Privacy Notice
Last updated: 2 October 2026
Nortamy helps organisations understand where friction in everyday work consumes employee time and creates avoidable effort.
This Privacy Notice explains how personal information is handled when you visit the Nortamy website, contact us, use a Nortamy account, or participate in a Nortamy Scan.
1. Who we are
Nortamy is currently operated in the United Kingdom.
For questions about this Privacy Notice or how personal information is handled, contact:
hello@nortamy.com
We may update the legal and contact information in this notice as Nortamy develops.
2. Information we collect
The information we process depends on how you interact with Nortamy.
Website and pilot enquiries
If you request a Nortamy pilot, we may collect:
your name;
work email address;
organisation;
role or job title;
organisation size; and
any information you choose to include in your enquiry.
We use this information to review and respond to your enquiry and to communicate with you about a potential Nortamy pilot.
Nortamy account holders
If you create or use a Nortamy account, we process information required to provide and administer that account. This can include your email address, name, organisation membership, role and information relating to your use and administration of Nortamy Scans.
Employees participating in a Nortamy Scan
Nortamy Scans are designed to understand work, not to assess individual employees.
Employees do not need to create a Nortamy account to complete a Scan, and the Scan does not ask employees to provide their name or email address.
Scan responses may include:
department;
structured answers about work activities and work friction;
frequency and time information;
frustration, business impact and other diagnostic responses;
free-text descriptions of work, processes and potential improvements; and
information about additional areas of work friction.
Although Nortamy does not ask employees to identify themselves in Scan responses, information entered into free-text fields could potentially contain information that identifies an individual. Participants should avoid including names or other identifying information in their responses.
3. How we use information
We may use information to:
provide and operate Nortamy;
administer customer accounts and organisations;
create, manage and analyse Nortamy Scans;
identify recurring work-friction themes and patterns;
produce aggregated Executive Reports;
respond to pilot enquiries and other communications;
maintain the reliability and security of the service; and
comply with applicable legal obligations.
Nortamy is designed to analyse work rather than workers. We do not use Scan responses to provide individual employee performance scores.
4. How Nortamy Scan responses are handled
Employee Scan responses are collected without requiring an employee account.
Customer users do not receive direct access to individual raw employee responses through the Nortamy application. Instead, Nortamy uses responses to produce aggregated analysis and Executive Reports.
Department-level reporting includes safeguards intended to reduce the risk of identifying individuals in very small groups.
Nortamy is designed to minimise the employee-identifying information collected through a Scan. However, no system relying on free-text responses can guarantee that participants will never enter identifying information. Participants should therefore avoid including names or other information that could identify themselves or another person.
5. AI-assisted analysis
Nortamy uses an AI service provided by OpenAI as part of the thematic analysis of Scan responses.
Selected Scan response information may be sent to OpenAI for this purpose, including department, structured information about work friction, and relevant free-text responses.
Nortamy does not send the organisation name, Scan name, customer email address, customer account details or employee submission timestamp to OpenAI as part of this thematic-analysis request.
Nortamy configures these analysis requests not to be stored by the OpenAI API for this purpose.
AI-generated thematic analysis is subsequently validated and used as part of the Nortamy Executive Report.
6. Service providers
Nortamy uses specialist technology providers to operate the service. Depending on how you interact with Nortamy, these providers may process information on our behalf or as part of providing their services.
Current technology providers include services used for:
website and application hosting;
database and authentication infrastructure;
AI-assisted analysis;
email and communications; and
website forms.
This includes providers such as Supabase, OpenAI, Lovable, Cloudflare, Framer and our email service providers where relevant.
We do not sell employee Scan responses or customer personal information to advertisers.
7. Cookies, browser storage and analytics
The Nortamy application uses browser storage where necessary to support functions such as account sessions and saving an unfinished Scan response on the participant’s device.
At the date of this notice, the Nortamy application does not use advertising trackers or marketing analytics.
The public website and third-party services used to deliver it may use technologies necessary to operate and secure their services.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes for which it is being processed, including providing the Nortamy service, supporting pilot activity, responding to enquiries and meeting applicable legal or operational requirements.
Nortamy is developing its formal retention and deletion procedures as the service progresses through its pilot stage.
If you would like to ask about the retention or deletion of information relating to you or your organisation, contact hello@nortamy.com.
9. Security and access
Nortamy uses technical controls intended to restrict customer information to authorised users of the relevant organisation.
Access within an organisation is controlled through account roles and permissions.
Raw employee Scan responses are not made directly available to customer users through the Nortamy application.
No internet-based service can guarantee absolute security, but we take reasonable steps to protect the information processed through Nortamy.
10. International processing
Some of the technology providers used to operate Nortamy may process information outside the United Kingdom.
Where applicable, we will take appropriate steps to ensure that international transfers of personal information are handled in accordance with applicable data-protection requirements.
11. Your data protection rights
Depending on the circumstances and applicable law, you may have rights relating to your personal information, including rights to request access, correction or deletion of information, restrict or object to certain processing, or raise concerns about how your information is handled.
If your information was provided through a Nortamy Scan conducted by your employer or another organisation, that organisation may be responsible for responding to requests concerning the processing it has asked Nortamy to perform.
You can contact us at hello@nortamy.com if you have a question or request and we will help identify the appropriate route.
You also have the right to raise a concern with the UK Information Commissioner’s Office (ICO).
12. Changes to this Privacy Notice
Nortamy is currently developing and piloting its service. We may update this Privacy Notice as the product, our business or applicable requirements change.
When we make changes, we will update the date shown at the top of this page.
Contact
For privacy questions or requests:
hello@nortamy.com