1. Who we are, and what this covers
Norden Sky LLC (Delaware, United States) — “Norden Sky”, “we”, “us” — publishes this policy and is responsible for the processing described in it. Our registered address is 16192 Coastal Hwy, Lewes, DE 19958. Resolv.Now and Vince are products of Norden Sky LLC.
One policy covers three products, because they share an account system and a database and describing them apart would be misleading:
| Product | What it is |
|---|---|
| resolv.now | The public website. Marketing pages and one contact form. No account, no sign-in. |
| The web console | The Resolv.Now support desk and the wider Vince platform it ships inside — support cases, customers, sales, inventory, electronic invoicing and payroll. Used by our customers’ own staff, who sign in. |
| The Vince mobile app | The iOS and Android companion to the console, used by field staff for inventory counts, meter readings and document scanning. Signs in against the same accounts. |
Where something is true of only one of them, this policy says which.
2. Our two roles, and why the difference matters to you
We handle personal data in two quite different capacities, and which one applies decides who you should ask when you want something done.
We are the controller — the party that decides why and how data is used — for the website, for enquiries sent to us, and for the administrative records of the people at our customers who hold accounts. Sections 3 to 5 describe that data. Ask us directly.
We are a processor — acting only on our customer’s documented instructions — for everything our customers put into the console and the mobile app. That includes their own customers’ support cases and the messages on them, contact records, invoices, and their employees’ payroll and attendance records. We did not decide to collect any of it, we do not use it for our own purposes, and we do not sell it. Our customer is the controller; their privacy notice governs it, and a separate Data Processing Agreement governs our handling of it. Across Latin America we are the encargado; under the GDPR, the processor; in the United States, a service provider.
If you raised a support case with a company that runs Resolv.Now, your data is in the second category. Write to that company. If you write to us instead we will pass the request on and tell you we have done so, but we cannot decide it for them.
3. The website (resolv.now)
The website carries no analytics, no advertising tags, no session recording, no social widgets and no third-party scripts of any kind. The typeface is served from our own domain rather than fetched from Google, so reading the site sends a request to nobody but us.
The contact form is the only place the site collects anything. When you submit it we receive:
- your name, and the email address you give us;
- optionally your company, phone number, support team size, and what the enquiry is about;
- the message you write;
- the language edition you were reading, the page you submitted from, and a campaign reference if you arrived by a link that carried one.
The form will not submit without the consent box ticked, and the box is never ticked for you. There is also one hidden field that is not shown to you and must stay empty: it catches automated submissions, and its only possible content is whatever a bot typed into it.
Submissions are delivered to our sales inbox as email, through Amazon SES in the AWS us-east-1 region, with your own address set as the reply address so that answering the enquiry answers you. We use what you send to reply and to follow up about the product. We do not add you to a newsletter, we do not enrich your details from data brokers, and we do not pass them to anyone for their own marketing.
Our hosting provider keeps ordinary server logs — IP address, request time, browser user agent — which we use to keep the site available and to investigate abuse.
4. The web console
The console is for our customers’ staff, and reaching any page in it requires signing in. As controller, what we hold about an account holder is the record that makes the account work: the user identifier, the name, the email address and mobile number on the record, the language and theme preference, the branch and role assignments that decide what the account may see, and the sign-in and activity history.
Authentication is performed against the database server itself. There is no separate password store, and we cannot read your password. Your session is held as an encrypted token in a cookie the browser will not expose to page scripts; it is re-issued periodically while you keep working, and it stops being valid when you sign out or change your password.
Where your account requires a second factor, we send a one-time code to the email address or mobile number on your user record. Email goes through Amazon SES; SMS goes through Ubiquo Labs (IM ContactoSMS). The code is stored only as a digest, with its attempt count, and only while the challenge is open.
Changes that matter — to records, to settings, and to service-level policies — are written to an append-only audit ledger together with the account that made them and when. That ledger is what lets a figure on a dashboard still be explained a year later, and it is deliberately not editable, including by us.
Everything else in the console is our customer’s data, processed on their instructions as described in section 2: support cases and their full history across email, WhatsApp and the customer portal; files attached to those cases; customer, lead, sales and receivables records; electronic invoicing documents submitted to the tax authority where the customer’s country requires it; and payroll, employee and attendance records.
Two parts of that are worth naming, because they involve people who never signed up with us. The customer portal deliberately has no accounts and no passwords: someone raising a case is identified by an email address they proved they can read, and nothing is filed until they open the link we email them — which is what stops a case being raised in someone else’s name. The WhatsApp channel runs on the WhatsApp Business Platform, so messages, media and phone numbers on that channel pass through Meta’s systems, under Meta’s terms as well as ours.
5. The Vince mobile app
The mobile app signs in against the same accounts as the console and reaches the same data. It contains no advertising SDK, requests no advertising identifier, and sends nothing to a third-party analytics service.
