Privacy

What we collect

If you join the waitlist or create an account, we collect your email address and any optional details you choose to share, such as role, company, market, and notes. Inside the app, Norma stores the workflow data you create, including transactions, tasks, dates, documents, contacts, templates, notes, and settings.

How we use it

We use this information to provide Norma, contact you about early access or support, prioritize onboarding cohorts, improve the product roadmap, and help you coordinate real estate transaction work.

What we don’t do

We do not sell your personal information or connected Google user data. We do not use Google user data for advertising, and we do not allow humans to read connected email or workspace content unless needed for security, legal compliance, or support you request.

Email

We send occasional product updates related to the waitlist and early access. You can opt out at any time.

Microsoft 365 and Outlook data (when you connect)

If you connect Microsoft 365 or Outlook, Norma requests access only after you grant consent through Microsoft. Norma may access your profile and email address; Outlook messages, folders, threads, sender and recipient details, snippets, message bodies, attachments, read status, categories, drafts, and sending actions; Outlook Calendar events; Microsoft To Do tasks; and Outlook Contacts needed for transaction coordination.

Norma uses this data to show relevant inbox and thread context, link email to transactions, create or send user-directed emails, organize mailbox work, read transaction-related calendar context, read task items, and use contacts selected for transaction communication. Norma stores OAuth tokens and selected workflow records needed to keep the connection active and provide the app. Full Outlook message content and attachments are fetched as needed for user-facing features.

Google Calendar data (when you connect)

If you connect Google Calendar, Norma requests access only after you grant consent through Google. Norma accesses your Google Calendar events needed for transaction coordination.

Norma uses this data to read transaction-related calendar context and to create or update transaction key-date events. Norma stores OAuth tokens and selected workflow records needed to keep the connection active and provide the app.

Google API Limited Use

Norma's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Norma uses Google user data only to provide or improve user-facing features that are visible and prominent in the app. Norma does not transfer Google user data to third parties except as necessary to provide or secure the service, comply with law, or with your consent.

How we protect sensitive data

We protect sensitive data, including Google user data, with security procedures designed to preserve the confidentiality and integrity of your information. Norma uses HTTPS/TLS for data transmitted between your browser, Norma, and connected service providers. Application records are stored in managed database and hosting infrastructure that documents encryption at rest and in transit, including Supabase/Postgres and Vercel infrastructure used by Norma.

OAuth tokens and connected workspace records are stored only as needed to provide the connected features you enable. Norma also applies application-level encryption to stored OAuth tokens and integration secrets used for connected provider features, including Microsoft, Google, DocuSign, Airtable, and Jotform. App access requires an authenticated session, and user data requests are scoped to the authenticated user wherever Norma reads or changes connected workspace records. Access to production systems and sensitive user data is limited to authorized personnel with a legitimate business need, such as security, legal compliance, or support you request. We use account authentication, user-scoped access checks, operational logging, monitoring, and retention limits to reduce the risk of unauthorized access, disclosure, alteration, or loss.

Disconnecting Google Calendar

You can disconnect Google Calendar from Norma in the app settings or revoke access from your Google Account permissions page. If you ask us to remove your account or connected data, we will delete or de-identify data we are not required to retain for security, legal, or operational reasons.

Questions

If you have questions or would like your information removed, reply to any email you receive from Norma or contact the support email listed on the Google OAuth consent screen.