Privacy Policy

Last updated: 2026-05-01 · Effective: 2026-05-01

This Policy explains what personal data Noren Up collects, why, who we share it with, and your rights. "We" means Correlate Design GK, the operator of Noren Up.

1. What we collect

Categories of personal data we may collect (using California Consumer Privacy Act categories):

• Identifiers: business name, owner name (if provided), email, postal address, phone number.
• Commercial information: subscription plan, billing history, support correspondence.
• Public business records: Google Maps listings (rating, review count, hours, photos), business directory entries, public domain registration data. We use this to draft your initial preview website.
• Internet/network activity: server request logs (IP, user-agent, requested URL, timestamp) for security, capacity planning, and abuse detection.
• Geolocation: approximate (city / state) inferred from IP. We do not collect precise device GPS.
• Payment data: handled exclusively by Stripe. We see only the last 4 digits of your card, the brand, and expiry month/year. We never see or store the full card number or CVV.

2. Why we use it

• To deliver and maintain the Service you subscribed to.
• To bill you and provide receipts.
• To send transactional email (welcome, payment confirmations, billing failures, scheduled maintenance).
• To send occasional service-update email. You can opt out at any time without losing the Service.
• To detect and prevent fraud and abuse.
• To comply with our legal and tax obligations.

3. Cold outreach (before you become a customer)

If you received an email from us with a preview of your website, we built that preview from publicly available information about your business. We sent the email because we believed our service might be useful to you.

• You can opt out by clicking the unsubscribe link in any email or replying with "stop". We remove your address from our outreach list within 10 business days, as required by the U.S. CAN-SPAM Act.
• We delete cold-outreach prospect data within 24 months if you never become a customer (or sooner on request).
• We do not sell, rent, or share prospect lists with third parties.

4. Subprocessors and service providers

We use the following service providers ("subprocessors") to operate Noren Up. Each has signed a data-processing agreement with us where one is required.

We do not sell or share your personal information for cross-context behavioral advertising.

5. How long we keep data

• Active customers: for the duration of your subscription.
• Former customers: up to 7 years after cancellation for tax, accounting, and legal-claims defense.
• Cold-outreach prospects: up to 24 months from last contact, then deleted (or sooner if you opt out).
• Server logs: 90 days for security and capacity planning.

6. Your rights

Regardless of where you live, you can email hello@noren-up.com to:

• Request a copy of the personal data we hold about you;
• Correct inaccurate data;
• Delete your data (subject to legal retention requirements above);
• Object to or restrict our processing;
• Opt out of marketing email.

We respond within 30 calendar days. We will verify your identity by reply email from the address on file before honoring deletion or copy requests.

California residents (CCPA / CPRA)

You have the right to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information. To exercise these rights, email hello@noren-up.com with the subject line "California Privacy Request". We do not discriminate against users who exercise their rights. We do not sell personal information and we do not share personal information for cross-context behavioral advertising. We do not knowingly collect or sell the personal information of consumers under 16.

"Shine the Light" notice (Cal. Civ. Code §1798.83): California customers may request, once per calendar year, the categories of personal information (if any) we disclosed to third parties for their own direct-marketing purposes during the preceding calendar year, and the names and addresses of those third parties. Email hello@noren-up.com with the subject line "Shine the Light Request". We do not currently disclose personal information to third parties for their own direct marketing.

EU / UK / EEA residents

Our Service is currently directed at U.S. small businesses and non-profits. If you are an EU/UK customer or prospect, we engage with your GDPR / UK GDPR rights on a best-effort basis. We do not yet have a formal Article 27 or UK Representative; we will appoint one when we accept EU/UK customers in volume. Contact hello@noren-up.com for any GDPR request.

7. Security

We use industry-standard practices: HTTPS for all transport, encrypted secrets at rest, principle of least privilege for our staff, no long-lived database credentials in source control, and audit logging on production systems. No system is perfectly secure; if we discover a breach affecting your personal data, we will notify you within 72 hours and report to applicable regulators where required.

8. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

9. Cookies and tracking

The Noren Up dashboard uses a single first-party cookie for authentication. Customer-facing websites we host do not run third-party advertising trackers by default. If you ask us to add Google Analytics, Meta Pixel, or similar to your site, we will add a cookie banner and disclose the change here.

10. Changes

We will email you at least 30 days before any material change to this Policy. The current effective date is shown at the top.

11. Contact

Correlate Design GK
2-22-20 Hakusan, Bunkyo-ku, Tokyo 112-0001, Japan
hello@noren-up.com

Plain English summary: We collect what we need to run your site and bill you. We never sell your data. We use Stripe for payments, Cloudflare for hosting, Anthropic for AI drafting, and Resend / Instantly for email. You can ask to see, correct, or delete your data any time.