It asks for three device permissions, each only when the feature that needs it is used, and each refusable without losing the rest of the app:
| Permission | What it is for |
|---|---|
| Camera | Scanning text from a document, and photographing a meter as evidence for a reading. A photo taken this way is attached to the reading it belongs to. |
| Location (while in use) | Recording where a meter reading was taken, at the moment it is entered. Approximate accuracy — roughly a hundred metres — is requested rather than precise GPS. The app never asks for background location and cannot collect a position while it is closed: the stamp records a visit, not a person’s movements. A reading saves normally, with no location at all, if the permission is refused or no fix is available. |
| Photo library (add only) | Saving a meter photo to your device gallery, named after the reading, so you can find it outside the app. Refusing keeps the photo inside the app instead, and the app says so. |
Your session credentials are stored in the operating system’s own secure storage — the iOS Keychain or the Android Keystore — and not in ordinary app storage. The app also keeps your language and theme preference on the device, and records basic device and app-version information for diagnostics.
If push notifications are enabled, the device is issued a push token that we store against your account so notifications can be addressed to it. Delivery goes through the Expo push service, and from there through Apple’s and Google’s notification services. Turning notifications off in your device settings stops this.
7. Why we are allowed to use this data
Where the GDPR or UK GDPR applies, we rely on the following lawful bases for the processing we control:
- Consent — for the contact form, which you tick before submitting, and for each device permission the mobile app asks for. You can withdraw either at any time, and withdrawing does not affect what was lawful before you did.
- Performance of a contract — for running accounts, authenticating users, and providing the console and the app to the customer that subscribes to them.
- Legitimate interests — for keeping the services available and secure, preventing automated abuse of the contact form, maintaining the audit ledger, and following up on an enquiry a business contact chose to send us. We have weighed these against your interests and use the least data that answers the purpose.
- Legal obligation — for records we are required to keep, including tax and electronic invoicing records where a customer’s country mandates them.
For data we process on a customer’s behalf, that customer determines the lawful basis and is responsible for having one.
8. Who else sees it
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not disclose it for anyone else’s marketing. We use a small number of service providers, each bound by contract to act only on our instructions:
| Provider | What it handles |
|---|---|
| Amazon Web Services | Hosting and compute for all three products, the database, file and attachment storage, and outbound email (Amazon SES). |
| Meta Platforms | The WhatsApp Business Platform, where a customer has enabled the WhatsApp channel. Messages, media and phone numbers on that channel pass through Meta. |
| Ubiquo Labs | Delivery of one-time codes and notifications by SMS. |
| Expo | Delivery of push notifications to the mobile app, and from there Apple’s and Google’s notification services. |
We also disclose data where the law requires it — a valid order from a court or a competent authority — and to professional advisers, or to an acquirer, in connection with a corporate transaction. Where we are the processor, we will tell the controller before responding to such a request unless we are legally forbidden to.
9. International transfers
We are a United States company and our infrastructure runs in the United States, in the AWS us-east-1 region. Data from Latin America, the European Economic Area or the United Kingdom is therefore transferred to and stored in the United States.
For transfers out of the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum, supported by the technical measures described in section 11. You can ask us for a copy of the clauses that apply to you.
10. How long we keep it
We keep personal data for as long as it is needed for the purpose it was collected for, and then for as long as we are required to keep it to meet a legal, accounting, tax or regulatory obligation, or to establish, exercise or defend a legal claim. When none of those applies any longer, we delete it or anonymise it.
What that means in practice differs by category. An enquiry is kept while it is live and while there is a realistic prospect of it going somewhere; account records last as long as the account; the audit ledger is append-only and is kept for the term of the agreement, because a record that can be pruned is not an audit trail.
For data we hold as processor, the customer sets the retention period and we follow it. On termination we return or delete that data as the agreement provides. Backups age out on their own schedule, so a deletion reaches them at the end of the backup cycle rather than at once.
11. How we protect it
- Traffic to all three products is encrypted in transit, and so is the connection between the applications and the database.
- Sessions are encrypted tokens rather than readable ones, held in cookies that page scripts cannot reach, or in the device keystore on mobile.
- Two-factor authentication by email or SMS is available and can be required per user.
- Access is least-privilege by design rather than by policy alone. The website’s database credential, for instance, can execute one stored procedure and do nothing else at all — so the worst a compromise of the public site can achieve is a spurious enquiry.
- File attachments are uploaded and downloaded through short-lived signed links, so the files themselves do not pass through the application layer.
- Changes to records and settings are recorded in the append-only audit ledger, with the account that made them.
No system is perfectly secure, and we will not claim otherwise. Where the law requires it we will notify the competent authority, and affected individuals, within the period it sets — and where we are the processor, we will notify the controller without undue delay so that they can.
