Effective date: October 21, 2026 · Last updated: October 21, 2026
This Privacy Policy explains how BSR Agro Trade AG ("Norman", "we", "us") collects, uses, shares and protects personal information when you use the Norman web application at normanfarm.ai and related services (the "Service"). It applies to users in the Americas, Europe and Oceania, where Norman is offered. By using the Service you agree to this Policy.
BSR Agro Trade AG
Representative office: Rue De-Candolle 24, 1205 Genève, Switzerland
Swiss commercial register: CHE-115.937.442 (registered 27 August 2010)
Privacy contact: dev@bsr-agro.ch · Phone: +41 44 688 01 05
BSR Agro Trade AG is the data controller for the Service under Swiss, US state and Canadian privacy law. The person in charge of the protection of personal information (privacy officer, including for the purposes of Quebec's Law 25) can be reached at the privacy contact above.
We collect only what the Service needs to work.
We do not collect payment card numbers (if paid plans are added, payments will be processed by a third-party processor) or government ID numbers.
Sensitive information. The only sensitive personal information (as defined by the California Privacy Rights Act) we collect is precise geolocation: field boundaries and, with your permission, your device location. We use it only to provide the Service you asked for — weather, satellite data and advice for your fields — and never to infer characteristics about you, for advertising, or for sale or sharing. Do not upload photos of people or documents containing identification numbers.
We do not show advertising inside Norman, do not build advertising profiles of you, and never use your questions, photos, field data or records for advertising.
Norman uses large language models (AI) to answer questions and analyze photos. Your questions, photos and relevant context (your region, field data, weather) are sent to an AI model provider to generate a response. We send only what is needed for the answer; we do not send your name or phone number. AI model providers process this data on our behalf and are contractually prohibited from using it to train their models.
AI responses are advice, not decisions. Norman does not make automated decisions that produce legal or similarly significant effects on you. Always check product labels and consult a licensed adviser before applying any crop protection product.
We share personal information only with service providers who process it for us under contract, and only as needed:
We do not sell personal information. Under California law, letting Google collect data through its tag for ad measurement may count as "sharing" for cross-context behavioral advertising. You can opt out at any time — see section 6 — and we honor the Global Privacy Control signal. We do not knowingly sell or share the personal information of anyone under 16.
We may disclose information if required by law, to protect our rights, or in connection with a merger or acquisition (you will be notified).
Strictly necessary storage — a sign-in token so you stay logged in, session storage for your map view and preferences, and your cookie choice. These are always on; the Service cannot work without them.
Analytics cookies (optional) — Google Analytics 4, to understand how Norman is used. We have turned off Google Signals and advertising features in Analytics; Google Analytics does not log or store IP addresses.
Advertising cookies (optional) — the Google Ads tag, to attribute visits and sign-ups to our own ads. We do not use remarketing lists, do not show ads inside Norman and do not build advertising profiles.
How the choice works depends on where you are. The two categories can be accepted separately. In the European Economic Area, the United Kingdom, Switzerland, Brazil and Quebec, a category is loaded only after you accept it in the cookie banner — nothing is sent to Google before that. Elsewhere, including the United States and the rest of Canada, both are on by default, the banner tells you so, and you can switch them off with one click. A category that is off — not yet accepted, declined, or turned off by a Global Privacy Control signal — is not loaded at all. We use no other third-party trackers. Cookie names, lifetimes and purposes are listed in our Cookie Notice; we ask for your choice again after 12 months.
Your choice. Change it at any time on the Cookie Notice page ("Your choices"); declining removes the Google Analytics and Google Ads cookies immediately.
Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale and sharing: when it is present, analytics and advertising cookies stay off and we do not ask you to accept them. We do not respond to the older "Do Not Track" setting, because there is no accepted standard for it; GPC covers the same ground.
E-mail. If you sign in by e-mail, we send a one-time code and a one-tap sign-in link (which carries the same code) to the address you enter. These are account-verification messages only — we do not send marketing e-mail, and we do not add your address to any mailing list. The link signs in whoever opens it, once, within 10 minutes, so do not forward the message. You stop receiving these messages by not requesting codes or by deleting your account. We do not read the e-mail address or the code from the sign-in link into our analytics; both are removed from the page address before any analytics event is sent.
Phone. When you request a sign-in code, we send a one-time code to your phone number as a WhatsApp message or an SMS text message. These are account-verification messages only — we never send marketing texts. By entering your number and requesting a code you consent to receive it; message frequency varies with your sign-in activity, and message and data rates may apply under your carrier's plan. You can opt out at any time by replying STOP to a text message, by not requesting codes, blocking the sender in WhatsApp, or deleting your account; reply HELP or email dev@bsr-agro.ch for help. Phone numbers and SMS consent are used for sign-in and account security only and are not sold, rented or shared with third parties or affiliates for marketing purposes; they are shared only with the delivery provider to the extent needed to deliver the message. See our Terms of Service, section 3.
Our servers and database are located in the United States. If you are outside the US, your data is transferred to and processed in the US. For residents of the European Economic Area, the United Kingdom and Switzerland, transfers rely on the EU–US, UK and Swiss–US Data Privacy Frameworks where our providers are certified, and otherwise on the European Commission's Standard Contractual Clauses (with the UK Addendum and Swiss amendments). For Quebec residents, we have assessed the privacy impact of this transfer as required by Law 25. For other countries, we rely on the contractual safeguards required by local law.
Depending on where you live, you have the right to:
How to exercise your rights. Email dev@bsr-agro.ch with "Privacy request" in the subject (Norman operates only online and this is our designated request method). To delete your account and all its data, send "Delete my account" from the e-mail address on the account, or state the phone number or e-mail address on the account in your message. We will confirm receipt within 10 business days and respond within 45 days (extendable once by 45 days where permitted). We may ask you to verify your identity by confirming the phone number or e-mail address on the account (for example, by signing in). You may authorize an agent to make a request on your behalf; we will ask the agent for proof of authorization.
California residents have the rights above under the CCPA/CPRA. We do not sell personal information. Because Google Ads measurement may count as "sharing", the Your Privacy Choices link in the footer lets you opt out ("Do Not Sell or Share My Personal Information"); we also honor the Global Privacy Control signal. In the preceding 12 months we have disclosed the categories listed in section 2 to the providers listed in section 5, and shared identifiers and internet activity with Google for analytics and ad measurement, except for visitors who opted out (or, where we ask first, did not accept). We do not use sensitive personal information for purposes that would give rise to a right to limit its use.
Canadian residents may also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC).
Residents of Brazil have the rights provided by the LGPD (confirmation, access, correction, anonymization, deletion, portability and information about sharing); our privacy contact above acts as the person in charge (encarregado). Residents of other countries have the rights provided by their local data protection law and can exercise them through the same contact.
If you are in the EEA, the UK or Switzerland, the GDPR, the UK GDPR or the Swiss FADP applies, and the following also holds.
The Service is not directed at children under 13 (US) or under the age of majority elsewhere, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.
We use encryption in transit (TLS), encrypted storage, access controls and logging. Sign-in is by one-time code; we do not store passwords. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as required by law.
We may update this Policy. The effective date at the top shows the current version. For material changes we will notify you in the Service or by the contact details on your account.
BSR Agro Trade AG · Rue De-Candolle 24, 1205 Genève, Switzerland
dev@bsr-agro.ch · +41 44 688 01 05