Privacy Policy

Last updated: October 2026

This is the English version of our Datenschutzerklärung. It is a convenience translation: the German text is the legally binding version.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ali Hariri Movahed Am Spick 8, 40668 Meerbusch, Germany Email: ali@noboru.ai Phone: +49 176 70904603

2. General information on data processing

We process the personal data of our users only to the extent necessary to provide a working website and our content and services. Personal data is any information relating to an identified or identifiable natural person.

3. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. The domain is provided by GoDaddy.com, LLC. When you open the website, these providers process technically necessary data (in particular the server log files described in section 4).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and efficient delivery of the website. We have concluded, or are concluding, data processing agreements with the providers under Art. 28 GDPR.

Data is transferred to the USA. This is based on the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR) or, where the provider is certified, on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR). We point out that the USA cannot be guaranteed a level of data protection fully comparable to European law.

4. Provision of the website and server log files

Each time the website is opened, the system automatically records data about the accessing device: IP address, date and time of access, page or file requested, amount of data transferred, browser type and version, operating system and referrer URL.

This processing serves to deliver the website and to ensure the security and stability of our systems. The legal basis is Art. 6(1)(f) GDPR. Log files are stored for security reasons and deleted after 30 days at the latest.

5. Contact and waitlist

On our website you can sign up for a waitlist or contact us using a form. The data you enter, in particular your email address and, if you choose to give one, a website URL, is transmitted to us and stored. To document your consent we also store the time the form was submitted.

Waitlist data is transmitted and processed by our service provider Resend (Plus Five Five, Inc., USA), which we use as a processor under Art. 28 GDPR; this also involves a transfer to the USA on the basis of the safeguards named in section 3.

The legal basis for the processing is:

for an enquiry made in the context of a (pre-)contractual relationship, Art. 6(1)(b) GDPR;
otherwise your consent under Art. 6(1)(a) GDPR, which you give by ticking the box and submitting the form and which you can withdraw at any time with effect for the future.

The data is deleted as soon as it is no longer needed for the purpose for which it was collected, at the latest when you withdraw your consent or when the waitlist phase ends, unless statutory retention obligations apply.

6. Audience measurement (Vercel Web Analytics)

To analyse how the website is used we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. It works without cookies and without storing identifiers across devices; no data is collected that would allow individual visitors to be identified. Only aggregated, non-personal usage data is recorded (for example pages viewed, approximate region of origin at country level, device type). Because no information on the end device is accessed within the meaning of section 25 TDDDG, no consent is required. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is designing and improving our website to meet demand.

7. Use of the web app (app.noboru.ai)

Customers use Noboru through the web app. Sign-in and user accounts are managed by Clerk, Inc. (USA). To maintain a customer’s website we process, on the customer’s behalf, the content of their website and the approvals and feedback of their users; the data processing agreement (in German) applies to this. The service providers we use, their tasks and the basis for any transfer to third countries are listed in section 9. The legal basis is Art. 6(1)(b) GDPR (contract) and, for security and error analysis, Art. 6(1)(f) GDPR.

8. Chat channels: Slack, WhatsApp and Telegram (optional)

Customers can connect Slack, WhatsApp Business or Telegram to Noboru. Noboru then sends messages through that channel (for example that a change needs approval, that a change went live, a weekly report), and the customer can approve, reject or undo changes, ask for a report or ask for work in plain words by replying. Using a channel is voluntary: everything is also available in the web app.

What we process when a channel is connected:

the account identifier on that channel: the Slack user and workspace identifiers, the WhatsApp phone number and, if WhatsApp provides it, the profile name, or the Telegram user identifier and first name;
the messages you send to Noboru (commands, replies, notes on a rejection and instructions in your own words) and the messages Noboru sends you (titles and short summaries of proposed changes, status and the weekly report);
when you last wrote to Noboru, which WhatsApp requires us to know because it allows free-form messages only within 24 hours of your last message;
which channel a decision came from, stored with the decision so that every change remains traceable;
for Slack, the access token of the connected workspace, which we store encrypted.

