Privacy notice

This notice sets out the personal data processed in connection with Norvli, the purposes and legal bases of that processing, the periods for which data is retained, and the rights available to data subjects.

Last updated: 2026-08-24

1. Controller

Norvli, of Galami 1, Tayibe 40400, Israel, is the controller in respect of the processing described in this notice. Correspondence should be addressed to support@norvli.io.

2. Categories of personal data

Account data: email address and the name supplied on registration.

Content data: the material entered into the builder, including any photograph, and the documents saved to the account.

Assistant data: where you use Norvli Gen, the messages you send it, the material you ask it to read, and its replies. This category arises only for a visitor who opens Gen; the builder itself does not create it.

Transaction data: subscription status and payment history. Payment card details are collected by Polar and do not reach our systems.

Technical data: server logs recording that a request occurred and whether it succeeded. These carry account identifiers; they do not carry names or content.

First-party measurement data: counts of pages opened, the site a visit arrived from, whether a visit began from an advert (only the name of the advertising network; the click identifier in the address is not kept), which page followed the first, and how long a page was open. Nothing is stored on your device for this and no identifier of you is retained. Your IP address and browser string are converted, at the moment of the request, into a one-way value under a key that is derived afresh each day and never stored; that value distinguishes one visit from another within a single day and cannot be linked to you, to any account, or to the previous day.

3. Purposes and legal bases

Performance of the contract: operating the account, storing content, taking payment, and, where you use Norvli Gen, transmitting what you send it to the provider named in section 4 in order to produce the reply you asked for.

Compliance with legal obligation: retention of transaction records for the period prescribed by tax law.

Legitimate interests: securing the Service and preventing abuse, and measuring in aggregate which pages of the Service are used, balanced against the rights and freedoms of data subjects. The measurement stores nothing on your device, keeps no identifier of you beyond the short-lived daily value described above, and produces only counts.

Consent: optional cookies and equivalent storage only, withdrawable at any time.

4. Recipients

Amazon Web Services, as processor, for hosting and storage. Data is encrypted at rest and in transit. The first-party measurement described above is performed entirely within that infrastructure and is disclosed to no one.

Anthropic PBC, as processor, in respect of Norvli Gen alone, and only for so long as you use it. Anthropic receives the messages you send Gen, any material you ask it to read, and the resulting replies. It does not receive your email address, your account identifier or your saved documents. Under its commercial terms it may not train models on that material; it deletes it within 30 days; and it retains it longer only where its own usage policy has been breached. Where Gen consults a public source, the query transmitted is one fixed sentence built by the Service around the job title from your resume, normalised to plain words, and contains nothing else you have written.

Polar Software, Inc., as merchant of record and as an independent controller of the payment relationship, for the collection of payment, the assessment and remittance of sales tax, the issue of receipts and the effecting of refunds, under its own privacy policy. A request concerning payment data may accordingly fall to be made to Polar.

Cloudflare, in respect of the bot-mitigation challenge presented on registration, sign-in, password reset, resending a confirmation code, the contact form, country-rule corrections, template suggestions. Cloudflare receives the originating IP address in order to score the request.

Google, as processor, in respect of website analytics and of advertising conversion measurement, in each case only where you have consented to that category. For analytics, Google receives the pages visited and the truncated originating IP address, with advertising signals and personalised advertising disabled. For conversion measurement, Google receives the fact that a visit arriving from a Google advertisement led to an account or a purchase; no name, email address or resume content is included. Refusing, withdrawing consent, or transmitting a Global Privacy Control signal means no request is made to Google for the refused category.

LinkedIn Ireland Unlimited Company, as an independent controller under the LinkedIn Independent Controller Addendum and its own privacy policy, in respect of advertising conversion measurement through its Insight Tag, only where you have consented to the Marketing category. LinkedIn states that directly identifying information is removed within seven days and the remaining pseudonymous data deleted within 180 days. While that consent is in force the tag receives, for each page viewed, the page address, the referring page, browser details and the originating IP address, together with the identifiers in the storage described in the cookie notice and the fact that a visit led to an account, a purchase or a first PDF download; no name, email address or resume content is included. Refusing, or transmitting a Global Privacy Control signal, means the tag is never loaded; withdrawing consent means no further event is sent and the tag is not loaded again on any later page.

