Privacy Policy

Last updated: August 19, 2026

1. Scope

This Privacy Policy explains how Normal Computing Corporation ("Normal," "we," "our," or "us") collects, uses, discloses, and protects personal information when you:

Visit normalcomputing.com or another Normal website where this Policy is posted;
Contact us, request information, subscribe to communications, or submit a website form; or
Interact with us in a professional or business context.

Normal Computing Corporation is the controller or business responsible for the personal information covered by this Policy unless a supplemental notice identifies another Normal entity.

This Policy does not apply to:

Personal information submitted or otherwise processed in connection with employment opportunities at Normal, which is covered by our separate Applicant Privacy Notice, available at normalcomputing.com/applicant-privacy-notice and linked from our careers site;
Personal information we process solely on behalf of enterprise customers under their instructions, which is governed by our agreements with those customers; or
Personal information about current employees, which is governed by applicable workforce notices.

"Personal information" includes "personal data" and similar terms under applicable privacy laws.

2. Personal Information We Collect

The information we collect depends on how you interact with us.

Information you provide

We may collect:

Contact and professional information, such as your name, business email address, telephone number, employer, job title, and professional profile;
Communications, including messages, inquiries, feedback, form submissions, attachments, and records of our correspondence;
Marketing preferences, including newsletter subscriptions and communication choices; and
Business relationship information, such as the organization you represent, your areas of interest, meeting details, and information relevant to a potential or existing relationship with Normal.

If a form identifies certain information as required, we need that information to respond to or fulfill your request. Other information is optional.

Information collected automatically

When you use our websites, we and providers acting on our behalf may collect:

IP address and approximate location derived from it;
Browser, operating system, device, and language information;
Pages viewed, links selected, referring and exit pages, and timestamps;
Cookie identifiers and similar technical identifiers; and
Information about website performance, errors, security events, and interactions.

Information from other sources

We may receive information from:

Affiliates and personnel within Normal;
Event organizers, business partners, and organizations with which you are affiliated;
Publicly available professional sources; and
Providers supporting website operations, analytics, security, communications, and business relationship management.

We may combine information received from these sources with information you provide directly.

3. How and Why We Use Personal Information

We may use personal information to:

Operate, maintain, troubleshoot, and secure our websites and systems;
Respond to inquiries and provide requested information;
Manage existing and prospective business relationships;
Send newsletters, event invitations, and other communications, subject to applicable consent and opt-out requirements;
Understand website use and improve our content, performance, and user experience;
Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;
Establish, exercise, or defend legal claims;
Comply with legal, regulatory, tax, recordkeeping, and reporting obligations; and
Evaluate or complete a corporate transaction, such as a financing, merger, reorganization, or sale of assets.

Artificial intelligence and model training

We do not use personal information covered by this Policy to train machine learning or artificial intelligence models.

EEA and UK lawful bases

Where the European Union General Data Protection Regulation or UK General Data Protection Regulation applies, we rely on one or more of the following lawful bases:

Consent, such as for certain marketing communications and non-essential cookies;
Steps requested before entering a contract, including responding to certain business inquiries;
Performance of a contract;
Legitimate interests, including operating and securing our websites, responding to inquiries, maintaining business relationships, and improving our communications;
Compliance with legal obligations; and
Establishing, exercising, or defending legal claims.

When we rely on legitimate interests, we consider the nature of the information, the expected benefits, and the potential effect on individuals. We do not rely on those interests where they are overridden by your rights and interests.

You may contact us for additional information about the lawful basis applicable to a particular activity.

4. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

Affiliates and personnel, where access is reasonably necessary for business operations, security, legal compliance, or relationship management;
Service providers and contractors supporting cloud hosting, website operations, forms, analytics, communications, customer relationship management, document storage, and cybersecurity;
Professional advisers, including lawyers, accountants, auditors, insurers, and consultants;
Government bodies, regulators, courts, or other parties when disclosure is required by law or reasonably necessary to protect rights, safety, or security;
Transaction participants, such as potential investors, purchasers, lenders, and advisers involved in a financing, merger, acquisition, reorganization, or sale of assets; and
Other recipients at your direction or with your authorization.