We link a chat account only after a one-time code created in the signed-in app is sent from that account. You can disconnect at any time in the app under Settings or by sending disconnect in the chat; Noboru then stops messaging you. We do not send passwords, access tokens or payment data through chat channels. Instructions you send in your own words are processed by the AI provider named in section 9 to prepare a proposal, and a proposal is never published without approval unless you have turned on autopilot.

The purpose is to provide the contracted service; the legal basis is Art. 6(1)(b) GDPR and, for security and abuse prevention (for example rate limits), Art. 6(1)(f) GDPR. We keep the link to your chat account until you disconnect it and the technical record of a disconnected link until you ask us to delete it, and we keep a decision and its note for as long as the customer’s account exists.

The providers of the channels process messages under their own terms and privacy policies, as the operators of the services you chose to use. They are listed in section 9 with the basis for any transfer to third countries. Telegram’s provider is based outside the EU, and you should consider this before connecting Telegram; use Slack, WhatsApp or the web app if you prefer.

9. Service providers

The following services receive personal data. Services marked optional are used only if the customer connects them.

Vercel

Provider: Vercel Inc., USA
Purpose: Hosting of this website and the web app app.noboru.ai, server log files, cookie-free audience measurement (Vercel Web Analytics, Speed Insights).
Data: IP address, time, requested URL, browser, operating system, referrer; in the app also the content shown.
Legal basis: Art. 6(1)(f) GDPR; in the app Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Railway

Provider: Railway Corporation, USA
Purpose: Operation of the backend (API, background jobs) and the database.
Data: Account and contract data, content of the customer's website, change proposals, approvals and feedback, encrypted credentials, technical logs.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Cloudflare R2

Provider: Cloudflare, Inc., USA
Purpose: Object storage for page snapshots, before-states of changes and reports.
Data: Content and screenshots of the customer's website, which may contain personal data.
Legal basis: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Anthropic

Provider: Anthropic, PBC, USA
Purpose: AI models (Claude) that analyse the content of the customer's website and propose changes. Under the provider's contract terms, inputs are not used to train its models.
Data: Content of the customer's website, instructions and feedback from users.
Legal basis: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Voyage AI

Provider: Voyage AI (MongoDB, Inc.), USA
Purpose: Computing text embeddings so that a customer's earlier decisions and preferences can be found again.
Data: Text excerpts of the customer's website, feedback from users.
Legal basis: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Resend

Provider: Plus Five Five, Inc., USA
Purpose: Sending email: waitlist confirmations, notifications and reports from the app.
Data: Email address, name, content of the email, delivery status.
Legal basis: Waitlist: Art. 6(1)(a) GDPR; customers: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Clerk

Provider: Clerk, Inc., USA
Purpose: Sign-in, user accounts and organisations in the app, session management.
Data: Name, email address, sign-in data, IP address, browser and session data.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Sentry

Provider: Functional Software, Inc., USA
Purpose: Detecting and analysing technical errors.
Data: Technical error reports. Credentials and secrets are removed before transmission and identifiers are pseudonymised.
Legal basis: Art. 6(1)(f) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

Langfuse

Provider: Langfuse GmbH, Germany
Purpose: Logging the AI agent's runs for quality assurance and troubleshooting.
Data: Inputs and outputs of the AI models, i.e. content of the customer's website and feedback from users.
Legal basis: Art. 6(1)(b) and (f) GDPR.
Third country: No transfer to a third country (data centre in the EU).

