Your Data and Privacy

This article explains what data Nolorem stores, where it lives, and how third-party services interact with your content.

What Data Is Stored

• Account data: display name, email, profile photo, password hash, notification preferences, and UI language, and the time you were last active in the app (one timestamp, overwritten on each visit, with no history, removed with your account).
• Organization data: workspace name, team members, roles, and invitations.
• Blog content: posts, drafts, outlines, topics, SEO keywords, generated text, images, and videos.
• Social content: composed and scheduled posts, channel connections, and analytics data.
• Settings: blog settings, Voice DNA profiles, Content Advisor memory, CMS credentials, brand identity, and media style preferences.
• Billing data: subscription status, plan tier, and Stripe customer references. Credit card numbers are stored by Stripe, not by Nolorem.
• Assistant conversations: the messages you exchange with the Content Advisor, kept for 12 months after the last message (see below).
• Text before and after your edits: for each generated text, the version Nolorem wrote and the version you sent or scheduled, kept for 12 months (see below).

Where Your Data Is Hosted

Nolorem's database and application are self-hosted on a virtual private server in Frankfurt, Germany (EU), using a self-hosted Supabase instance (PostgreSQL). File storage for images, avatars, and media also uses Supabase Storage on the same EU server. Your data does not leave the EU except when sent to third-party AI providers for content generation.

AI Provider Data Handling

When you generate content or use the Content Advisor, the minimum required input is sent to these providers:

Provider	Purpose	Data sent
Anthropic	Primary text generation, voice analysis, content advice, language review of generated texts	Topic, outline, writing samples, company profile, Voice DNA settings; and the generated text being reviewed
OpenAI	Three tasks: a rewriting pass on generated blog articles to remove typical AI writing traits, turning texts into searchable fragments (embeddings) for internal links and the repetition check, and fallback for text generation and language review when Anthropic is unavailable	The full generated blog text for the rewriting pass, the text being turned into fragments, and in a fallback the same input as Anthropic
Google	Reserve only: text generation when both Anthropic and OpenAI are unavailable	The same input as Anthropic, only in that case
Fal.ai	AI image generation	Image prompt text derived from your topic and style
Perplexity	Primary research	Search queries derived from your topic
Tavily	Fallback research	Search queries derived from your topic

These providers process your data according to their own privacy policies and terms.

Nolorem also runs its own internal quality measurements on already generated text, sent to the same AI providers already used for content generation on this platform. These measurements only read the text they check, are processed under the provider's API terms, and the result is written only to Nolorem's own internal log, never shared any further.

Who Can Access Your Data

• Your team, based on each member's role.
• Nolorem platform administrators at Bonalogic, for support and maintenance. Conversations with the Content Advisor are the exception: see the section on conversations below.
• No third party beyond the AI providers above, and only for content generation. Your data is not sold or shared.

Conversations With the Content Advisor

Your conversations with the Content Advisor are saved so you can find them again. They are kept for 12 months after the last message and then deleted. In the app only you can see them, not the other members of your workspace and not the administrators of your workspace. You can delete a conversation yourself at any time. Your conversations in a workspace are deleted when you leave that workspace or are removed from it, and they are included in your personal data export.

For each answer the Content Advisor gives, we also keep a technical record of which document passages and data the answer used and what it changed, so that errors can be traced. The content of that record is deleted after 30 days. After that only characteristics without content remain (hashes and counts), for as long as the conversation exists. The record disappears with the conversation or with your organization, and it is included in your personal data export.

Alongside a conversation we keep a short ledger of references and statuses: which proposals you accepted or declined, which suggestion cards were applied, and which figures the assistant already mentioned, so it can notice when a figure has since changed. It holds no copy of your documents and no free text apart from wording you chose yourself. The ledger is kept as long as the conversation (12 months after the last message) and disappears with it or with your organisation, and it is part of your data export.

A Nolorem administrator can view a conversation only to check a complaint or when you ask us to. The administrator chooses a reason from a fixed list, and every view is recorded: who, when, which conversation and the reason. That record is kept for 24 months, even if the conversation is deleted before then, and it also notes whose conversation it was. If your account is deleted, the record no longer names you.

Text Before and After Your Edits

For each text Nolorem generates for you, Nolorem keeps two versions: the text as it was generated and the text as you sent or scheduled it. For a blog article this is kept per section. With the two versions it keeps the channel, the voice profile, the language, the kind of content and which user started the final step.

This is kept to be able to improve your own generations. Whatever can be learned from the edits of an organization serves that organization only. It is never used for other customers and never to train a model, and internal analysis runs only on figures without customer names.

The texts are kept for 12 months. They are deleted earlier as soon as the post or article is definitively deleted, which includes emptying the trash, and when your organization is deleted. A post or article in the trash keeps its texts until it is definitively deleted or until the 12 months are over. A text generated in the social composer that was never saved is deleted after 7 days. The texts are included in the data export of your workspace.

Data Isolation

All data is scoped to your organization. Row-level security policies in the database ensure one organization cannot access another's data, even on shared infrastructure.

That includes what the Content Advisor remembers about you: those facts are stored per person and per workspace. A fact learned in one workspace is never used in another workspace you belong to, and a colleague in your workspace never sees them. You can review and erase them at any time under Settings then Assistant.

Data Deletion

You can delete your account and all associated data at any time, with the process and timeline described on the account page. Your saved conversations with the Content Advisor go with your account.