Sign in

The small print

Privacy

What we collect, where it goes, and how long it stays. Written from what the product does.

Dated 23 September 2026.

Who is responsible

The company responsible for your personal data is NorwAI AS, organisation number 920 631 908, Trygve Nilsens vei 48P, 1061 Oslo, Norway. Questions and requests go to Sondre@NorwAI.as with privacy in the subject line.

What you give us

  • Your web address, on the front page. Our server reads your colours, your typeface and your name from your own site and shows them in our films. What it reads is public, no model is used for it, and it is kept for a while so the next time is quick. The server also counts how often one IP address asks, so the reader cannot be abused. How long it stays says for how long.
  • Your email address, if you sign in. We send a six digit code to it and keep a salted digest of the code for ten minutes, never the code itself. Your account record holds the address, when it was made and last used, and which studios it may enter with which role: owner, member or viewer. If you change the address in Settings, the one you had before is kept on the record too.
  • An invitation to a studio. When an owner invites somebody, we keep that person's email address, the studio, the role and who invited them, until the invitation is taken, withdrawn or seven days have passed. The invitation is sent by email.
  • What you send for a film. Your brief, your words, a script, documents, pictures, a logo, a recording or a video. It is kept in a folder for your account on our servers, and used to make the film you asked for.
  • A payment, if you buy a plan or credits. Stripe takes the card. We receive that a payment was made, the amount and the currency, Stripe's reference for it, and the name, email address and country you gave Stripe.

Who makes the film with us

When a film is made, what you give us goes to OpenRouter, and from there to the company whose model makes the film. Our engine makes a film by working with a model. It reads about you, writes the film, looks at it as it is made, and then two separate checks read it again, one for the facts and one for the craft. Each of those steps is a call from our servers to OpenRouter, which passes it on to a company that runs the model.

  • Microsoft Clarity records how visitors use these pages (clicks, scrolling, where a page gets in the way), without your name and with typed text masked, so we can make the pages better. Nothing from it is used for advertising.
  • OpenRouter, a company in the United States, connects our engine to the model. For each step it receives what that step needs: your brief and your own words, the text we read from documents you send, a written copy of what is said in a recording you send, the pictures and logos you send, pages from your website, the film itself as it is written, and pictures of the film as it is made.
  • Anthropic, a company in the United States, makes the model that does this work today, Claude. OpenRouter can run that model at Anthropic itself, or at Amazon Web Services, Google Cloud or Microsoft Azure, which run the same model. OpenRouter decides which of them takes each call, so the same material can pass through any of the four.
  • OpenAI, a company in the United States, makes the model the engine uses to search the web about your company. It receives the search words the engine writes, such as your company's name, and not your files. OpenRouter can run that model at OpenAI or at Microsoft Azure. When the model's own search cannot be used, OpenRouter runs the search through Exa, a company in the United States, which then receives the same search words.

A recording you send is not sent to the model as sound. What is said in it is written out by software on our own servers, and that text goes on. If your video is part of the film, the pictures of the film as it is made can show it.

Typing your web address on the front page is different. Our server reads your colours, your typeface and your name from your own site, and no model is used for that, so nothing from it goes to OpenRouter.

Which model does the work is a setting on our side. If we change it, this page and the subprocessor page change on the same day.

The other companies that run the service

  • Railway, a company in the United States, rents us the servers the product runs on, in its EU West region. Everything the product keeps is kept there: your account, the files you send, the jobs, the engine's working notes, and the finished films.
  • Vercel, a company in the United States, serves the pages and passes each request on to our servers at Railway, files you upload included. It sees an ordinary web request: your IP address, the page asked for, and the time.
  • Cloudflare, a company in the United States, keeps a copy of a finished film in private storage (R2), held in its EU jurisdiction, from the time the film is made into a video file for you. Nothing in Nine can make that copy public.
  • Resend, a company in the United States, sends our email. It receives your email address and the message: a sign in code, a code that confirms a new sign in address or deleting your account, a note that your film is ready, an invitation to a studio from one of its owners, or the note you asked for when you joined the waiting list. The waiting list itself, which is your email address, is kept there.
  • Domeneshop, a company in Norway, hosts our own mailbox. Every message you write to us arrives there, and so does a note for each address that joins the waiting list, with what you wrote with it.
  • Stripe takes payments. Card details go to Stripe and never reach us. What comes back to us is that a payment was made, the amount and the currency, Stripe's reference for it, and the name, email address and country you gave Stripe.