Firecrawl

Provider: SideGuide Technologies, Inc., USA
Purpose: Fetching publicly accessible pages of the customer's website and of comparison sites, for example to check for broken links.
Data: Publicly accessible page content.
Legal basis: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

SE Ranking

Provider: Seranking Ltd. / SER Acquisition Inc.
Purpose: Keyword, ranking and backlink data for the customer's website.
Data: Domain and search terms; as a rule no personal data.
Legal basis: Art. 6(1)(b) GDPR.
Third country: Provider based outside the EU. Basis: EU standard contractual clauses (Art. 46(2)(c) GDPR).

Google Search Console

Provider: Google Ireland Limited, Ireland
Purpose: Retrieving search performance data and verifying the customer's website, after the customer has granted access.
Data: Aggregated search queries, clicks and impressions, identifier of the Google account that granted access.
Legal basis: Art. 6(1)(b) GDPR.
Third country: Transfer to Google LLC, USA, possible. Basis: EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Microsoft Bing Webmaster Tools

Provider: Microsoft Ireland Operations Limited, Ireland
Purpose: Retrieving search performance data for the customer's website, after the customer has granted access.
Data: Aggregated search queries, clicks and impressions.
Legal basis: Art. 6(1)(b) GDPR.
Third country: Transfer to Microsoft Corporation, USA, possible. Basis: EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Slack (optional)

Provider: Slack Technologies, Salesforce group
Purpose: Optional chat channel: notifications, approvals and requests by Slack, when the customer connects Slack.
Data: Slack user and workspace identifiers, messages to Noboru, messages from Noboru (titles and short summaries of change proposals, status, weekly report).
Legal basis: Art. 6(1)(b) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

WhatsApp Business (optional)

Provider: WhatsApp Ireland Limited, Ireland
Purpose: Optional chat channel: notifications, approvals and requests by WhatsApp, when the customer connects WhatsApp.
Data: Phone number and, where WhatsApp provides it, profile name, messages to Noboru, messages from Noboru (titles and short summaries of change proposals, status, weekly report).
Legal basis: Art. 6(1)(b) GDPR.
Third country: Transfer to WhatsApp LLC and Meta Platforms, Inc., USA, possible. Basis: EU-U.S. Data Privacy Framework (Art. 45 GDPR) or other safeguards under Art. 46 GDPR.

Telegram (optional)

Provider: Telegram Messenger Inc. and group companies outside the EU
Purpose: Optional chat channel: notifications, approvals and requests by Telegram, when the customer connects Telegram.
Data: Telegram user identifier and first name, messages to Noboru, messages from Noboru (titles and short summaries of change proposals, status, weekly report).
Legal basis: Art. 6(1)(b) GDPR.
Third country: The provider is based outside the EU; for group companies outside the EU it names EU standard contractual clauses as its basis. See Telegram's privacy policy for details. Using this channel is optional.

Stripe

Provider: Stripe Payments Europe, Limited, Ireland
Purpose: Payment processing, subscriptions and invoices.
Data: Company and billing data, email address, payment data (card and account data are processed by Stripe only).
Legal basis: Art. 6(1)(b) and (c) GDPR.
Third country: Transfer to Stripe, Inc., USA, possible. Basis: EU-U.S. Data Privacy Framework (Art. 45 GDPR) or EU standard contractual clauses.

Calendly

Provider: Calendly LLC, USA
Purpose: Booking onboarding calls. Calendly is only opened when you click a corresponding link.
Data: Name, email address, chosen time, details in the booking form; when calendly.com is opened, also technical connection data.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures).
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

GoDaddy

Provider: GoDaddy.com, LLC, USA
Purpose: Registration of the domain noboru.ai and name resolution (DNS).
Data: DNS requests, including the IP address of the requesting server.
Legal basis: Art. 6(1)(f) GDPR.
Third country: USA. Basis: adequacy decision under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise EU standard contractual clauses (Art. 46(2)(c) GDPR).

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR). You can withdraw a consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany.

To exercise your rights, email the controller named in section 1 or contact@noboru.ai.

11. Currentness

This privacy policy is current as of October 2026. As our website develops, it may become necessary to amend it.