Privacy Policy
Effective: September 26, 2026 · BHVD Inc.
1. Who we are
BHVD Inc. operates NORM and trynorm.co and is the controller for personal information collected through the service. For questions: support@trynorm.co.
2. What we collect
| Data | When | Why |
|---|---|---|
| Email address | Account creation, waitlist signup | Authentication, account recovery, service communications |
| Brand searches | When you search or request a scan | To improve coverage and understand which brands matter to users |
| Saved brands & alerts | When you add to your watchlist | To deliver score-change alerts you request |
| Subscription data | If you purchase a paid plan | Billing, access management, receipts |
| Auth token (local storage) | On login | Keeps you signed in across sessions |
| Basic usage data | During site use | Bug fixes and performance monitoring; not behavioural advertising |
NORM does not request precise location, health records, or fitness data through the current public beta interfaces. Ordinary infrastructure logs may include an IP address, user agent, endpoint, and timestamp.
3. How we use your data
- Account management — authentication, subscription access, support
- Score-change alerts — notifying you when brands on your watchlist are re-scored
- Coverage decisions — aggregated, anonymised brand search demand helps us decide which brands to score next
- Service communications — onboarding, significant product changes, billing events. Not marketing newsletters unless you opt in.
- Security — detecting abuse, fraud, and unauthorised access
We do not sell personal data to data brokers or use it for targeted advertising. Aggregated demand analysis may be used to prioritize future captures. NORM does not provide a brand with the identity of a person who searched for it.
4. Third parties we use
| Service | Purpose | Data shared |
|---|---|---|
| Google Cloud | Authentication, database (Cloud SQL), API hosting (Cloud Run) | Email, account data, saved brands, request logs (IP, endpoint, timestamp) — retained 30 days |
| Stripe | Payment processing (paid plans) | Payment details (handled entirely by Stripe; we see billing status only) |
These services are bound by their own privacy policies and by contractual data processing agreements. We select sub-processors that maintain industry-standard security practices.
5. Cookies, local storage, and analytics
NORM uses browser local storage to keep signed-in users authenticated. Clearing local storage signs the user out. The site contains first-party event logging hooks and code hooks for third-party analytics services. Third-party analytics and advertising pixels are inactive as of September 26, 2026. If they are activated, this policy and any legally required notice or consent controls must be updated before activation.
6. Data retention
Account data is retained while your account is active and for up to 90 days after deletion (to allow recovery in case of error). Anonymised, aggregated demand signals (which brands were searched) are retained indefinitely — these cannot be linked back to individual users. Server request logs are deleted after 30 days.
7. Your rights
Depending on your location, you may have rights to:
- Access — request a copy of your personal data
- Correction — update inaccurate data
- Deletion — request erasure of your account and associated personal data
- Portability — receive your data in a machine-readable format
- Object — opt out of any processing you do not consider necessary
To exercise any of these rights, email support@trynorm.co with the subject "Privacy Request". We will respond within 30 days.
To request account deletion, contact privacy@trynorm.co.
8. Children
NORM is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us personal information, contact us and we will delete it promptly.
9. Security
We use industry-standard practices: encrypted connections (HTTPS/TLS), access controls, and separation of production and non-production systems. No system is perfectly secure — if you suspect unauthorised access to your account, contact us immediately.
10. Changes to this policy
We may update this policy. Material changes will be communicated by email to registered users at least 14 days before taking effect. The effective date at the top of this page reflects the most recent revision.
11. Contact
Privacy questions and requests: support@trynorm.co
Legal inquiries or disputes: legal@trynorm.co
General contact: BHVD Inc., support@trynorm.co
12. Brand data
Brand-level data analyzed by NORM is publicly available marketing content. No private or personal brand data is collected without consent. All scoring data is aggregated and non-identifiable at the individual consumer level. NORM does not collect personal information from brand employees or representatives unless voluntarily submitted through account creation or evidence submission.
13. NORM Browser Extension
The legacy browser extension preview is paused and is not being promoted while public records and extension behavior are reviewed. Before distribution resumes, NORM will verify requested permissions, collection, logging, retention, sharing, and deletion behavior and update this section if needed.
- Intended input: The active tab domain is needed to request a matching public record.
- Authentication: If account features return, an authentication token may be stored locally on the device.
- Distribution status: No installation invitation is active on NORM public pages during the review.
For more details on how the extension uses specific Chrome permissions, see our Technical Transparency page.