Companies Nine does not use, so none of them receives anything from you: Google and Apple (for signing in), ElevenLabs (a spoken voice), Deepgram (speech to text), Supabase (a hosted database), and Anthropic or DeepSeek, a company in China, reached directly rather than through OpenRouter. If Nine ever uses one of them, it is added to the subprocessor list first.

The list of who handles your data has the same companies, with what each one receives and when.

Where it is

Our servers are rented from Railway, in its EU West region, and the films are made there. The private copy of a film at Cloudflare is held in Cloudflare's EU jurisdiction. The pages come from Vercel's network, which serves them from many places. Our mailbox is at Domeneshop, in Norway. OpenRouter, the companies whose models make the film, and Exa are in the United States, so what goes to them can be handled there.

On what basis data goes to the United States. Several of the companies named here are American, and what they receive can be handled in the United States. The law allows that on one of two grounds. On 10 July 2023 the European Commission decided that a company certified under the EU-U.S. Data Privacy Framework protects personal data well enough, so data can go to a certified company on that decision. Data that goes to a company that is not certified goes under the European Commission's standard contractual clauses, in our agreement with that company. OpenRouter's own privacy policy names those clauses. Write to us and we tell you which ground applies to each company, and send you a copy of the clauses.

Why we are allowed to use it

  • To make and deliver what you asked for, which includes sending what each step needs to OpenRouter and the company whose model makes the film. This is the agreement between us.
  • To sign you in, and to tell you when a film is ready: the same agreement.
  • To keep the service from being abused, for example by counting how many requests come from one IP address in a day: our interest in keeping Nine up for everyone.
  • To keep accounting records: a duty under Norwegian bookkeeping law.

How long it stays

  • A sign in code: ten minutes, and it works once. Five wrong tries end it sooner.
  • The request counter: your IP address, the kind of request and the time, kept for today and yesterday and then dropped.
  • An account: until you delete it in Settings, or ask us to. Deleting waits seven days, and in that time you can sign in and keep it. Then the account is erased: your address leaves our records and the waiting list, and the films and files in a studio only you were in are deleted with it. A studio you shared stays with its other people. What stays is a note that an account was erased, which does not hold the address, and the payment records bookkeeping law requires.
  • The waiting list: your email address, kept at Resend until you ask us to remove it. The note with what you wrote with it stays in our mailbox until you ask us to delete it.
  • Files you send, and the films made from them: on our servers until you delete your account, or ask us to delete them. Nothing deletes them on a timer.
  • The engine's working folder for a film: the pages it read, the notes it wrote, the pictures it looked at, and the copy of your material it worked from. Kept with the film, for as long as the film is kept.
  • A copy of a film at Cloudflare: for as long as the film is kept. A download link to it works for five minutes.
  • What we read from a public website: pages, colours, logo and typeface files, kept in a cache for between one month and one year, so the next person who types the same address does not wait.
  • At OpenRouter and the model companies: what they keep, and for how long, is set by their own terms for business customers.
  • Payments and receipts: for as long as Norwegian bookkeeping law requires, which is why a payment record cannot be deleted on request while that duty applies.

What we do not do

  • We do not train any model on your material, and we do not sell it or hand it to anyone to train on.
  • We do not sell anything about you, and there is no advertising here.
  • These pages load no analytics and no tracking script, and nothing from any other company.
  • We do not make decisions about you automatically. Our engine decides whether a film passes our own checks, and that is a decision about the film, not about you.
  • We do not ask for sensitive information, and we do not want it. Please do not send health data, or anything about a child, in a script, a picture or a recording.

Your rights

In Settings you can download a copy of everything we hold about you in a file, change the email you sign in with, and delete your account, all without writing to anybody. You may also ask to see what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it, ask for it in a file a machine can read, or object to a use based on our own interest. Write to Sondre@NorwAI.as with privacy in the subject line. Where a duty to keep an accounting record applies, that record stays, and we tell you which part stayed and why.

If you think we have handled your data badly, you may complain to the Norwegian Data Protection Authority, Datatilsynet. You do not have to tell us first.

Cookies

These pages set a cookie when you sign in, and another when you start making a film before signing in. The cookie page names each one, says what it holds, and how long it lives.

Changes to this page

This version is dated 23 September 2026. When this page changes in a way that matters, the date changes with it.