Your data and Nora

Who is responsible

Nora is a personal project of Igor Rekarte Irastorza, based in Irun (Gipuzkoa, Spain), who is the controller of your data. For any privacy question, write to kaixo@nora.eus.

What data we handle when you message Nora

• Your phone number and WhatsApp profile name, or your Telegram ID and username.
• What you send: messages, voice notes, photos and your location, if you share it.
• Nora’s replies.
• The date and time of each message.

Nora doesn’t ask for health data or any other sensitive data. If you mention a medical appointment or a hospital when asking about a trip, it is only used to answer you and is deleted with the conversation.

Nora only takes the current conversation into account: after 12 hours without messages, it starts from scratch.

We also log which trips are looked up (origin, destination, date and time), without your number or anything that identifies you, to understand what people ask and improve Nora.

What we use it for

• To answer your questions. Legal basis: your own request for the service (Article 6(1)(b) GDPR).
• To review conversations and fix Nora’s mistakes, such as a wrong timetable or a misplaced stop. Legal basis: our legitimate interest in Nora giving correct information (Article 6(1)(f)).
• To prevent abuse, such as mass messaging. Legal basis: legitimate interest (Article 6(1)(f)).
• To show you, at most once every 30 days, a link in case you want to support the project on Ko-fi. We store your number and the date so it isn’t repeated. Legal basis: legitimate interest (Article 6(1)(f)).

We don’t use your data for advertising, we don’t build profiles, and we don’t sell it or hand it to anyone for their own purposes. Nora never messages you on its own: it only replies when you write to it.

Who else handles it

To run Nora we use these providers. They only process data to provide their service to us, except where stated otherwise:

• Hetzner Online (Germany): the server Nora runs on, in Helsinki (Finland).
• OpenRouter (USA): passes each conversation to the AI model that writes the reply.
• DeepInfra (USA) and Microsoft Azure: run that model (DeepSeek). The model is made by DeepSeek, but your messages don’t go to DeepSeek or to China. If both fail, another version of the same model runs on DeepInfra or, as a last resort, Google (Gemini) writes the reply.
• OpenAI (USA): turns your voice notes into text, via OpenRouter.
• Google (USA): describes the photos you send (Gemini) so Nora can understand them, via OpenRouter.
• WhatsApp (Meta) and Telegram: the channel you use to talk to Nora; they handle your data under their own privacy policies.
• Anthropic (USA): Igor uses its assistant, Claude, to review conversations and fix Nora’s mistakes. They reach it without your phone number or your profile name. It is a personal account, so Anthropic processes that data under its own terms, with use for training its models switched off.
• Netlify (USA): hosts this website.
• Gandi (France): the kaixo@nora.eus mailbox.

We have configured the model providers so they don’t use your messages to train their models.

We send your messages to a single AI provider, OpenRouter, which passes them on to the model (DeepInfra, Microsoft, OpenAI or Google). That transfer to the United States relies on the standard contractual clauses approved by the European Commission. Microsoft, Google and Netlify are also certified under the EU–US Data Privacy Framework.

How long we keep it

• Conversations (messages, voice notes, photos and locations), with your number or username: 6 months after your last message.
• Technical server logs (number, date and time of each message, without its content): 3 months.
• The Ko-fi notice (number and date): 6 months.
• The trips looked up, without anything that identifies you: kept for statistics.

Backups do not include conversations.

Your rights

At any time you can ask to see your data, correct or delete it, object to its use, restrict its use or receive it in a format you can take elsewhere. Write to kaixo@nora.eus with your WhatsApp number or Telegram username. To check it’s yours, we may ask you to confirm by messaging Nora from that same number. We will reply within one month at the latest.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es). If you live in another EU country, you can also go to your own country’s data protection authority.

The nora.eus website

• We don’t use tracking or advertising cookies. Visit statistics (Umami, on our own server) don’t store your IP address and don’t identify you.
• If you choose a language, a cookie (nora_lang) is stored to remember it.
• The map loads its images from OpenFreeMap, which receives your IP address.
• The WhatsApp, Telegram, Ko-fi and X buttons take you to those services, which have their own policies.

Children

If you are under 14, use Nora with the permission of your mother, father or guardian.

Changes

If we change anything important, we will say so here and update the date at the top.