Nori LabsSign in

Legal

Privacy Policy

Last updated: July 6, 2026

Nori Labs (“Nori Labs,” “we,” “us”) is a tool for influencers and creators to triage brand pitches, price deals, and draft replies. This policy explains what data we access, why, and how it’s protected. Using Nori Labs means you agree to this policy.

What we access, and why

Gmail

With your permission, we connect to your Gmail account in read-only mode to detect and extract brand pitches. We never send, delete, or modify email on your behalf, and we never read email unrelated to brand-deal detection beyond what’s needed to classify a message.

Instagram & Facebook

With your permission, we connect to the Instagram account linked to your Facebook Page to read account-level analytics — follower count, engagement rate, and reach — used only to personalize your pricing suggestions. We do not post, like, comment, message, or otherwise act on Instagram or Facebook on your behalf, and we do not access any other business’s data.

Deal and preference data

Pitches you receive or paste in, the preferences you set (dealbreakers, rate floors, priority brands), and the deals you mark as closed are stored to power scoring, pricing, and draft replies.

What we never do

  • We never send an email, DM, or reply automatically. Every draft is reviewed and sent by you.
  • We never sell your data or share it with advertisers.
  • We never use your Gmail or Instagram data to train models outside of generating your own suggestions.

How your data is protected

OAuth access tokens for Gmail and Instagram are encrypted at rest with AES-256-GCM and are never readable in plaintext by any client, including account owners viewing their own workspace. Each workspace’s data is isolated from every other workspace at the database level. Data is stored on Google Cloud infrastructure (Firebase/Firestore).

Third-party services

We use Google (Gmail API), Meta (Instagram Graph API), and Anthropic (Claude, for classification, scoring, and draft generation) to provide the service. Data sent to these providers is limited to what’s needed to perform the specific function (e.g., pitch text sent to Anthropic for classification) and is governed by their respective privacy policies.

Your controls

You can disconnect Gmail or Instagram at any time from Settings — this immediately revokes and deletes the stored access token. You can request deletion of your account and all associated data by contacting us below.

Changes to this policy

If this policy changes materially, we’ll notify active users by email before the change takes effect.

Contact

Questions or data-deletion requests: dannykim00926@gmail.com