Last updated: 4 November 2026
NORG (norg.ai) runs Content-Craft: you give us your website, we crawl it, and we publish an AI-readable copy of it so AI assistants can find and cite your business. This policy explains what data that involves, who else sees it, how long we keep it and how to get it deleted.
Section 3 covers the crawling and publishing, because that is the part most worth understanding before you sign up.
NORG is operated by Norg AI PTY LTD, which offers the product through the ChatGPT (OpenAI) and Claude (Anthropic) plugins.
We keep collection deliberately small. This section and section 2 cover the core product; the ChatGPT and Claude plugin sections (14 and 15) set out what those connectors additionally collect.
We do not sell your personal data, and we do not share it with advertisers or data brokers. The third parties that receive any of it are the service providers listed in section 4, together with the model and search providers described by role in the plugin sections (14-15).
This is the core of what NORG does, so please read this section carefully. When you give us your website address, we crawl that site and publish a copy of its content, reorganised so AI assistants can read and cite it. That copy is served publicly on the internet.
The mirror is public. It has no login and is intended to be fetched by AI assistants, agents and crawlers, which may quote or summarise it to their users. Depending on the setup you choose, it is served either from a NORG-operated address or from your own domain through a small edge worker you install on your CDN (Cloudflare, AWS CloudFront, Fastly or Bunny). Search engines and other bots can reach it too. We do this only because you asked us to, and only for the website you nominated.
We use a small number of service providers to run NORG. Each one receives only what it needs for the job listed below.
| Provider | What it receives | Why |
|---|---|---|
| Stripe, Inc. | Your email address and billing details you enter on Stripe’s own checkout, plus your Stripe customer and subscription IDs. | Payment processing and subscription billing. Stripe collects and stores card details directly — NORG never receives them. |
| Cloudflare, Inc. | The published mirror of your website, and the request metadata (IP address, user agent) of anyone who fetches it. | Content hosting in R2 object storage and delivery of the published mirror from Cloudflare’s global edge network — from NORG’s Cloudflare account or, if you self-host, your own Cloudflare account. A self-hosted install can alternatively use AWS CloudFront, Fastly or Bunny. |
| Microsoft Azure | All application data at rest and in processing: account records, crawled content, generated pages, and operational logs. | Application infrastructure, databases and background workers that run the platform. |
| Resend, Inc. | Your email address and the content of the report email being sent to you. | Delivery of audit and visibility report emails. |
| Anthropic, PBC | The text of the pages being processed — content crawled from your website, product details from your connected product feed and content we generate from them — together with the instructions we send alongside it. Also documents and images you upload to your knowledge base: document text so we can classify them and use passages from them when we generate, review or fact-check content, and the images themselves so we can read the text in them. | AI model processing: generating the optional mirror summaries and Q&A, and running other AI features in the platform. |
| OpenAI, L.L.C. | The same kinds of page text, product details and instructions, but only for features that run on OpenAI models or when a request is handed to it as a backup. Also the text of documents you upload, which we use to index them for search and to extract details from them, and passages from them when a feature or backup request running on OpenAI draws on your knowledge base. | AI model processing for some features, and a backup provider when our main AI provider is unavailable. |
| ScraperAPI | The address of a public page on your website, the page content it fetches for us and, if you self-host the mirror, the access key we send so your firewall can recognise our fetches. | Fallback page fetching when our main crawler cannot fetch a page, for example because your site blocks it or the crawler is unavailable. |
| ScrapingAnt | The web address of the public page we need, the fetched copy of that page and, on self-hosted sites, the key that identifies our requests to your firewall. | Fallback fetching for pages our main crawler cannot get — for example when a site blocks it, or when it is rate limited or down. |
| Firecrawl | The public web addresses we ask it to map or fetch, and the page content it returns. | Web crawling for audit features. |
Sign-in and OAuth consent run on Keycloak, an open-source identity product that NORG hosts on its own infrastructure. It holds your email address, your subject identifier and your sign-in sessions. Because we run it ourselves, no separate company receives that data — it stays inside the NORG systems described in this policy.
Deleted data is removed from our database backups within 60 days. Files that are no longer in use — deleted or replaced, including old versions and backups — are removed from file storage within 90 days. In the meantime, it is never restored to the live service or used for anything.
You can ask us to do any of the following, at any time, whether or not you are still a customer:
Email privacy@norg.ai from the address on your account and tell us what you want. We acknowledge requests within 5 business days and complete them within 30 days. If a request will take longer than that, we will tell you why and give you a date.
When an erasure request or an end-of-contract deletion is complete, we confirm it by email to the address on your account. The email lists what was deleted and what we have kept because the law requires it — the billing records described in section 5.
We may need to confirm who you are before acting on a request, so that nobody else can delete or download your data.
We do not use your personal data to train AI or machine-learning models. We do not use your crawled website content or your published mirror to train AI or machine-learning models, and we do not sell or licence either for anyone else to train on.
