Norman Apps

Privacy policy

This English translation is provided for information only. In the event of any discrepancy, the French version prevails. Version française

DRAFT TO BE VALIDATED This text describes how the service currently works. The highlighted passages are to be completed or confirmed, and the text must then be reviewed by a professional before it is considered final.

Last updated: date

1. Who is responsible for your data?

Norman Apps - legal form, SIRET number, address, hereinafter “Norman Apps”, publishes a service of mobile apps that display a customer’s website, with notifications, and an online account to configure them.

Contact for any question about your data: contact@norman-apps.com.

Two situations must be distinguished:

  • You are a Norman Apps customer (you have an online account): Norman Apps is the controller of your data, described below.
  • You use a customer’s app : see section 4.

2. Data collected

  • Account : company name or organization, login email address, password (stored only in encrypted form). If you sign in with Google or Apple (an account is then created on first sign-in): the email address, name and identifier provided by that service. No other data from your Google or Apple account (photo, contacts, etc.) is read or kept.
  • Contact details : first name, last name, job title, phone number and contact email address of the person in charge of the account.
  • Website : website address, ownership verification code, and proof of your authorization (accepted text, date and time, IP address, browser used).
  • Business declaration : type of organization (company or association), company name and, for earlier declarations, identification number.
  • Subscription and billing : plan, status, event history, invoices and the customer’s identifiers at Stripe. Card data is processed exclusively by Stripe and is never kept by Norman Apps.
  • Pro app request : name, email address, phone number, website address and any message.
  • Your app’s content : name, colors, icons, images, links, texts and translations that you configure.
  • Notifications : title, message, link and image of the notifications you send. Images are deleted from our servers after 24 hours.
  • Security : to limit abusive attempts, the IP address and email address are kept as a (non-reversible) hash; the host keeps technical connection logs. Public forms (sign-in, sign-up, forgotten password, contact) are protected by the Cloudflare Turnstile anti-bot check, which analyzes technical information about the browser and the device (including the IP address).
  • Messages : service emails sent by Norman Apps (address confirmation, forgotten password, billing, reminders).

3. Why, and on what legal basis?

  • Creating and managing your account (including via Google or Apple sign-in), providing the service, contacting you : performance of the contract.
  • Invoicing, keeping the accounts : performance of the contract and legal obligation.
  • Verifying that the website belongs to you and keeping proof of your consent (required by app publishing platforms): legitimate interest of Norman Apps, and performance of the contract.
  • Responding to requests from Google or Apple about your app : legitimate interest and performance of the contract.
  • Service security, abuse prevention : legitimate interest.
  • Sending notifications : performance of the contract with you; see section 4 for your users.

None of this data is sold, used for advertising purposes or subject to automated decision-making.

4. Users of our customers’ apps

  • The app asks its users for no account, name or email address.
  • To receive notifications, the device obtains a technical identifier from Google (Firebase Cloud Messaging) and subscribes to the app’s broadcasts. Norman Apps does not keep these identifiers in its own database.
  • Favorites and notification history are stored only on the user’s device and are not sent to Norman Apps.
  • The website displayed in the app is the customer’s: its own privacy and cookie rules apply. The customer is responsible for the content of its website and the notifications it sends.
  • For sending notifications, Norman Apps acts on behalf of the customer, who remains responsible towards its users. This relationship is governed by a data processing agreement (Article 28 of the GDPR) included in the general terms of sale.

5. Who receives your data?

Only the technical providers necessary for the service, acting as processors:

  • OVH (France): hosting of the website, database and files.
  • Stripe : payment of subscriptions and setup fees.
  • Brevo (France): sending service emails.
  • Cloudflare : anti-bot check (Turnstile) on public forms: sign-in, sign-up, forgotten password, link resend and contact.
  • Google : Firebase Cloud Messaging (notifications), Google Play (app publication) and Google sign-in.
  • Apple : app publication on the App Store, notifications on iPhone and Apple sign-in, where the iOS version and this sign-in are offered. To be confirmed before the iOS launch.

Some of these providers (Stripe, Cloudflare, Google, Apple) may process data outside the European Union, under safeguards provided for by the GDPR (standard contractual clauses or the EU-US Data Privacy Framework). To be confirmed with each provider.

6. How long?

Proposed periods, to be validated.

  • Account, contact details, configuration: for the duration of the contract, then deleted 3 years after it ends.
  • Invoices and accounting records: 10 years (legal obligation).
  • Proof of website authorization: 5 years after the end of the contract.
  • Notification images: 24 hours.
  • Security hashes (login attempts) and technical logs: 12 months at most.

7. Security

Encrypted connections (HTTPS), passwords stored in encrypted form, access restricted to those who need it, card data entrusted to Stripe. As no system is infallible, in the event of a data breach presenting a risk, the persons concerned and the CNIL (French data protection authority) will be notified within the legal time limits.

8. Your rights

You may request access to your data, its rectification, erasure or portability, the restriction of processing, and object to processing based on legitimate interest. To do so, write to contact@norman-apps.com; you will receive a reply within one month. Some data (invoices in particular) must be kept despite a request for erasure.

If you believe your rights are not being respected, you may lodge a complaint with the CNIL (French data protection authority): www.cnil.fr.

9. Cookies

The public website uses no tracking cookies: only a language preference cookie is stored when you choose FR or EN. The customer area uses a session cookie, necessary for signing in and for form security, and the same language preference cookie. The Cloudflare Turnstile anti-bot check does not set any advertising or audience measurement cookie. These cookies are strictly necessary for the service to work: no consent is required. To be completed if an audience measurement tool is added.

10. Changes

This page may also be used as the privacy policy address on Google Play and App Store listings. It may change; the date of the latest update appears at the top of the page. Customers are informed by email of any significant change.