Privacy Policy

The data controller for noryas is Yilmaz - Einzelunternehmen, Inh. Yilmaz, Yasin, Dachsbau 4, 21635 Jork OT Königreich, Germany. Contact for privacy questions: support@noryas.com.

• Account data: email address, password (stored as a salted hash, never in plain text, by Supabase Auth), first name (optional).
• Content you create: procedures, steps, notes, and any images/files you upload, plus the live checklist state for each object (which steps are currently checked off) and a permanent record of completed procedure runs (when a procedure was finished, and by whom if signed in).
• Billing data: if you upgrade to Pro, your plan status and billing identifiers are stored by us; your payment details (card, etc.) are handled entirely by Paddle and never touch our servers.
• Technical data: standard web server logs (IP address, timestamps, request metadata) generated by our hosting provider for security and abuse prevention.
• Cancellation requests: if you use our public cancellation page (no login required), we collect the email address and name you enter to identify the subscription, and use them only to send a one-time verification link and to process the cancellation once confirmed.
• Anonymous QR-scan activity: when someone scans an object’s QR code (no login, no account), we record which checklist steps were checked off and an optional free-text "worker note", keyed to a random identifier generated by their device — not to a name, email address, or any other identifying information. See "Public QR-code access" below for what that scanner can see.

Each object can get a QR code. Scanning it opens a page with no login and no account. That public page shows only: the object’s name and location, its procedures’ titles and category tags, the step-by-step checklist content for a procedure the scanner opens, and the "Besonderheiten" free-text note if the workspace owner added one. Nothing else in the workspace — no other objects, no other groups, no account or contact data, no pricing — is reachable from a QR scan; every public read is scoped server-side to that one specific object.

The workspace owner controls what goes into the fields shown on that page. If a "Besonderheiten" note or a procedure step contains a person’s name, contact details, or other personal or confidential information, it becomes visible to anyone who scans that QR code — noryas doesn’t screen or restrict what’s entered there. See our Terms of Service §2 and §6.

• To provide the Service (your account, your procedures, your execution history) — performance of a contract with you (Art. 6(1)(b) GDPR).
• To process payments for the Pro plan — performance of a contract / compliance with legal (tax/invoicing) obligations (Art. 6(1)(b)/(c) GDPR).
• To send you transactional emails (email confirmation, password reset) — performance of a contract (Art. 6(1)(b) GDPR). We do not send marketing emails, and we do not use your email for anything beyond operating your account.
• Security, fraud, and abuse prevention — legitimate interest (Art. 6(1)(f) GDPR).
• To process a cancellation request submitted via our no-login cancellation page — compliance with a legal obligation to provide an easily accessible cancellation mechanism (Art. 6(1)(c) GDPR, § 312k BGB) and performance of the underlying subscription contract (Art. 6(1)(b) GDPR). The verification link expires after 48 hours and can only be used once.

We use a small number of infrastructure providers ("processors") to run noryas. We don’t sell your data, and we don’t share it with anyone for advertising or marketing purposes. Where a processor is located outside the EU/EEA, transfers are made on the basis of Standard Contractual Clauses or another valid GDPR transfer mechanism.

• Supabase (database, authentication, file storage) — hosted in Frankfurt, Germany (EU Central region).
• Vercel Inc. (application hosting) — our application servers run in Frankfurt, Germany; Vercel is a US company and may process data in the US under Standard Contractual Clauses.
• Resend (transactional email delivery) — email sending infrastructure located in Ireland (eu-west-1).
• Zoho Corporation (support email hosting for support@noryas.com) — hosted within the European Union.
• Paddle.com Market Limited (payment processing, merchant of record for Pro plan billing) — processes your payment details directly; see their own privacy policy for how they handle payment data.
• Geoapify (operated by Keptago Ltd, Cyprus; converts an object’s location into an approximate map image shown on its card) — hosted in EU data centers.

If you’re a business customer and your use of noryas involves us processing personal data of your own personnel, site contacts, or other third parties on your behalf, we act as your processor and you act as controller of that data (Art. 4(7)/(8), Art. 28 GDPR). The terms of that processing — sub-processors (the list above), security measures, deletion on termination, and how we assist with data subject requests and breach obligations — are set out in our Data Processing Agreement, incorporated into your contract with us.

We keep your account and content for as long as your account exists. Deleting your account from Settings permanently removes your workspace, procedures, executions, and uploaded files from our systems — this cannot be undone.

Completion records (when a procedure run finished, and by whom if signed in) are kept as a permanent history entry, the same way on every plan, until you delete your account.

Billing and invoice records related to Pro plan purchases are retained for up to 10 years after the end of the calendar year in which they were created, as required under German tax and commercial law (§ 147 AO, § 257 HGB), even after you delete your account.

Under GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data (you can do this yourself at any time via Settings → Delete Account, or by contacting us)
• Restrict or object to certain processing
• Receive your data in a portable format
• Lodge a complaint with a supervisory authority — in Germany, Die Landesbeauftragte für den Datenschutz Niedersachsen (lfd.niedersachsen.de), or the supervisory authority in your own EU member state.

To exercise any of these rights, contact support@noryas.com.

Access to your data is protected by Row-Level Security policies scoped to your workspace — other users cannot see your procedures, executions, or files. Passwords are hashed, never stored in plain text. Uploaded images and files live in private storage buckets accessed only via short-lived signed URLs. All traffic is encrypted in transit (HTTPS/TLS).

noryas uses only strictly necessary cookies: one to keep you signed in, and one to track whether you’ve completed onboarding. Neither is used for tracking, advertising, or analytics, and under GDPR/ePrivacy rules, strictly necessary cookies don’t require consent. If we ever add analytics or marketing cookies, we’ll update this policy and ask for consent first.

noryas is a professional tool intended for business and technical use and is not directed at, or intended for use by, children under 16.

We may update this Privacy Policy from time to time. We’ll update the date at the top of this page when we do.

Questions about this Privacy Policy: support@noryas.com