Nordlivo Privacy Notice

Last updated 6 October 2026

This notice explains how Nordlivo handles personal information in its family coordination app, including Nord AI support, photo imports and its optional Google Calendar connection.

Who is responsible

NordLivo ApS, CVR 44783940, Klintedalen 20, 3520 Farum, Denmark, is the data controller. For privacy questions or to exercise your rights, contact kontakt@nordlivo.dk.

Information we collect

We collect parents' names, email addresses, family membership and account information, and the routines, tasks and calendar entries they enter. Parents may enter children's names, ages, birthdays, routines, tasks and appointments. Children do not create accounts or sign in. We also process optional routine check-ins and technical information needed for authentication, security and troubleshooting, including access-log IP addresses.

Depending on the features you use, we also process:

• Photo imports. If you photograph a paper calendar, note or school message, the image is read by an AI model on Amazon Bedrock in the EU to suggest events, tasks and routines for you to review. The AI receives only the image. Images and unconfirmed suggestions are deleted 30 days after your last edit.
• Phone calendars. If you share a calendar from your phone, the app uploads the events of the calendars you choose, with the same details or busy-only choice as for Google Calendar. Nordlivo's servers never read your phone's calendar directly.
• Notifications. If you allow notifications, we store your device's push token. Notifications pass through Expo and Apple or Google and contain only a generic line, never names, titles, places or times.
• Email. Sign-in codes and family invitations are sent by email through Amazon SES. An invitee's email address is kept only while the invitation can be accepted.
• Subscriptions. If your family subscribes, Apple or Google handles the payment and RevenueCat tells us whether the family's subscription is active. We do not store payment details or purchase history.

How we use information

We use this information to provide family organisation, authenticate parents, display routines and tasks, and maintain the family calendar. The legal basis for parents' core service data is performance of the contract. We use the optional Google Calendar connection to provide the calendar import and family sharing functions you request; connecting Google Calendar is not required to use the app. Children's information is processed on the basis of parental consent. Check-in responses are processed on the basis of consent. Where processing relies on consent, you can withdraw it by contacting us; withdrawal does not affect processing that was lawful before withdrawal.

Optional routine check-ins

After completing a routine, a parent may select Good, Okay or Hard, or dismiss the prompt. We store the family, routine, date, answer and a reference to the parent who answered. The answer prevents repeat prompts that day and forms part of the family history available in the data export. It is not used for advertising or profiling. A usage counter records completion without recording the answer or the answering parent. These check-ins are optional and are not required to use routines or tasks.

Google Calendar connection

Connecting Google Calendar is optional. Google asks you to authorise Nordlivo to read the list of your calendars and their events. Nordlivo requests the read-only permissions calendar.calendarlist.readonly and calendar.events.readonly. Imported events are read-only in Nordlivo. Nordlivo does not create, edit or delete events in Google Calendar, and no changes are sent back to Google.

For each calendar, you choose not shared, busy only or details. Before you confirm, you can preview the events. The preview is not stored.

Google information we use

We store the Google account's email address to identify the connection and an encrypted refresh token to maintain it. We also keep calendar names to let you manage your connected calendars. The information imported depends on the choice you make for each calendar:

• Not shared: no events are fetched or stored for that calendar. Only the calendar's name is kept, and only the connecting parent can see it.
• Busy only: we store the event identifier, start and end times, and time zone. Titles, locations and descriptions are not stored and are not shown in Nordlivo, including to the parent who connected the calendar.
• Details: we store the same information as for busy only, plus the event title, location, description where present, and the link to the event in Google Calendar.

For calendars you share, we import events from 30 days in the past to one year ahead and update them about every 15 minutes. Consider what an event reveals about you, your children or other people before sharing its details.

Who can see imported events

Every parent in your Nordlivo family can see the imported events, using the sharing level you selected: busy only or details. Each event identifies which parent shared it. The calendar's name is shown to the family only when it is shared with details.

The list of connected calendars, including calendars you have not shared, is visible only to the parent who connected them. Children do not have accounts and cannot access the imported information through their own account.

