Privacy Policy

This website (norvan.io) is operated by Norvan Technologies Sdn. Bhd. (Reg. No. 202601022926 / 1685023-U), Suite 20-01 & 20-02B, Level 20, The Pinnacle, Persiaran Lagoon, Bandar Sunway, 47500 Subang Jaya, Selangor Darul Ehsan, Malaysia, together with its affiliated entities Norvan L.L.C-FZ (Dubai, UAE) and Norvan Technologies, Inc. (Miami, USA). In this policy, "Norvan", "we", and "us" refer to these entities.

Questions about this policy or your personal data can be sent to info@norvan.io.

Information you give us. When you take the Intelligence Assessment, request the PDF report, book a call, contact us, apply for a role, or talk to Nexus (our on-site assistant), you may provide your name, work email, company, role, industry, company size, phone number, and the content of your messages. Assessment answers and scores are stored with your request when you ask for the report.

Information collected automatically. Like most websites we record standard technical data: pages visited, referring URL, campaign parameters (UTM), approximate location derived from your IP address, browser and device type, and interaction events used to understand how the site is used.

Cookies and local storage. We use a small number of first-party cookies and browser storage entries to remember your session with Nexus, whether you have dismissed a prompt, and basic analytics state. TODO: legal review — list each cookie, its purpose, and its lifetime.

To deliver what you asked for: your assessment results, the PDF report, a call back, a reply to your enquiry, or a response from Nexus.

To follow up on a genuine business enquiry with relevant information about Norvan Nous and our services. You can ask us to stop at any time.

To operate, secure, and improve the website, and to measure which content is useful.

We do not sell personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

Where the Malaysian Personal Data Protection Act 2010, the UAE Personal Data Protection Law, the GDPR, or similar laws apply, we rely on your consent (for marketing follow-up and non-essential cookies), the performance of a contract or steps taken at your request (for reports, calls, and enquiries), and our legitimate interests in running and improving the site.

TODO: legal review — confirm the applicable regimes and the basis relied on for each processing activity.

Service providers who process data on our behalf: our hosting and database providers, our email delivery provider, our analytics tooling, and the AI model providers that power Nexus (conversation text, and the audio of a voice conversation, is sent to them to generate a reply). Each is bound by a contract that limits use of the data to providing the service.

Within the Norvan group of entities, so that the right team can respond to you.

Where required by law, regulation, or a valid legal process.

Norvan operates from Malaysia, the UAE, and the United States, and our providers may process data in other countries. Where a transfer leaves the jurisdiction the data was collected in, we use recognised safeguards such as standard contractual clauses. TODO: legal review — confirm transfer mechanisms per provider.

Enquiry, assessment, and call-back records are kept for as long as needed to respond to you and for a reasonable period afterwards for follow-up, then deleted or anonymised. Nexus conversations, typed or spoken, are kept in our own platform for quality and safety review and to learn what visitors ask about. Analytics data is retained in aggregated form. TODO: legal review — set specific retention periods.

Depending on where you are, you may have the right to access the personal data we hold about you, to correct it, to ask for it to be deleted, to object to or restrict certain processing, to withdraw consent, and to receive a copy in a portable format. To exercise any of these, email info@norvan.io. We will respond within the period required by the applicable law.

You may also have the right to lodge a complaint with your local data protection authority.

We use technical and organisational measures appropriate to the sensitivity of the data, including encrypted connections, access controls, and separation between client data and platform intelligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Our deployment and data-handling options for clients are described on the Security page.

This site is intended for business use and is not directed at children under 18. We do not knowingly collect data from children.

We may update this policy from time to time. The date at the top shows when it was last changed. Material changes will be highlighted on this page.