Privacy notice
How Norm handles personal data under the GDPR.
Controller
Yusuf Enes Tokat
Danziger Straße 24
37688 Beverungen
Germany
Email: hello@normlabs.de
What the scan does
When you submit a URL, our server fetches the public HTML of that address and analyses the markup. The page is not rendered, no scripts are executed and nothing is uploaded from your device.
The operator of the scanned website may see our request in their server logs, including the IP address of our server.
What is stored
Scans: the submitted URL, the resulting score, the band and the structured findings, together with a timestamp.
Contact requests: the name, email address, organisation, website and number of pages you enter in the request form, plus the selected plan and a timestamp.
Server logs kept by our hosting provider for operating and securing the service, including IP address, time of access and user agent.
Legal basis
Art. 6(1)(b) GDPR — processing of the data you enter in the request form is necessary to answer your enquiry and to perform or prepare a contract for an audit.
Art. 6(1)(f) GDPR — our legitimate interest in operating a working, secure service and in keeping scan results so that scores can be compared over time and displayed in public rankings.
Cookies and tracking
Norm sets no tracking cookies, no advertising cookies and no analytics cookies. The language you choose is held in memory only and is gone when you close the tab. Nothing is written to local storage or session storage.
Recipients
Hosting and the database are provided by Lovable Cloud, which processes data on our behalf as a processor under Art. 28 GDPR. Data is not sold and not passed to third parties for advertising.
Retention
Scan records: 24 months, then deleted or aggregated without a URL.
Contact requests: 6 months after the enquiry is closed; if a contract results, for the statutory retention periods of up to 10 years.
Server logs: 30 days.
Your rights (Art. 15-21 GDPR)
You have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21).
To exercise any of these rights, write to hello@normlabs.de. You also have the right to lodge a complaint with a supervisory authority.