Purpose and limits

We use Google Calendar information only to provide and update the calendar feature you request. We do not sell Google Calendar information or use it for advertising or to train AI models. Google Calendar information is not passed to Nord or other AI services. Nordlivo's use of information received from Google APIs complies with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.

Google API Services User Data Policy: developers.google.com/terms/api-services-user-data-policy
Google Workspace API User Data and Developer Policy: developers.google.com/workspace/workspace-api-user-data-developer-policy

Disconnecting Google Calendar

Disconnect in Nordlivo. Disconnecting removes that connection, its stored refresh token and all events imported through it together in a single database transaction. Other parents stop seeing those events when their screens next refresh. Nordlivo also revokes the token at Google unless another Nordlivo connection uses the same Google account; in that case, Google authorisation is preserved to avoid interrupting the other connection.

Revoke access in your Google Account. You can remove Nordlivo's access through Google's third-party connections settings. Syncing stops, but previously imported events remain in Nordlivo, marked as out of date, until you disconnect in Nordlivo or delete your Nordlivo account.

Delete your Nordlivo account. Account deletion removes your Google Calendar connections, their stored credentials and the events imported through them. Currently, account deletion does not also revoke Google's authorisation. Nordlivo may therefore remain listed among the connected apps in your Google Account until you remove it there. To revoke that authorisation, remove Nordlivo in your Google Account's third-party connections settings.

None of these actions creates, edits or deletes your original events in Google Calendar. Deleted database information may remain in backups for up to 14 days, as described below.

Sensitive calendar entries

Calendar entries and free-text fields can reveal health information or other sensitive details, and can concern people who do not use Nordlivo. Avoid sharing details that are unnecessary for family organisation; sharing a calendar as busy only keeps its titles, locations and descriptions out of Nordlivo. The connection is intended for scheduling, not collecting sensitive information for another purpose.

Nord AI support

Nord is our interactive AI tool. You can ask questions about your child or concerns you have and receive an answer based on curated research. Nord processes only the question you type; it does not receive your family's calendar, routines or other app data. Avoid including names or other identifying or sensitive details that are unnecessary for your question.

Your question is processed by Amazon Bedrock, an Amazon Web Services service, using AI models from Anthropic and Cohere that AWS runs in its EU regions. Nordlivo does not store your questions or Nord's answers on its servers or in its logs, and they are not used to train AI models. The app keeps your 20 most recent questions and answers on your phone only, so you can read them again; they are deleted when you sign out. We store only the thumbs-up or thumbs-down feedback you may voluntarily give after a response, linked to your account but not to the question or answer. AI can make mistakes, and Nord does not replace professional help.

Storage and providers

Nordlivo's family database is hosted by AWS in eu-north-1, Stockholm. Amazon Cognito provides parent authentication, Amazon SES sends email and Amazon Bedrock runs the AI models for Nord and photo imports, all within AWS. Expo delivers notifications and RevenueCat reports subscription status. Sentry receives crash reports from the app and stores them in its EU data region. Google supplies the Calendar connection and operates its own services under its applicable privacy terms. The EU hosting and data-region statements above describe the specified services; they do not mean that all processing by every provider, or all provider support access, is confined to the EU/EEA.

Retention and deletion

During the pilot, family data is retained while the family account remains active. Remaining pilot personal data will be deleted within 30 days after the pilot ends. Account deletion is available within Nordlivo. If a parent leaves a continuing family, the link between that parent and their check-ins is cleared while the answers remain as family history. Access logs are retained for up to 30 days and database backups for up to 14 days. Imported calendar entries are deleted when you disconnect the calendar or delete your account; revoking Google access alone does not erase them.

Your rights

Depending on the circumstances, you may have rights of access, correction, erasure, restriction, portability and objection. Where we rely on consent, you may withdraw it. Contact kontakt@nordlivo.dk to exercise your rights. You can export your family data and access account deletion through the app. You may complain to the Danish Data Protection Agency, Datatilsynet, at www.datatilsynet.dk.

Changes to this notice

We will update this notice when the way we handle personal information changes. Material changes will be communicated appropriately before new processing is introduced.