Privacy Policy

For the purposes of applicable privacy laws, the data controller is CONCIERGERIE SHORT RENTAL, a Moroccan single-member limited liability company (SARL à associé unique / SARLAU). Our registered office is 201 BD MUSTAPHA EL MAANI, 2nd Floor, Apartment 9, Mers Sultan, Casablanca, Morocco. You can contact us at support@norixo.io.

Norixo is operated through the Norixo brand and related digital services. For legal notice details, please see the Legal Notice.

This policy applies to our public website, the authenticated Norixo application, the free audit flow, audit result pages, workspace and billing features, listing-management tools, and backlink/outreach workflows where they are available. It also covers support communications and other interactions with us in connection with those services.

Depending on how you use Norixo, we may collect and process the following categories of information.

• Account and authentication information: your email address, password-managed authentication state, and identity information associated with your account or workspace membership.
• Workspace information: workspace name, slug, owner or member relationship, and other workspace-scoped settings required to operate the product.
• Listing and property information: listing source platform, source URL, title, city, country, price, currency, ratings, review counts, extracted listing data, and other property details that you provide or that we process for audit or optimization purposes.
• Audit and analysis information: audit inputs, generated results, scores, score breakdowns, recommendations, booking or revenue-related analysis, and related result payloads.
• Market intelligence information: market snapshots, market comparables, benchmark outputs, aggregated fact groups, and similar data used to build market views or reports.
• Billing and transaction information: Stripe customer IDs, subscription IDs, checkout session IDs, payment intent IDs, invoice or payment status, amount, currency, plan or entitlement information, and billing-related metadata.
• Communications and support: support requests, correspondence, and information you choose to send us.
• Backlink and outreach information: contact details, domain details, campaign details, outreach history, delivery events, inbound messages, verification history, notes, activity, and related operational records.
• Technical and request information: device and browser information, request headers, IP-related data used for rate limiting or request protection, and logs or diagnostics necessary to secure and operate the service.
• Browser storage: information stored locally in your browser where needed for product flows, including guest audit drafts, workspace selection, pending audit state, and similar saved preferences.

We collect information in a few different ways:

• directly from you when you create an account, workspace, audit, or listing;
• when you use Norixo and generate new analysis, content, or workflow data;
• from the information you submit about listings, backlinks, campaigns, and support requests;
• from service providers that help us operate payments, authentication, email, hosting, or AI-assisted processing; and
• from technical request data needed to secure the platform and prevent abuse.

We use personal data to:

• provide and maintain Norixo;
• authenticate users and manage workspaces;
• run audits, backlink workflows, and related automation;
• generate and improve analysis, recommendations, and content assistance;
• process billing, subscriptions, and payment-related operations;
• send service, transactional, and account-related messages;
• provide support and respond to requests;
• protect the platform, limit abuse, and troubleshoot errors; and
• comply with legal, accounting, and regulatory obligations.

Where GDPR or similar laws apply, we rely on one or more lawful bases depending on the context: performance of a contract, legitimate interests, legal obligations, and consent where specifically requested or required.

The exact legal basis can vary by feature and by the relationship between you and Norixo. For example, we process account and workspace data to deliver the service you requested, billing information to manage payments, and certain technical data to keep the platform secure and reliable.

Norixo uses OpenAI as a verified external AI provider for certain analysis and generation workflows. Depending on the feature you use, the data sent to the AI provider may include listing titles, descriptions, amenities, location information, platform context, language or locale information, visual or content signals, campaign context, and other information needed to produce a useful result.

Please avoid submitting unnecessary sensitive personal information in content that you send to AI-assisted features. AI outputs are generated to help you work faster, but they should still be reviewed before publication or operational use.

We do not make unsupported claims about provider-side model training or retention policies beyond what is contractually disclosed by the provider.

Norixo uses Stripe for checkout, subscriptions, billing, and payment processing. Stripe handles payment card data. Norixo does not store full payment card numbers or card security codes in its application database.