Where a provider processes personal information on our behalf, we use contractual protections appropriate to its role and the information involved. A recipient acting as an independent controller is responsible for its own processing under its privacy notice.

5. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

Strictly necessary technologies, which support core functionality, security, network management, and services you request;
Functional technologies, which remember settings and preferences; and
Analytics and performance technologies, which help us understand website use, diagnose problems, and improve performance.

Google Analytics

We use Google Analytics, provided by Google, to understand how visitors interact with our websites. Google Analytics uses cookies and similar technologies to collect information such as pages viewed, interactions, approximate geographic location, and browser and device information. Google Analytics also receives an IP address when data is collected, although Google states that it does not log or store IP addresses in Google Analytics.

We use Google Analytics reports to measure website traffic and engagement, understand how our content is used, diagnose performance issues, and improve our websites.

You can limit Google Analytics through your browser controls or by using the Google Analytics Opt-out Browser Add-on. Information about how Google processes information from sites that use its services is available in Google's privacy materials.

You can manage cookies through your browser settings. Most browsers allow you to block or delete cookies or receive a warning before a cookie is stored. Browser controls vary, and blocking some technologies may affect website functionality.

6. Sale, Sharing, and Targeted Advertising

Normal does not sell personal information for money or other valuable consideration. Normal also does not share personal information for cross-context behavioral advertising or process it for targeted advertising as those terms are defined under applicable US state privacy laws.

During the preceding 12 months, Normal has not sold or shared personal information as those terms are defined by the California Consumer Privacy Act.

Where legally required, we recognize qualifying universal opt-out preference signals, such as Global Privacy Control, as requests to opt out of sale, sharing, or targeted advertising. Because Normal does not currently engage in those activities, there is no additional advertising opt-out to apply.

7. International Transfers

Normal is headquartered in the United States and operates internationally. Personal information may be transferred to and processed in the United States and other countries where Normal or its providers operate. Those countries may have privacy laws that differ from the laws where you live.

Where required for transfers from the European Economic Area, United Kingdom, or Switzerland, we use an applicable safeguard such as:

An adequacy decision;
The European Commission's Standard Contractual Clauses;
The UK International Data Transfer Agreement;
The UK Addendum to the European Commission's Standard Contractual Clauses; or
Another transfer mechanism permitted by applicable law.

You may contact us for more information about the safeguard used for a particular transfer and, where available, to request a copy subject to appropriate redactions.

8. Retention

We retain personal information only for the period reasonably necessary for the purposes described in this Policy, including legal, accounting, security, and dispute-resolution requirements.

Our standard retention approach is:

RecordStandard retention period or criterionWebsite inquiries and business communicationsThree years after the last substantive interaction, unless an active relationship or legal requirement justifies a longer periodMarketing recordsUntil you unsubscribe or after 24 months without meaningful engagement, whichever occurs first; a limited suppression record may be retained to honor your choiceSecurity and operational logsNormally up to 12 months, unless needed to investigate an incident or comply with lawCookie and analytics dataAccording to the retention settings configured for the relevant technology and no longer than reasonably necessary for its stated purpose

We may retain information longer when reasonably necessary for a legal hold, investigation, dispute, or statutory requirement. We may delete information earlier when it is no longer needed. When a retention period ends, we delete, anonymize, or securely isolate the information as appropriate.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

No transmission or storage system is completely secure. We therefore cannot guarantee absolute security.

10. Your Privacy Rights

Your rights depend on your location and are subject to applicable exceptions.

EEA and UK rights

If the European Union or UK data protection regimes apply, you may have the right to:

Obtain confirmation of whether we process your personal data and access a copy;
Correct inaccurate or incomplete personal data;
Request deletion of personal data;
Restrict processing;
Object to processing based on legitimate interests;
Object at any time to direct marketing;
Receive certain personal data in a structured, commonly used, machine-readable format and transmit it to another organization; and
Withdraw consent at any time, without affecting earlier lawful processing.

