Privacy policy

Who is responsible for your data

What's Normal? (whatsnormal.app) is operated by Antonio Nunes, a sole proprietor based at 14604-125 Street, Edmonton, Alberta, Canada. We are the data controller for the personal information described in this notice — meaning we decide what is collected and why.

For any privacy question or request, contact us at northpointdigitalgroup@gmail.com.

What you send us

When you check a document we process its contents to produce an assessment. If you are signed in and choose to save a check, the document and the resulting analysis are stored in a private storage bucket and database rows that only your account can read.

An account is required to receive a result. You can upload or paste a document first, but you will be asked to sign in before the assessment is shown, and the check is then saved to your account.

Location information

Location is optional and free-text. We ask only for country, province/state and city because pricing is regional. We never ask for a street address, and skipping location simply lowers the confidence of the assessment.

Sharing is sanitized

When you share a result we generate a new record containing only the category, the assessment, the score, the amount, the typical range and a short headline. Names, addresses, account numbers, business names, uploaded files and raw document text are never included in a shared link or share image.

Accounts and what we collect

A result is always tied to an account, so we collect your email address and, if you sign in with Google, the basic profile details Google returns. We use this to create your account, save your checks privately, provide support and — if you opt in — send occasional product updates. Your document contents are never used for marketing.

Why we process it, and our legal basis

Account details (email address, sign-in identifiers) and the documents you submit are processed to perform our contract with you — creating your account and producing and storing the assessment you asked for.

Security logs, anonymous product events and basic device information are processed under our legitimate interest in keeping the service secure, preventing abuse and improving how it works.

Product update emails are sent only on the basis of your consent, which you can withdraw at any time.

Where we must keep records for tax, accounting or other legal reasons, we process that data to comply with a legal obligation.

Payments and data sharing

Purchases are processed by Paddle.com, our reseller and Merchant of Record. Paddle collects the billing details needed to take payment, calculate tax and issue invoices, and shares the transaction outcome with us so we can unlock your plan or credits. We never receive or store your card number.

Beyond Paddle we share personal data only with the infrastructure providers that run this service (hosting, database, storage and the analysis provider that produces your assessment), with professional advisers where necessary, and with authorities where the law requires it. We never sell your data.

Marketing and how to opt out

Product update emails are optional. You can turn them on or off at any time from the Account page, or use the unsubscribe link in any email we send. Transactional messages — receipts, password resets and important account notices — are not marketing and are always sent.

Your rights

You can request access to, correction of, export of or deletion of your personal data by contacting us. Where applicable law gives you additional rights — including objecting to processing, restricting it or complaining to a supervisory authority — those rights apply. We respond within one month.

Analytics

We record anonymous product events — such as a check being started or completed — to understand which parts of the flow work. These events are tied to a random session identifier, not to your document contents.

How we keep it secure

We apply appropriate technical and organisational measures to protect your information. Data is encrypted in transit and at rest, uploaded documents live in a private storage bucket that is not publicly reachable, and database access is restricted per account by row-level security so one account can never read another's checks.

Administrative access is limited to the operator of the service and protected by authenticated sign-in. No system is perfectly secure, but we review access and configuration as the product changes.

How long we keep it

Saved checks, their line items and their stored documents are kept until you delete them or close your account. Account records are kept for as long as your account exists. Purchase and tax records are kept for as long as law requires, after which they are deleted or anonymised. Anonymous product events are retained in aggregate and are not linked to your identity.

Some of our infrastructure providers process data outside Canada, including in the United States. Where that happens we rely on providers that offer contractual safeguards for international transfers.

Deletion

Deleting a saved check removes its analysis, its line items and its stored document. You can delete your entire account and everything in it yourself from the Account page, or contact us at northpointdigitalgroup@gmail.com and we will action the request.