Microsoft Ireland Operations Limited, as an independent controller under its own privacy statement, in respect of advertising conversion measurement through its Universal Event Tracking tag, only where you have consented to the Marketing category. While that consent is in force the tag receives, for each page viewed, the page address, the referring page, browser details and the originating IP address, together with the identifiers in the storage described in the cookie notice; no name, email address or resume content is included. Refusing, or transmitting a Global Privacy Control signal, means the tag is never loaded and no request is made to Microsoft. Withdrawing consent means the tag is instructed through Microsoft's consent mode to stop setting and using identifiers and the identifiers stored under this domain are removed at once; the already-loaded tag may still report pages viewed, without identifiers, until the page open at the time is left, and it is not loaded again on any later page.

Personal data is not sold. Beyond the consent-based conversion measurement described above, nothing is disclosed for advertising purposes.

5. International transfers

Data is stored within Amazon Web Services. Where processing entails a transfer outside your region, it is effected under the safeguards offered by that provider.

Assistant data is transferred to Anthropic PBC in the United States under the standard contractual clauses incorporated in its commercial terms and data processing addendum. Not using Norvli Gen prevents the transfer entirely.

Analytics and advertising conversion data, where consented to, are transferred to Google LLC in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by Google. Withholding or withdrawing consent prevents the transfer.

LinkedIn advertising conversion data, where consented to, are transferred to LinkedIn Corporation in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by LinkedIn. Withholding or withdrawing consent prevents the transfer.

Microsoft advertising conversion data, where consented to, are transferred to Microsoft Corporation in the United States under the EU-US Data Privacy Framework and the standard contractual clauses incorporated in the terms offered by Microsoft. Withholding or withdrawing consent prevents the transfer.

6. Retention

Content and account data: until deleted by you, or until deletion of the account.

Transaction records: for the period prescribed by applicable tax law, and no longer.

Technical logs: one month, after which they are deleted automatically.

Assistant data: a conversation is held in the browser for the session only and is not stored by us once the tab is closed, with two exceptions. A message the misuse classification refuses is kept, up to its first 500 characters, for 30 days. A job title you have typed for which Gen has no example is kept, as a content request, for one year. At the provider the conversation is deleted within 30 days, save that material which breaches its usage policy is retained by it for up to two years, and the classification scores derived from it for up to seven years.

7. Rights of the data subject

You have the right to request access to, rectification of, or erasure of your personal data, to restrict or object to its processing, and to data portability. The account page gives immediate effect to most of these.

Where processing is founded on consent, that consent may be withdrawn at any time by means of the cookie settings link in the footer. Withdrawal does not affect the lawfulness of processing carried out before it.

Requests should be addressed to support@norvli.io. You additionally have the right to lodge a complaint with your local supervisory authority.

8. Children

The Service is not directed at children. An account holder must have capacity to contract under the law of their place of residence, and we do not knowingly process the personal data of any person below that age. Where we are notified that we have done so, the account and its data will be deleted.

9. Automated decision-making

No decision producing legal or similarly significant effects is taken solely by automated means, and there is no profiling.

Norvli Gen assesses the material you send it by machine-learning system, and messages sent to it are additionally classified by such a system for the purpose of detecting misuse. Neither produces a decision about you: Gen proposes text which takes effect only where you accept it, and the misuse classification governs only whether a message is answered. A restriction of access arising from repeated misuse is reviewed by a person before it is applied to an account, whether free or paid, and may be contested at the address given in section 7. A visitor without an account may be refused automatically for the remainder of that session.

The bot-mitigation challenge scores the request, not the individual.

10. Amendment

This notice may be amended. The amended version will be published bearing a revised date.