Privacy policy
What NorminUp keeps about you, why, for how long, and how to get it back or have it deleted.
Last updated: October 24, 2026
This English version is a translation provided for convenience. The French version is the one that applies.
Who is responsible for your data
The data controller is Yann Beaucousin Negelin, sole trader, reachable at contact@norminup.com.
For a status page’s subscribers, the customer who publishes the page decides how their data is used. NorminUp then acts on their behalf, as a processor.
The data kept and for how long
| Data | Why | How long |
|---|---|---|
| Account: username, e-mail, hashed password (never in plain text), preferences, and what you add to your profile (photo, job title, phone, links) | Signing you in and writing to you | As long as the account exists |
| Open sessions: device, browser, IP address | Showing your sessions so you can close them | Deleted after 30 days of inactivity |
| Sign-in history: IP address, browser, success or failure | Spotting a suspicious sign-in | 90 days |
| Results of your services’ checks | Alerts, history, status pages | 90 days |
| Activity log: actions taken on the account, IP address | Security and team follow-up | 90 days |
| Exports you generate | Sending them to you | 7 days |
| Contact form messages: name, e-mail, message | Answering you | Received by e-mail, never stored in the database |
| Status page subscribers: e-mail | Notifying them of incidents, after confirmation through a link | Until they unsubscribe, in one click from any e-mail |
| Billing: invoices, plan subscribed | Accounting obligations | 10 years, as French law requires |
| Company of the organization: legal name, country, identifier (SIREN, SIRET, EU VAT or registration number), result and date of the check | Keeping paid plans for businesses and printing the legal name on invoices | As long as the organization exists; the one on issued invoices, 10 years with them |
| Request for the free Pro (open source project or non-profit): name, address and description of the project, optional reference, the team's decision and note | Reviewing the request and following the granted offer | As long as the organization exists |
| Audience of the public site, without cookies: page viewed, where the visit comes from (ad campaign or referring site), country, kind of device; to count visitors, a fingerprint of the IP address and browser, mixed with a random value drawn every day | Knowing which pages and campaigns bring people, without following you from one day to the next | Only daily totals are kept, 13 months; the fingerprint is never stored in the database and disappears within 2 days |
| Sign-ups per campaign: one counter per day and campaign (or referring site), with no link to the account created | Knowing which campaigns bring sign-ups | Only daily totals are kept, 13 months |
| Telegram chat linked to NorminUp’s bot: its id and name (the group’s, or your name for a private chat) | Sending the organization’s alerts there | Until you disconnect it, or as soon as the bot is removed from the chat |
NorminUp never sees your card number: payment happens at Stripe.
The legal basis of each processing
- The contract: account, checks, alerts, status pages.
- Legitimate interest: account security, fighting fraud and abuse, fixing technical errors.
- A legal obligation: keeping invoices.
- Consent: subscribing to a status page’s alerts, confirmed by e-mail.
Service providers
Only these providers receive data, and only what they need:
- OVH (France): hosting of the servers and the database.
- Stripe: subscription payments.
- Cloudflare: protecting the site against attacks, and the anti-bot check at sign-up and sign-in.
- Annuaire des entreprises (French State) and VIES (European Commission): checking the identifier of the company subscribing to a paid plan; only that identifier is sent to them.
- Discord: internal notifications to the NorminUp team (new organization, company to check).
E-mails (alerts, account messages) are sent from our own mail server, with no third-party provider. If your organization sets up its own sending server, e-mails to your subscribers go through it.
Stripe, Cloudflare and Discord may process data outside the European Union. These transfers rely on the safeguards provided by the GDPR (the European Commission’s standard contractual clauses or the Data Privacy Framework).
Alerts you send to Discord, Slack, Telegram or a webhook go to those services at your request, with what you configured. On Telegram, they go through NorminUp’s bot, or yours if you set one up.
Your data is never sold, rented or used for advertising.
Security
- All traffic goes over HTTPS.
- Passwords are hashed with bcrypt.
- The session cookie cannot be read by the page’s scripts.
- Two-factor authentication is available in your profile.
- The database is backed up every night.
Your rights
You can access your data, correct it, delete it, get a copy of it, object to a processing or ask for it to be restricted. Most of these requests can be handled directly from your profile:
- edit your details and your e-mail address;
- download a copy of your data (JSON or PDF report);
- view your sign-in history and close your open sessions;
- delete your account.
To exercise another right, write to contact@norminup.com. You will get an answer within one month at most.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
Changes to this policy
The date at the top of the page shows the latest version. A significant change is announced to customers by e-mail before it takes effect.
A question about this document? Write to me at contact@norminup.com