Privacy Policy

1. General

Norlo provides a health, lifestyle and personal-development service through our website and related services.

This Privacy Policy explains how we collect, use, store and share personal information when you use Norlo.

We aim to collect only the information necessary to provide, secure and improve the Service, and to explain our use of personal information clearly.

2. Information We Collect

When you use Norlo, we may collect the following information.

a. Account Information

When you create or save a Norlo account, we may collect:

• your email address;
• your display name;
• your account identifier; and
• information needed to authenticate and maintain your account.

Norlo may also support anonymous use before an account is permanently linked to an email address.

b. Profile and Progress Information

Your Norlo profile and progress may include:

• XP and level;
• streak information;
• completed challenges;
• programme progress;
• Island progress;
• gems and other in-app progression information; and
• other information necessary to provide your Norlo experience.

c. Verification and Activity Information

When you complete Norlo activities, we may collect information such as:

• verification sessions;
• challenge completion information;
• check-ins;
• challenge responses;
• progress information; and
• information generated while completing verification steps.

d. Programme Information

If you use Norlo programmes, we may collect:

• programme progress;
• completed actions;
• reflections;
• selected habits; and
• other information you choose to enter into a programme.

Please do not enter medical diagnoses, medication details or other highly sensitive medical information into free-text fields unless Norlo specifically asks you to provide it and gives you information about how that information will be used.

e. Social and Referral Information

If you use Norlo's social or referral features, we may process:

• friend codes;
• referral codes;
• referral relationships;
• friend connections; and
• information associated with those features.

f. Technical and Security Information

We may process information needed to operate and protect Norlo, such as:

• authentication and session information;
• technical information about your device or browser;
• error information;
• security events; and
• other information reasonably necessary to maintain the Service.

g. Analytics Information

We may use analytics technologies to understand how users interact with Norlo and improve the Service.

We aim to configure analytics to minimise the collection of personal information.

We do not intend to send information such as your email address, password, private reflections or other sensitive information to analytics services for general product analytics.

3. How We Collect Information

We collect information:

• directly from you when you create or use an account;
• when you complete challenges, activities or programmes;
• when you use social or referral features;
• automatically where necessary to operate and secure the Service; and
• from service providers that help us operate Norlo.

4. How We Use Personal Information

a. Provide the Service

We use information to create and manage accounts, save progress, operate challenges and programmes, provide verification and maintain the features you choose to use.

b. Personalise Your Experience

We may use your Norlo activity and progress to display relevant challenges, programmes, progression and other features within the Service.

c. Operate Social and Referral Features

We use information necessary to provide friends, leaderboards, referrals and related features.

d. Maintain Security and Prevent Misuse

We may use information to protect accounts, investigate misuse, prevent fraud and maintain the security of Norlo.

e. Improve Norlo

We may use appropriately minimised or aggregated information to understand how Norlo is used and to improve the Service.

f. Communicate With You

We may send essential communications needed to operate your account, such as account, security or service messages.

Where we send direct marketing communications, we will comply with applicable laws and obtain consent where required.

g. Comply With Legal Obligations

We may process or disclose information where necessary to comply with legal obligations or valid legal requests.

5. Legal Bases for Processing

Under UK data-protection law, we must have a lawful basis for processing personal information.

Depending on the purpose and circumstances, our legal bases may include:

• Contract, where processing is necessary to provide the Norlo service you request;
• Legitimate interests, where processing is necessary for a legitimate interest and your rights do not override that interest;
• Consent, where we ask you to give permission for a particular use of your information; and
• Legal obligation, where processing is required by law.

We determine the appropriate lawful basis for each processing activity and keep those decisions under review.

6. Health and Special-Category Data

Some information processed through a health, fitness or wellbeing service may constitute health data depending on its content and how it is used.

Where Norlo processes special-category personal data, we will identify an appropriate condition under Article 9 of the UK GDPR in addition to an Article 6 lawful basis.

Norlo is intended as a general health, lifestyle and wellbeing service and is not intended to collect or maintain medical records.

We aim to minimise the amount of sensitive information we collect and do not intentionally ask users to provide unnecessary medical information.

7. Third-Party Service Providers

Norlo relies on service providers to operate parts of the Service.

These may include:

• Supabase — authentication, database and backend infrastructure.
• Netlify — website hosting and deployment infrastructure.
• Umami — analytics and product-usage measurement.

We may introduce additional service providers where reasonably necessary to operate, secure or improve Norlo.

Where required, we will put appropriate contractual, security and data-protection arrangements in place with those providers.

8. International Data Transfers

Some of our service providers or their infrastructure may process information outside the United Kingdom.

Where personal information is transferred internationally, we will use an appropriate legal mechanism and safeguards where required by applicable data-protection law.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

Different types of information may be retained for different periods.

We review our retention practices and aim to delete or anonymise information when it is no longer needed.

10. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include authentication controls, database access controls and other safeguards appropriate to the nature of the information we process.

No internet service can be guaranteed to be completely secure.

11. Your Data Protection Rights

Depending on the circumstances, you may have rights to:

• access your personal information;
• ask us to correct inaccurate information;
• ask us to erase your information;
• ask us to restrict certain processing;
• object to certain processing;
• request portability of certain information; and
• withdraw consent where we rely on consent.

These rights are subject to applicable legal conditions and exceptions.

To exercise a data-protection right, contact us using the details in the Contact Us section below.

We may need to verify your identity before completing a request.

12. Account Deletion

We aim to provide users with a way to delete their Norlo account and associated personal information.

Some information may need to be retained where required by law or where another lawful basis for retention applies.

Further information about retention is provided in this Privacy Policy.

13. Children and Younger Users

Norlo may be accessible to people under the age of 18.

Because services likely to be accessed by children may be subject to additional data-protection requirements, we aim to apply privacy-by-design principles and high-privacy defaults appropriate to the risks of the Service.

We aim to:

• minimise the personal information collected from younger users;
• avoid unnecessary location collection;
• limit unnecessary profiling;
• apply appropriate privacy settings to social features; and
• present important privacy information clearly and accessibly.

We will review our practices against the ICO's Children's Code where applicable.

14. Cookies and Similar Technologies

Norlo may use cookies or other technologies that are necessary to operate the Service.

We may also use analytics or other non-essential technologies.

Where applicable law requires consent for a particular technology, we will obtain that consent before using it.

15. Direct Marketing

Where Norlo sends marketing communications by email or other electronic means, we will comply with applicable direct-marketing and electronic-communications laws.

Where consent is required, we will obtain it separately from acceptance of these Terms.

You can withdraw marketing consent or unsubscribe from marketing communications at any time.

Essential service communications may still be sent where necessary to provide or secure the Service.

16. Links to Third-Party Websites

Norlo may contain links to third-party websites or services.

This Privacy Policy applies to information collected by Norlo and does not govern the privacy practices of independent third parties.

We encourage you to review the privacy policies of third-party services you choose to use.

17. Privacy Policy Updates

We may update this Privacy Policy when our Service, data-processing practices or legal obligations change.

We will update the "last revised" date when changes are made.

Where appropriate, we will take reasonable steps to inform users about material changes.

18. Complaints

If you have concerns about how Norlo handles your personal information, please contact us first:

getnorlo@gmail.com

You also have the right to complain to the UK's Information Commissioner's Office (ICO):

19. Contact Us

Norlo is operated by Leo King, trading as Norlo.

For questions about this Privacy Policy, your account, or how Norlo handles personal information, contact us at:

We will keep our contact information up to date as Norlo develops.