We may store billing metadata that is necessary to manage your subscription and account, including Stripe customer identifiers, subscription identifiers, checkout session identifiers, payment intent identifiers, invoice or payment status, amount, currency, and plan or entitlement information.

We may share information with verified third-party providers that help us run the service:

• Supabase — authentication, database, and backend infrastructure.
• Stripe — payments and billing.
• Resend — transactional and service email.
• OpenAI — AI-assisted analysis and generation.
• Vercel — website and application hosting and delivery.

Some providers may process data in countries or regions where they or their infrastructure operate. Where required, we rely on appropriate safeguards for cross-border transfers.

Norixo processes aggregated or de-identified information where applicable, including market intelligence and benchmark data. For example, the repository includes an aggregated facts table named anonymous_fact_groups. We use cautious terminology here because the implementation supports aggregation and de-identification workflows, but not every upstream data source is guaranteed to be irreversibly anonymous in every context.

Norixo uses browser storage where required for product functionality, including localStorage and sessionStorage for guest audit drafts, workspace selection or settings, and pending audit flows. Some authentication or integration flows also rely on cookies or cookie-like browser state for legitimate security purposes.

We do not claim that Norixo uses no cookies at all, and we do not claim the presence of a verified mainstream advertising analytics tracker. We also do not present simulated tools as if they were active analytics processors.

We use reasonable technical and organizational measures to protect the data we process. These include authenticated access, workspace authorization, row-level access controls where appropriate, server-side secret handling, Stripe webhook verification, and request rate limiting for public-facing flows.

No online system can be guaranteed perfectly secure, but we work to reduce risk and to limit access to data on a need-to-know basis.

We do not use a fixed one-size-fits-all retention timer. Instead, we retain personal data only for as long as reasonably necessary for purposes such as providing Norixo, maintaining accounts and workspaces, delivering audits, managing billing and accounting, supporting security and fraud prevention, resolving disputes, and complying with legal obligations.

Where appropriate, data may be deleted or anonymized once it is no longer needed. Some records may need to be retained for longer periods where required by law, accounting rules, fraud-prevention needs, dispute handling, or other legitimate business-record purposes.

Because we rely on third-party service providers, your data may be processed in countries or regions where those providers or their infrastructure operate. We do not claim that all data is stored in a single country or region.

Where cross-border processing requires safeguards under applicable law, we rely on appropriate contractual or organizational measures as needed.

Depending on where you live and which law applies, you may have rights such as access, correction, deletion, portability, objection, restriction, and withdrawal of consent where consent is the applicable legal basis.

At present, Norixo does not provide verified self-service tools for account deletion, personal-data export, objection, restriction, or consent withdrawal. Requests are handled by contact rather than by an automated privacy dashboard.

To exercise a privacy right or ask a question, contact us at support@norixo.io.

Listings can be soft-deleted in the product, and audits can be deleted from the dashboard. Those actions remove items from the active workspace view, but they may not erase every historical record immediately where retention, integrity, or legal requirements apply.

Broader account or data-deletion requests should be made through our contact email above. We will review those requests in light of applicable law and our operational, legal, and accounting obligations.

If you use the backlinks module, Norixo may store contact information, domain information, campaign data, outreach history, delivery events, inbound messages, verification history, notes, and activity records. This operational information can include personal or contact-related data, and it is processed to run the backlink workflow, track status, preserve history, and support delivery and verification behavior.

User-agent information may be stored in the verification system as part of outbound HTTP verification options. This is used for controlled verification behavior rather than visitor tracking.

Norixo is intended for users aged 18 or older. We do not knowingly target children, and the service is not designed for minors.

We may update this Privacy Policy from time to time to reflect changes in our service, our legal obligations, or our data practices. When changes are material, we will update the date at the top of the page and, where appropriate, provide additional notice.

If you have a question, a request, or a privacy concern, contact Norixo at support@norixo.io.

Controller identity: CONCIERGERIE SHORT RENTAL, Moroccan single-member limited liability company (SARL à associé unique / SARLAU), 201 BD MUSTAPHA EL MAANI, 2nd Floor, Apartment 9, Mers Sultan, Casablanca, Morocco.