Legal
Privacy Policy
How Noren handles your data. Plain language, no surprises.
Last updated: March 3, 2026
Data controller
What the website collects
Email addresses. When you join our waitlist, your email address is collected and stored by Buttondown, our email service provider. We use it solely to send you product updates and launch notifications. You can unsubscribe at any time.
Analytics. We use Vercel Analytics to understand how visitors use the site. Vercel Analytics is privacy-friendly: it collects aggregate page view data and does not track individual users, store cookies, or collect personally identifiable information.
X (Twitter) pixel. We use the X (formerly Twitter) conversion pixel on usenoren.ai for ad retargeting purposes. This pixel is only loaded after you give explicit consent via our cookie banner, as required by § 25 TDDDG. The pixel may set cookies and collect browsing data in accordance with X's privacy policy. You can withdraw your consent at any time through the cookie settings on our site, or opt out of X's personalized advertising in your X account settings.
Cookies. The website uses only functional cookies necessary for the site to operate. The X pixel cookie described above is only set after you grant consent. We do not use any other tracking or advertising cookies.
What the desktop app collects
Writing samples. When you run a voice extraction, your writing samples are sent to our server for processing. They are used only to generate your voice profile and are discarded immediately after the extraction completes. We do not store your writing samples beyond the duration of the extraction request.
Living Profile (Pro plan). If you subscribe to Pro, some generated content may be saved temporarily to enable periodic voice profile upgrades. This data is retained for up to 30 days and discarded after the upgrade cycle completes.
API keys. Your LLM provider API keys are stored locally on your machine. They are never sent to Noren servers. When running extractions, your API key is sent directly from your machine to the LLM provider. Your relationship with that provider is governed by their terms and privacy policy.
Data retention
- Waitlist emails: retained until you unsubscribe, or until the waitlist is closed
- Writing samples: discarded immediately after extraction completes (typically within minutes)
- Living Profile data: retained for up to 30 days per upgrade cycle, then discarded
- Vercel Analytics: aggregate data retained by Vercel per their data retention policy (no personal data is stored)
- Payment and transaction records: retained for the duration required by German tax and commercial law (up to 10 years per § 147 AO and § 257 HGB)
Third-party services
We rely on the following third-party services:
- Buttondown (USA) for email newsletter and waitlist management
- Vercel (USA) for website hosting and privacy-friendly analytics
- X (Twitter) (USA) for conversion tracking pixel on usenoren.ai (consent required)
- LLM providers (e.g. Google Gemini, OpenAI, Anthropic) for voice extraction, accessed using your own API key and governed by your agreement with that provider
International data transfers
Some of our third-party service providers are based in the United States. When your data is transferred to these providers, we ensure adequate protection through one or more of the following mechanisms:
- EU-US Data Privacy Framework: where the provider is certified under the framework (adequacy decision by the European Commission, July 2023)
- Standard Contractual Clauses (SCCs): where the provider has entered into EU-approved standard contractual clauses
LLM provider transfers are initiated by you directly using your own API key. The legal basis and safeguards for those transfers are governed by your agreement with the respective provider.
Legal basis for processing
We process personal data based on the following legal grounds (Art. 6(1) GDPR):
- Consent (Art. 6(1)(a)) for email collection via the waitlist and for loading the X pixel
- Contract performance (Art. 6(1)(b)) for processing writing samples to deliver the voice extraction service
- Legitimate interest (Art. 6(1)(f)) for Vercel Analytics (our interest: understanding site usage to improve the product)
- Legal obligation (Art. 6(1)(c)) for retaining payment records as required by German tax law
Automated processing
The voice extraction service uses AI models to analyze your writing samples and generate a voice profile. This is an automated process, but it does not produce decisions with legal or similarly significant effects on you. The output is a descriptive voice profile that you can review, edit, and choose whether to use.
No profiling, scoring, or automated decision-making as defined in Art. 22 GDPR takes place.
Obligation to provide data
You are not legally required to provide personal data to us. However, providing your email address is necessary to join the waitlist, and providing writing samples is necessary to use the voice extraction service. Without this data, we cannot provide the respective service.
Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate personal data (Art. 16)
- Erase your personal data (Art. 17)
- Restrict processing of your data (Art. 18)
- Port your data to another service (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3))
To exercise any of these rights, contact us at help@usenoren.ai. We will respond within 30 days.
Supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for our location is the Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany.