Privacy Policy

NORYQO is a small UK-operated software service that helps small businesses capture, prioritise and reply to customer enquiries. NORYQO is currently operated by a UK sole trader trading as NORYQO.

You can reach us about anything in this policy at hello@getnoryqo.com, or through the contact form on our home page. Customers with an account can also raise a request from the Support page inside the app.

It matters which data we are talking about, because our role changes:

• Our own records — we are the controller. Your account details, your workspace settings, your billing records and your support conversations with us are data we decide the purpose of, so we are responsible for them.
• Your customers' enquiries — we act as your service provider. When someone fills in your NORYQO enquiry form, that enquiry belongs to your business. We store and process it on your instructions so the product can do its job. You decide why you collect it and how long you keep it; we do not use it for our own purposes.

In UK GDPR terms this generally makes you the controller and NORYQO the processor for enquiry data. We describe the practical position here rather than asserting a legal conclusion for every possible situation — if you need a signed data processing agreement for your own compliance, email us and we will work through it with you.

Account and workspace information. Your name, email address, password (stored only as a hash by our authentication provider), the name of your business or workspace, the people you invite and their roles, and the settings you choose — such as your enquiry form configuration and the reply tone you prefer.

Business and contact information. Anything you send us through the website contact form or a support ticket: your name, email, business name, industry and the message itself.

Customer enquiry data. Whatever your own customers submit through a NORYQO enquiry form or an enquiry you forward into the product. Typically that is a name, an email address, sometimes a phone number or postcode, and a free-text description of what they need. It also includes what the product derives from that enquiry — a summary, a service category, an urgency score, a draft reply and the outcome you record.

Messages we send on your behalf. Replies and follow-ups that you approve are stored with their delivery state — sent, delivered, bounced, complained or unsubscribed — so you can see what actually reached the customer.

Product usage, audit and diagnostic information. Records of automation runs, how much of your monthly allowance you have used, errors and timestamps, and an audit trail of significant actions in your workspace. This is how we bill accurately, debug problems and show you what the system did.

Billing information. Your plan, subscription status, renewal dates and the identifiers our payment provider gives us. We do not see or store full card numbers.

We do not run advertising trackers on the marketing site and we do not sell personal data to anyone.

• To provide the service you signed up for — creating your workspace, capturing enquiries, classifying them, drafting replies, sending the ones you approve and tracking outcomes. Lawful basis: performance of our contract with you.
• To take payment and keep financial records — subscriptions, invoices, failed payments, cancellations. Lawful basis: contract, and legal obligation for tax and accounting records.
• To support you — answering your questions and investigating faults. Lawful basis: contract and our legitimate interest in running a service that works.
• To keep the service secure and within its limits — abuse prevention, rate limiting, usage metering, audit logging. Lawful basis: legitimate interests.
• To send service messages — confirmation, password reset, billing and important product notices. Lawful basis: contract. These are not marketing and you cannot opt out of them while you have an account.
• To handle your customers' enquiry data — on your documented instructions, as your processor. Your own lawful basis covers that collection.

You are responsible for collecting your own customers' information lawfully and fairly. That includes telling them who you are and what you will do with their enquiry, having a proper basis for contacting them, and not using NORYQO to send unsolicited marketing. NORYQO gives you the tools; it does not make you compliant on its own, and we cannot give you legal advice.

NORYQO never emails your customers by itself. Every reply and follow-up is a draft until a person in your workspace reads it and sends it.

We keep the list short on purpose. We currently rely on:

• Supabase — our database, authentication and file storage, hosted in the UK/EU region.
• Our application hosting provider — serves the NORYQO website and application and processes requests in transit.
• Stripe — payment processing and subscription billing. Card details are entered on Stripe's own checkout and handled by Stripe, not by us.
• Resend — delivery of transactional email, including the replies you approve and the account emails we send you.

Each of these acts as a sub-processor and is bound by its own contract to handle data only as instructed. We do not claim any certification, accreditation or audit status on their behalf or on ours. We will update this list before adding a provider that materially changes how enquiry data is handled.

Your workspace database is hosted in the UK/EU region. Some of our providers are international companies and may process limited data — for example billing records or email delivery metadata — outside the UK. Where that happens, we rely on those providers' own transfer safeguards, such as the UK addendum to the EU standard contractual clauses. We are describing this cautiously and honestly: we do not operate our own overseas infrastructure, and we do not deliberately move your enquiry data outside the UK/EU region.

Workspace and enquiry data is kept for as long as your workspace is active. The product applies an automatic retention routine that removes older operational records — run logs and message history — once they are past their retention window, so the amount we hold does not grow indefinitely.

You can export your enquiries at any time from inside the app. If you ask us to delete your workspace, we remove your workspace data from live systems and it then falls out of routine backups in the ordinary course. We keep the minimum billing and tax records the law requires us to keep, for as long as it requires.

We take security seriously and design for it: data is encrypted in transit, workspaces are isolated from each other at the database level so one customer cannot read another's data, secrets and provider keys are held server-side and never shipped to the browser, incoming webhooks are cryptographically verified, and significant actions are recorded in an audit trail.

No service can promise perfect security and we are not going to pretend otherwise. If we become aware of a personal data breach that is likely to affect you, we will tell you without undue delay and report it to the regulator where we are required to.

Under UK data protection law you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, or provide it in a portable format. You can also withdraw consent where we relied on consent.

Email hello@getnoryqo.com and we will respond within one month. If your request concerns enquiry data held inside a NORYQO customer's workspace — that is, you contacted a business that uses NORYQO — please contact that business directly, as it is their data. Tell us and we will help them action it.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

The marketing site does not use advertising or analytics cookies. The application uses strictly necessary browser storage to keep you signed in and to remember your workspace. Without it you could not stay logged in.

NORYQO is in an early, actively developed stage, so this policy will change as the product does. We will update the date at the top whenever we change it, and we will tell account holders by email before any change that materially affects how we handle their data.