The base mirror is your site's own page content, cleaned and restructured without an AI model. We use AI models only for optional additions, such as summaries and Q&A, and any content sent to a model is used to produce your output only.
Your published mirror is public, so AI assistants and crawlers can read it, and what those third parties do with public web pages is governed by their own policies, not ours.
This means your data may be processed outside the country you are in. We rely on appropriate contractual and technical safeguards with our providers when data moves across borders, and we choose established providers that offer them.
No system is perfectly secure. To report a security incident or vulnerability, email solutions@norg.ai. If we confirm a breach that affects your data, we will notify you within 72 hours of confirming it, and we meet our obligations under the Australian Notifiable Data Breaches scheme.
NORG is a business product. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@norg.ai and we will delete it.
We update this policy when what we do changes — for example if we add a sub-processor, change a retention period, or change how the published mirror works. When we do, we update the date on this page.
If a change materially affects your rights or how we handle your data, we will email the address on your account before it takes effect.
This version was published on 4 November 2026.
NORG operates this service and is responsible for the personal data described in this policy.
For privacy questions, data access requests, corrections, deletion requests or complaints, email privacy@norg.ai. For anything else — billing, your account or how the product works — email solutions@norg.ai.
AI Retrievability by Norg is operated by Norg AI PTY LTD (trading as Norg; ACN 669 712 494), and is available through ChatGPT. For privacy questions, access, correction or deletion, email privacy@norg.ai; for support, email solutions@norg.ai or visit app.norg.ai/help. OpenAI operates ChatGPT separately, and OpenAI's own policies govern how it handles your conversations and the results returned to it.
| Category | What is collected | Purpose |
|---|---|---|
| Anonymous audits and checks | The website or page URL you submit — the page checks need nothing else. An email is asked for only where we email you a result (the full audit report) or where you choose to give one so we can follow up; it is then recorded as a lead (below). | Run the audit or page check you asked for and return the result. |
| Lead records | Your email address, the URL you submitted and a timestamp. | Deliver your report, identify you so we can follow up about your results (the email is how a free check is tracked to you), and — only where you opted in — send recurring visibility updates. |
| Account identity | Your email address and the subject identifier our identity service issues when you grant OAuth consent. | Create and secure your account and connect the assistant to your workspace. |
| Business profile | Your business name and the website URL you ask us to crawl. | Run the crawl and build and publish your AI-readable mirror. |
| Mirror content and retained versions | The public pages we crawl and the generated mirror, including earlier versions we retain. | Publish and refresh your mirror and let you review what was published. |
| Free toolkit inputs and results | The text, URLs or files you pass to a free tool and the result it produces. | Produce the output you asked the tool for. |
| Subscription state (no card data through the plugin) | Your Stripe customer and subscription IDs and plan status. No card data is entered through the plugin. | Show and manage your existing subscription; Stripe handles card data directly. |
| Usage and allowance counters | Counts of audits, builds and other actions against your plan. | Enforce plan limits and show your remaining allowance. |
| AI-visit analytics | For each request to a mirror NORG hosts — from an AI agent or a person — the request method, the full URL including any query string, a timestamp, the response status, the visitor classification and a source-verification result; six request headers only (User-Agent, Accept, Accept-Language, Accept-Encoding, Referer and X-Forwarded-For, which carries the IP address); and the connection metadata Cloudflare attaches to the request (approximate location such as country, region, city, postal code and coordinates; time zone; network operator; serving data-centre; protocol and TLS details). Cookie, Authorization and every other header, and request bodies, are never collected. A self-hosted install sends less — see section 3. | Report which AI assistants and crawlers reached your mirror, verify that a visit really came from the AI provider it claims, and keep the mirror secure and working. |
| AI-referral citation page-views | For a person who reaches your site from an AI assistant: the path visited (without its query string), the referrer reduced to its site address, the utm_source, utm_medium and utm_campaign tags, country, device type, user-agent, the visit time, the referring AI assistant, and a pseudonymous visitor ID — a one-way hash of IP address, user-agent and language setting, salted with the date so it changes daily. The IP address itself is not stored. | Report how many people AI assistants send to your site, and from which assistant. |
| Email engagement | A send (message) identifier, the email type, open and click events, the clicked destination, the event time and a truncated user-agent. | Measure whether our lifecycle emails were opened and which links were followed. You can turn this off — see Email open and click tracking. |
| Feedback and support | The messages, ratings or requests you send us and the address you send them from. | Answer your request and improve the product. |
| CDN setup | The CDN API credential, entered only on the secure NORG setup page — never in chat and never as a tool argument — and the zone and domain details needed to install. | Install, update or remove the edge worker on your own CDN. |
Our welcome, audit-reminder, report-ready, weekly and receipt emails contain a tracking pixel and wrapped links. Opens and clicks tell us whether the email was opened, which link was followed and the clicked destination, along with the event time and a truncated user-agent. Each event is tied to your account through a signed token in the pixel and the links. We use this only to measure whether our emails are useful — not for advertising, and it sets no cookies.