12. Your rights
Wherever you are, you can ask us to tell you what we hold about you, to correct it if it is wrong, to delete it, and to stop using it for a purpose you object to. You can withdraw a consent you gave. You will never be treated worse for asking.
Write to privacy@resolv.now. We will ask for enough information to be sure the request is yours — which is a protection for you rather than an obstacle — and we will answer within the period the applicable law allows, telling you if we need longer and why. Exercising these rights is free, unless a request is manifestly unfounded or repetitive.
If your data reached us because you dealt with a company that uses our software, we hold it as processor and cannot decide the request ourselves. We will forward it to that company without delay, and tell you that we have.
13. If you are in Latin America
Data protection law in the region is national rather than regional, and the details differ from one country to the next. Rather than make you work out which statute applies to you, we grant the ARCO rights to everyone in Latin America, wherever you are and whether or not your country’s law compels us: acceso, rectificación, cancelación and oposición — to obtain confirmation of and access to your data, to have inaccurate or incomplete data corrected, to have data cancelled where its retention is no longer warranted, and to oppose processing on legitimate grounds relating to your situation. You may also revoke a consent you gave.
Send an ARCO request to privacy@resolv.now, identifying yourself and saying which right you are exercising and over what data. Where your country’s law sets a deadline for our answer, we work to it; where it sets none, we answer within thirty days.
If we refuse, or do not answer in time, you may take the matter to the data protection authority of your own country, where one has been established. Nothing in this policy limits a right your national law gives you, and where that law is more protective than what is written here, it prevails.
14. If you are in the European Economic Area or the United Kingdom
In addition to the above, you have the rights of access, rectification, erasure, restriction of processing, data portability and objection — including an unconditional right to object to direct marketing. Where we rely on legitimate interests you may object on grounds relating to your particular situation, and we will stop unless we can show compelling grounds that override yours.
You have the right to lodge a complaint with the supervisory authority of the country where you live or work, or where you believe the problem occurred. We would rather you came to us first, but nothing requires you to.
Our representative for the purposes of Article 27 is not appointed yet.
15. If you are in the United States
There is no single federal privacy law, and the state laws that exist grant overlapping rights to residents of some states and not others. We do not think where you live should decide what you can ask us, so we extend the following to every United States resident, whether or not your state has passed a law requiring it:
- to know the categories and the specific pieces of personal information we have collected, where it came from, why we collected it, and the categories of third party it was disclosed to;
- to have it corrected where it is inaccurate;
- to have it deleted, subject only to the records we are legally obliged to keep;
- to obtain a portable copy of what you gave us;
- to opt out of any sale of personal information, of its sharing for cross-context behavioural advertising, and of profiling — none of which we do, as set out below;
- not to be discriminated against, in price or in service, for exercising any of these.
We do not sell personal information, and we do not share or process it for targeted or cross-context behavioural advertising, and we have not done either in the preceding twelve months — including for anyone under sixteen. There is therefore no opt-out for you to exercise, and we run no advertising or analytics trackers that would create one.
We do not use sensitive personal information to infer characteristics about anyone, and we do not process it for any purpose beyond providing the services described here. Where we handle personal information on behalf of a business customer we act as a service provider, and are contractually barred from retaining, using or disclosing it for any purpose other than performing the service.
The categories we collect as a business are: identifiers; customer records and commercial information; internet or network activity limited to ordinary server logs; approximate geolocation, in the mobile app and only as described in section 5; and professional or employment information. They come from you, from your employer, and from your device, and are used for the purposes set out in sections 3 to 7.
Write to privacy@resolv.now to exercise any of these, or to appeal a decision we have made on a request — several state laws give you an appeal, so we offer one to everyone. An authorised agent may act for you if you give them written permission that we can verify.
16. Automated decisions and AI features
We make no decision about you by automated means that produces a legal effect, or anything similarly significant. No part of these products profiles you, scores you, or decides anything about you without a person involved.
Assisted features — drafting a suggested reply, proposing a queue or a priority — are drafting aids. They propose; an agent reads, edits and decides, and nothing reaches a customer without that. Where such a feature is enabled for a customer’s desk, it operates on that customer’s own data under the Data Processing Agreement.
17. Children
These are business products. They are not directed at children, and we do not knowingly collect personal data from anyone under sixteen. If you believe a child has given us data, write to us and we will delete it.
18. Changes to this policy
We update this policy when the products or the law change. The effective date at the top always reflects the current version. If a change materially affects how we use data we already hold, we will say so before it takes effect — by email to account holders, or by a notice in the product — rather than relying on you to notice a new date.
19. Contact
For anything in this policy, including a rights request, write to privacy@resolv.now. For anything else, support@resolv.now reaches a person.
Norden Sky LLC, 16192 Coastal Hwy, Lewes, DE 19958, United States