US state privacy rights

Depending on your state of residence and whether the relevant law applies to Normal, you may have the right to:

Confirm whether we process your personal information;
Access or obtain a portable copy of personal information;
Correct inaccuracies;
Request deletion;
Opt out of sale, sharing, targeted advertising, or qualifying profiling;
Limit certain uses of sensitive personal information;
Use an authorized agent; and
Appeal a decision concerning your request.

We will not unlawfully discriminate against you for exercising a privacy right.

Exercising your rights

To submit a privacy request, email legal@normalcomputing.com and describe your request and the relationship through which Normal received your information.

We may need to verify your identity before completing the request. We will use verification information only for that purpose. An authorized agent may submit a request where permitted by law, although we may request evidence of the agent's authority and ask you to verify your identity directly.

We respond within the period required by applicable law. This is ordinarily one month under the EEA and UK regimes and 45 days under many US state laws, subject to permitted extensions.

If we deny a request and your state provides an appeal right, you may appeal by replying to our decision or emailing us with "Privacy Request Appeal" in the subject line.

11. California Disclosures

The following table describes the categories of personal information Normal may have collected through its websites and business interactions during the preceding 12 months:

CategoryExamples and sourcesPurposesRecipient categoriesIdentifiers and contact informationName, email address, telephone number, IP address, and professional profile, provided by you or obtained from professional sources, business partners, or devicesCommunications, business relationships, website operations, and securityAffiliates, personnel, hosting and communications providers, advisers, and authorities where requiredProfessional and business informationEmployer, job title, business interests, meeting information, and professional background, provided by you or obtained from professional sources or business partnersResponding to requests, maintaining relationships, communications, and recordkeepingAffiliates, personnel, relationship-management and communications providers, and advisersCommunicationsMessages, forms, attachments, and records of correspondence, primarily provided by youResponding to requests, relationship management, legal compliance, and recordkeepingAffiliates, personnel, communications and document-storage providers, and advisersInternet and electronic activityBrowser, device, pages viewed, interactions, referring pages, timestamps, and cookie identifiers, collected automaticallyWebsite operation, analytics, performance, and securityHosting, analytics, and security providersApproximate geolocationGeneral location inferred from an IP addressSecurity, localization, and analyticsHosting, analytics, and security providers

The sources, business purposes, and recipient categories are described further in Sections 2 through 4. Retention periods and criteria are described in Section 8.

We do not provide financial incentives in exchange for personal information.

12. Children's Privacy

Our websites are not directed to children under 16, and we do not knowingly collect personal information from children under 16 through them.

If you believe a child has provided personal information to us inappropriately, contact us at legal@normalcomputing.com. We will investigate and delete the information where appropriate.

13. Third-Party Sites and Services

Our websites may link to websites or services operated by other organizations. A third party's privacy notice applies when that organization processes personal information for its own purposes. We are not responsible for the privacy practices of independent third parties.

14. Changes to this Policy

We may update this Policy to reflect changes in our practices, technology, or legal obligations. We will post the updated version and revise the "Last updated" date.

If a change materially affects how we use previously collected personal information, we will provide any additional notice or obtain any consent required by law.

15. Contact and Complaints

For privacy questions, requests, or complaints, contact:

Normal Computing Corporation
Attn: Legal and Privacy
27 W 20th Street, Suite 900
New York, NY 10011
United States
legal@normalcomputing.com

If you submit a UK data-protection complaint, we will acknowledge it within 30 days. We will take appropriate steps to investigate it, keep you informed where appropriate, and communicate the outcome without undue delay.

If you are in the EEA or UK, you may also complain to the data-protection authority where you live, work, or believe an infringement occurred. In the UK, this is the Information Commissioner's Office. Contacting Normal first is not a condition of making a complaint to an authority.

‍