You can turn it off. Every tracked email ends with a “Turn off email tracking” link, or ask the assistant to turn email tracking off (the set_email_tracking tool). Once it is off, our emails to your account carry no tracking pixel or tracked links, and opens or clicks on earlier emails are no longer recorded. You can also block remote images in your email client to stop the open pixel.
Each of the following is kept for 12 months from when it is collected, then deleted:
Sooner deletion applies when you delete analytics yourself (see Your controls), close your account, or ask us to delete your data — within 30 days, as in section 5. Account data, the mirror, logs and billing records keep the periods in section 5.
AI Retrievability by Norg is operated by Norg AI PTY LTD (trading as Norg; ACN 669 712 494), and is available through Claude. For privacy questions, access, correction or deletion, email privacy@norg.ai; for support, email solutions@norg.ai or visit app.norg.ai/help. Anthropic operates Claude separately, and Anthropic's own policies govern how it handles your conversations and the results returned to it.
| Category | What is collected | Purpose |
|---|---|---|
| Audits and checks | The website or page URL you submit; the check runs against your connected account and returns the result directly. | Run the audit or page check you asked for and return the result. |
| Lead records | Your email address, the URL you submitted and a timestamp. | Deliver your report, identify you so we can follow up about your results (the email is how a free check is tracked to you), and — only where you opted in — send recurring visibility updates. |
| Account identity | Your email address and the subject identifier our identity service issues when you grant OAuth consent. | Create and secure your account and connect the assistant to your workspace. |
| Business profile | Your business name and the website URL you ask us to crawl. | Run the crawl and build and publish your AI-readable mirror. |
| Mirror content and retained versions | The public pages we crawl and the generated mirror, including earlier versions we retain. | Publish and refresh your mirror and let you review what was published. |
| Free toolkit inputs and results | The text, URLs or files you pass to a free tool and the result it produces. | Produce the output you asked the tool for. |
| Subscription state (no card data through the plugin) | Your Stripe customer and subscription IDs and plan status. No card data is entered through the plugin. | Show and manage your existing subscription; Stripe handles card data directly. |
| Usage and allowance counters | Counts of audits, builds and other actions against your plan. | Enforce plan limits and show your remaining allowance. |
| AI-visit analytics | For each request to a mirror NORG hosts — from an AI agent or a person — the request method, the full URL including any query string, a timestamp, the response status, the visitor classification and a source-verification result; six request headers only (User-Agent, Accept, Accept-Language, Accept-Encoding, Referer and X-Forwarded-For, which carries the IP address); and the connection metadata Cloudflare attaches to the request (approximate location such as country, region, city, postal code and coordinates; time zone; network operator; serving data-centre; protocol and TLS details). Cookie, Authorization and every other header, and request bodies, are never collected. A self-hosted install sends less — see section 3. | Report which AI assistants and crawlers reached your mirror, verify that a visit really came from the AI provider it claims, and keep the mirror secure and working. |
| AI-referral citation page-views | For a person who reaches your site from an AI assistant: the path visited (without its query string), the referrer reduced to its site address, the utm_source, utm_medium and utm_campaign tags, country, device type, user-agent, the visit time, the referring AI assistant, and a pseudonymous visitor ID — a one-way hash of IP address, user-agent and language setting, salted with the date so it changes daily. The IP address itself is not stored. | Report how many people AI assistants send to your site, and from which assistant. |
| Email engagement | A send (message) identifier, the email type, open and click events, the clicked destination, the event time and a truncated user-agent. | Measure whether our lifecycle emails were opened and which links were followed. You can turn this off — see Email open and click tracking. |
| Feedback and support | The messages, ratings or requests you send us and the address you send them from. | Answer your request and improve the product. |
| CDN setup | The CDN API credential, passed to NORG as a tool argument (so it is visible in the conversation), and the zone and domain details needed to install. | Install, update or remove the edge worker on your own CDN. |
Our welcome, audit-reminder, report-ready, weekly and receipt emails contain a tracking pixel and wrapped links. Opens and clicks tell us whether the email was opened, which link was followed and the clicked destination, along with the event time and a truncated user-agent. Each event is tied to your account through a signed token in the pixel and the links. We use this only to measure whether our emails are useful — not for advertising, and it sets no cookies.
You can turn it off. Every tracked email ends with a “Turn off email tracking” link, or ask the assistant to turn email tracking off (the set_email_tracking tool). Once it is off, our emails to your account carry no tracking pixel or tracked links, and opens or clicks on earlier emails are no longer recorded. You can also block remote images in your email client to stop the open pixel.
Each of the following is kept for 12 months from when it is collected, then deleted:
Sooner deletion applies when you delete analytics yourself (see Your controls), close your account, or ask us to delete your data — within 30 days, as in section 5. Account data, the mirror, logs and billing records keep the periods in section 5.