the business: name, trading name, SIREN and SIRET numbers, activity, address, creation date and size. For an individual entrepreneur, the business name may be their own: it is then personal data;
- what the business publishes itself: opening hours, menu and prices, business phone and email, website and public social media pages, colours, logo, photos of the shopfront or products with no recognisable person, and accessibility information;
- our observations: whether the business has a website and whether it is recent, a priority score, the follow-up of our exchanges and our notes.

Their sources:

- the SIRENE register of Insee, only for establishments whose information is made public;
- OpenStreetMap, the collaborative map, and Panoramax, street photos published under a free licence;
- Acceslibre, the French public register of the accessibility of establishments;
- the website of the business, read by our tool NorensoBot, and its public social media pages;
- Google Maps, only to find businesses and learn whether they have a website: we keep only the listing identifier and the website address it shows. Nothing else from Google is kept or used in the mock-up or in our messages.

Purpose: choosing which businesses to offer a website, preparing a mock-up and showing it to you. The priority score is only used to choose who to contact first; a person always decides, and the score has no other consequence for you.

Legal basis: our legitimate interest in offering our services to professionals, for a purpose related to their business (Article 6(1)(f) GDPR).

The mock-up, which is unofficial, can only be seen through a private link, is not indexed by search engines and is no longer available 90 days after its last update. We record the date each time the link is opened, without your IP address or any other information, to know whether the offer interests you.

We contact you by email, private message on social media, letter or phone, using the professional contact details of the business. Each message says who we are and where your information comes from, and gives a code to open the client area of your business.

From the mock-up, you can give us your feedback without signing in, with an optional comment (do not write any personal data in it). We keep your answer, its date and the language of the page, without your IP address or any information about your device, to reply to you and improve our service (legitimate interest, same article, point f). Your feedback is deleted together with the other information about your business.

Objecting: at any time, without giving a reason, through the “Stop contacting me” link in each message and on the mock-up, or by writing to [contact@norenso.fr](mailto:contact@norenso.fr). The mock-up is removed at once and we do not contact you again.

To respect your objection over time, we keep only the SIRET number of your business in an objection list: without it, a new search could suggest it again.

If you asked INSEE not to make your business's information public, your business does not appear in our searches.

## If you ask us for a preview

The information sent with the “Tell us about your business” form is used only to contact you about your website, in particular to send you the preview you asked for.

We only collect what you enter in it:

- the name and town of your business;
- your name;
- your phone number and email address, if you provide them;
- what your customers need to find on your website, among: opening hours, prices, menu, photos, directions;
- your consent to be contacted.

To block automated submissions, Cloudflare's Turnstile service examines technical signals from your browser when you send the form; Cloudflare also uses some of them to improve its service, as a controller. Your IP address is used for a few minutes to limit the number of requests, without being stored.

Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box in the form. You can withdraw it at any time by writing to [contact@norenso.fr](mailto:contact@norenso.fr).

## Client area and sign-in

Your account contains your email address, your name, your role and the businesses you manage. To sign in, you receive a one-time code by email, valid for 10 minutes, stored in a form that cannot be read back.

Each sign-in creates a session, stored with its expiry date, the IP address and the browser used, to keep you signed in and secure your account. Your IP address is also used for a few minutes to limit sign-in attempts.

If you ask for access to the client area of your business without a code, we keep your request (name, email address, phone if you give it, message and language) to check that you are indeed in charge of the business.

Legal basis: preparing and performing your contract (Article 6(1)(b) GDPR).

## Your business information and photos

In your client area, you check and edit what your website shows: opening hours, menu and prices, contact details, presentation and legal notice. Each change is written to a log (who made it, when, the old and new value), which keeps track of what you asked us to publish.

The photos, logo and menu you send are used only for your website and for the files we prepare for you. Before sending a photo, you confirm that you have the right to use it and that no person can be recognised in it.

If you create visuals in the studio of your client area (posters, stickers), we keep each of them (template, format, colours, chosen elements and texts) and the date and format of each download, so that you can pick them up again. Downloaded files are not kept on our servers, and your visuals are deleted with the rest of your client area data.

Legal basis: preparing and performing your contract (Article 6(1)(b) GDPR); the change log is also used to defend our rights and yours (point f).

If you tell us that an upcoming feature interests you, such as creating your posters and posts, we keep your answer, its date and, if you write one, the description of the visual you would like, only to prepare that feature. Legal basis: your consent (point a), which you can change or withdraw at any time in your client area; otherwise, your answer is kept like the rest of your client area data.

## Recipients and processors

Your data is intended for Norenso only: it is not sold, rented or given away. Our providers only access it for the service they provide to us, under a contract that requires it:

- hosting of this website and the mock-ups, the database and the backups, and email sending: Scaleway, in France;
- receiving the emails sent to contact@norenso.fr: an email provider based in Switzerland, a country recognised by the European Commission as offering adequate protection;
- anti-bot check of the request form, described above;
- a professional artificial intelligence tool, which Norenso uses to prepare mock-ups and websites from the public information of the business and the information you ask us to publish, never your account data, under a data processing agreement that excludes training models on this data.

We may also have to disclose data to an authority that lawfully requests it, such as the tax authorities or the courts.

## Transfers outside the European Union

Some providers, the artificial intelligence tool and the anti-bot check, are based in the United States.

These transfers rely on the adequacy decision of the European Commission for companies certified under the Data Privacy Framework, or on the standard contractual clauses of the Commission. You can get the details of these safeguards by writing to us.

## Retention periods

After these periods, data is deleted, or made anonymous when only totals remain.

- Contacted businesses that do not become clients: three years after collection or after your last contact with us, then deleted
- Objection list: as long as needed to respect your objection, with the SIRET number only
- Mock-up openings: 90 days after each opening
- Requests sent with the form: three years after our last exchange, if no contract is signed
- Requests for access to the client area without a code: one year
- Account, business information and photos, web address, change log: during the contract, then three months after it ends, the time needed to hand over the archive of your website; without a contract, like the information of the contacted business
- Sign-in codes: valid for 10 minutes, then unusable
- Sign-in sessions: until you sign out, and at most 7 days after your last visit
- Technical logs: a few days, with automatic rotation of the server logs
- Backups: encrypted copies of the database, kept for 30 days

Data deleted by the application also leaves the backups within the following 30 days.

## Your rights

You can access your data, have it corrected or erased, ask for its processing to be restricted and object to its processing, in particular to prospecting, at any time and without giving a reason. For the data of your account and your business, you can also ask to receive it in a reusable format. You can withdraw a consent at any time and set instructions about what happens to your data after your death.

To exercise these rights, email [contact@norenso.fr](mailto:contact@norenso.fr). You will receive a reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority, at [cnil.fr](https://www.cnil.fr).

## Storage in your browser

The website stores three display preferences in your browser, with no personal data: the language, in a cookie used to reply to you in that language, as well as the light or dark theme and whether the logo animation has already played, which stay on your device.

When you sign in, a strictly necessary session cookie keeps you signed in. It is not used for any tracking and disappears when you sign out or at the latest 7 days after your last visit.

The request form loads Cloudflare's Turnstile service, which may use strictly necessary information in your browser to tell a person from a robot. This website uses no audience measurement tool and no advertising tracker.