Data processing
We work with your operation's data in read-only mode. Credentials are stored encrypted and are never returned by the API, and none of your data is used for another client or to train anything.
Last updated: August 5, 2026What data we touch
Only the sources you expressly authorize, and only the fields needed for the contracted diagnostic. We do not access personal data of your end customers unless it is essential to the work, and in that case it is stated in writing before we start.
Read-only
The access we request is read access. We do not write to, change settings in or delete data from your systems. If a fix requires writing to one of your systems, it is agreed separately and either your team carries it out or it is explicitly documented.
How we store credentials
Encrypted with AES-256-GCM and never returned by the API. No team member can read them in plain text from the interface.
What we don't do
We do not combine data across clients. We do not build benchmarks with your information without your written authorization. We do not use your data to train models. We do not transfer it to third parties.
Subprocessors
We use infrastructure and email providers to operate the service. The current list is provided in writing on request, before signing, by writing to hola@norq.agency.
Offboarding and deletion
When the relationship ends, you revoke access from your own account and request deletion of what was processed by writing to hola@norq.agency. Deletion is carried out within 30 days, except for anything regulations require us to keep.