Back to home
NorthNorth OS

Privacy Policy

Last Updated: July 2026

North OS Technologies Ltd. ("North", "we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect personal information when you use the North OS website, waitlist, platform, applications and APIs (the "Service").

This policy is designed to satisfy the UK GDPR, the Data Protection Act 2018, the EU GDPR (where we serve EEA users), the California Consumer Privacy Act as amended by the CPRA, and other applicable US state privacy laws (including Colorado, Virginia, Connecticut and Utah), to the extent they apply to our processing.

Controller. For personal data relating to your account, our website and our marketing, North acts as the data controller. For Customer Content you upload or connect to the platform (e.g. your CRM records, documents, emails), North acts as a data processor on your behalf — see our Data Processing Agreement.

1. Information We Collect

Information you provide:

  • Identity and contact data — name, email address, company name, phone number
  • Account data — credentials, role, preferences, profile details
  • Business data — CRM records, clients, leads, projects, tasks, invoices and related records you create in the Service
  • AI prompts and conversations — messages you send to AI features and the responses generated
  • Uploaded documents and files — contracts, brand assets, spreadsheets and other content you upload
  • Payment data — billing details processed securely by third-party payment providers (we do not store full card numbers)
  • Communications — support requests, feedback, survey responses

Information from integrations you connect (only with your explicit authorisation):

  • Email integrations — message content, headers and metadata from connected mailboxes
  • Calendar integrations — events, attendees and availability
  • Contacts — names, emails and details synced from connected services
  • Other connected services — data you authorise via OAuth scopes

Information collected automatically:

  • Device information — browser type, operating system, device identifiers
  • Usage data — pages viewed, features used, timestamps, referral source
  • Log and metadata — IP address, approximate location (country/city), session identifiers
  • Cookies and similar technologies — see our Cookie Policy

Sensitive data. We do not intentionally collect special category data (e.g. health, biometric, racial or ethnic origin data). Do not upload sensitive data unless strictly necessary and lawful; where you do, you are responsible for having a lawful basis.

2. How We Use Information and Lawful Bases

  • Provide, operate and secure the Service — contract performance
  • Process AI prompts to generate outputs — contract performance
  • Billing and account management — contract performance; legal obligation
  • Service updates and security notices — contract performance; legitimate interests
  • Product improvement and analytics — legitimate interests
  • Marketing communications — consent (which you can withdraw at any time)
  • Fraud prevention and platform integrity — legitimate interests; legal obligation
  • Legal compliance and enforcement — legal obligation; legitimate interests

AI processing. Prompts, connected data and uploaded documents may be processed by AI model providers to generate outputs. We do not use your Customer Content to train our own generally available models without your consent, and we contractually restrict model providers from using your data to train their models where such controls are available.

3. Data Retention

We retain personal data only as long as necessary for the purposes described above: account data for the life of your account plus a reasonable wind-down period; Customer Content until you delete it or your account is closed (followed by deletion from active systems within 90 days and from backups on rolling cycles); billing records as required by tax law (typically 6–7 years); and logs for security purposes for up to 24 months.

4. Sharing and Third-Party Processors

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share data only with:

  • Service providers / subprocessors — hosting, storage, AI model providers, email delivery, analytics and payment processors, under contracts that restrict their use of your data
  • Integration partners — services you choose to connect (e.g. Google, Microsoft), per the permissions you grant
  • Professional advisers and authorities — where required by law, legal process, or to protect rights, safety and the integrity of the Service
  • Corporate transactions — a buyer or successor in the event of a merger, acquisition or asset sale, subject to this policy

5. International Transfers

We may transfer personal data outside the UK/EEA, including to the United States. Where we do, we rely on adequacy regulations/decisions, the UK International Data Transfer Addendum, and/or EU Standard Contractual Clauses, together with supplementary safeguards where appropriate.

6. Security

We apply technical and organisational measures including encryption in transit and at rest, access controls, authentication requirements, logging and monitoring, and vendor due diligence. See our Security Policy for details. No internet service can guarantee absolute security; you use the Service at your own risk to the extent permitted by law.

7. Your Rights

UK/EEA users may have the right to: access; rectification; erasure; restriction; portability; objection (including to direct marketing); withdrawal of consent; and to lodge a complaint with the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

California residents have the right to know, delete, correct, and opt out of "sale"/"sharing" of personal information (we do not sell or share personal information as defined by the CCPA/CPRA), the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights. Other US state residents (Colorado, Virginia, Connecticut, Utah and others) may have similar rights, including the right to appeal a refusal.

To exercise any right, contact us via the website contact form. We will verify your identity and respond within the legally required timeframe (generally 30 days UK/EU, 45 days US states). Authorised agents may submit requests on your behalf where permitted.

8. Deletion

You may delete individual records inside the Service at any time, and you may request full account and data deletion. Deletion requests are actioned within 30 days for active systems, with backup purging on rolling cycles, except where retention is legally required.

9. Cookies

We use essential, analytics and (with consent) marketing cookies. See our Cookie Policy for details and controls.

10. Children's Privacy

The Service is intended for business users and is not directed at children under 18. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA/UK where consent rules apply). If you believe a child has provided us data, contact us and we will delete it.

11. Automated Decision-Making

The Service does not make decisions producing legal or similarly significant effects about you based solely on automated processing. AI features provide recommendations that require human review — see our AI Usage Policy.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be announced via the Service or email, and the "Last Updated" date will be revised. Continued use after changes take effect constitutes acknowledgement of the updated policy.

13. Contact

North OS Technologies Ltd. — for any privacy or data protection request (access, rectification, erasure, portability, or objection), contact support@northos.co.uk with "Data Protection" in the subject line, or use the contact form on our website.

This document is a template and should be reviewed by a qualified solicitor before production use.