Privacy Policy

Who we are

Nori is operated by Saber ("we", "us"). Saber is the controller of the personal data described here. For anything about your data, contact us at hello@getnori.app.

Your organisation's inventory data belongs to your organisation. We hold it so that we can provide Nori to you.

What we collect

Your account

• Your name and email address, and whether you have confirmed your email.
• Your password, stored only as a one-way hash. We never see or store it in plain text.
• Sign-in sessions: when each session started and expires, plus the IP address and the browser or device information (user agent) it was opened from.
• Whether you have finished or skipped the guided tour, so it does not start again on another device.

Your organisation and venues

• Organisation name, type, country and currency, and your plan.
• Venue names, countries and time zones.
• Who belongs to the organisation, their roles and which venues they can use, and invitations: the invited email address, who sent it and when it expires.
• When the terms were accepted and which version.

Your inventory

• Items, barcodes, categories, units, costs, storage areas and count schedules.
• Stock counts, deliveries, waste and other stock movements, with who recorded them and when.
• Suppliers, stock levels and orders.

Spreadsheet imports

When you import a spreadsheet, the file is stored privately on Vercel Blob while you review it. We also keep a record of the import: the file name and size, the choices you made (columns, categories, units, opening stock) and a summary of the result.

Invoice imports

When you import a supplier invoice, the file (a PDF or photo) is stored privately on Vercel Blob and read by an AI model through the Vercel AI Gateway, which turns it into invoice lines for you to review. The file is deleted when you save or cancel the import, or after 30 days if you do neither. What was read from it (the supplier's name and contact details, the invoice number and date, and each line's description, quantity and prices) is kept with the import record while the import is open, and with the saved deliveries once you save it. It is cleared when an import is cancelled.

Ask Nori

When you ask Ask Nori a question, your question and the stock records needed to answer it (such as item names, quantities, costs, counts, orders and supplier names) are sent through the Vercel AI Gateway to the AI model that writes the answer. Your chats are stored with your account and visible only to you. They are kept until you delete them, or 90 days after the last message, or until your account is closed.

The phone app

For each phone where you use the Nori app, we keep a random installation ID, the platform (iOS or Android), the app version, and when it was first and last used. This lets owners see who on their team uses the app. We do not collect the device name, model or IP address for this record. The app keeps your sign-in in the phone's secure storage and keeps counts on the phone until they can be sent to Nori.

What we do not collect

Nori has no advertising, no advertising trackers and no analytics cookies. We do not collect payment card details.

How we use it

• To provide Nori: sign you in, store and show your inventory, and run reports.
• To send service emails, such as confirming your email address and team invitations.
• To keep Nori secure, prevent abuse and fix problems.
• To answer you when you contact us.
• To improve Nori and produce benchmarks and industry insights, only from aggregated and anonymised data, as described below.

Barcodes

When you scan a barcode that Nori does not know yet, we look up only the barcode number with Open Food Facts, a public product database. If it is not found there, the first product name given to that barcode is added to Nori's shared product list, so the next venue that scans it gets a suggestion. That list holds only the barcode, product name and brand. It never records which venue or person added it, and it holds none of your stock, costs or suppliers.

Aggregated and anonymised data

We may use inventory and usage data in aggregated and anonymised form: combined across many venues and stripped of anything that identifies a venue, an organisation or a person. We use it for benchmarks, product improvement and industry insights, for example typical waste rates for a type of venue. This is the use you agree to when you create an organisation.

We never sell your data, and we never share a venue's own data with anyone else.

Our legal basis

We follow the principles of the EU General Data Protection Regulation (GDPR), because many of our customers are in the EU. We process personal data on these grounds:

• Contract: to provide the service you or your organisation signed up for.
• Legitimate interests: to keep Nori secure, improve it, and produce aggregated and anonymised insights. You can object to this (see Your rights).
• Legal obligations: where the law requires us to keep or share data.

Who we share it with

We use a small number of service providers (sub-processors) to run Nori. They process data only on our behalf, to provide their service to us:

• Vercel: hosting, and private storage of uploaded spreadsheets and invoices.
• Vercel AI Gateway: passes uploaded invoices, and Ask Nori questions with the records needed to answer them, to the AI model.
• Google (Gemini model, via Vercel AI Gateway): reads uploaded invoices to extract their lines, and answers Ask Nori questions.
• Neon: the database (Postgres) that holds your account and inventory.
• Resend: sending service emails such as email confirmation and invitations. Email sent to hello@getnori.app is received by Resend and forwarded to our team inbox.
• Better Auth: sign-in monitoring. The Better Auth sign-in library runs in Nori's own API; sign-in and other account events (sign-up, sign-in, sign-out), with your name, email address, IP address, approximate location (city and country) and browser, are also sent to Better Auth's hosted dashboard so we can monitor sign-ins and watch for abuse.

One other service receives a small amount of data:

• Open Food Facts: receives only the barcode number when you scan a barcode Nori does not know yet (see How we use it). It receives nothing about you or your venue.

These providers may process data outside your country, including in the United States. Where the law requires it, we rely on the data protection terms these providers offer for such transfers.

Within your organisation, the people you invite can see the data their role and venue access allow. We may also disclose data if the law requires it. Apart from that, we do not share your data.

Cookies and local storage

Nori uses one kind of cookie: a session cookie that keeps you signed in. It is needed for Nori to work, so we do not ask for consent for it. There are no analytics or advertising cookies.

The web app also uses your browser's local storage for preferences, such as your theme, whether the sidebar is collapsed and which organisation you last used, and keeps unsaved delivery drafts in session storage. These stay in your browser.

How long we keep it

• Account, organisation and inventory data: for as long as your account and organisation are active.
• Uploaded spreadsheets: deleted once the import is applied or cancelled. Imports left unfinished are cancelled after 30 days and the file is deleted then. Uploads that never became an import are deleted after about a day.
• Uploaded invoices: the file is deleted once the import is saved or cancelled, or when reading it fails. Imports left unsaved are cancelled after 30 days and the file is deleted then. What was read from a cancelled import is cleared; what was read from a saved one stays with its deliveries.
• Ask Nori chats: kept until you delete them, or 90 days after the last message, or until your account is closed.
• When you ask us to delete your account or organisation, we delete the data within 30 days, including from backups.
• Aggregated and anonymised data does not identify anyone, so we may keep it.

Your rights

You can ask us to:

• Access the personal data we hold about you.
• Correct data that is wrong. You can edit most of it in Nori yourself.
• Delete your account and data.
• Export your data in a portable format. Activity in Nori can already be exported as CSV files.
• Object to or ask us to restrict processing based on legitimate interests.

Email hello@getnori.app and we will reply within 30 days. If you use Nori as part of someone else's organisation, some requests about that organisation's data may need to go through its owner.

You also have the right to complain to a data protection authority, for example the one in the country where you live or work. We would appreciate the chance to sort it out with you first.

Security

Nori is served only over HTTPS. Passwords are stored as one-way hashes, uploaded files are stored privately, and each organisation's data is kept separate from others. No system is perfectly secure, but if a breach affects your personal data we will tell you as the law requires.

Changes to this policy

We may update this policy as Nori changes. The date at the top shows the latest version. If we make significant changes, we will email organisation owners before they take effect.

Contact

Nori is operated by Saber. Questions, requests or complaints: hello@getnori.app. See also our Terms of Service.