GDPR & Data Processing

For individuals visiting our site, buying a product or joining a waitlist, we are the controller. For business customers who upload their team's data into a paid product or sprint, we act as a processor on documented instructions in their order.

We rely on contract, legitimate interest, consent and legal obligation as described in our Privacy Policy.

Where personal data is transferred outside the EEA we use Standard Contractual Clauses and additional safeguards such as encryption in transit and at rest.

We use a small set of vetted subprocessors for hosting, email delivery, payments, AI inference and analytics. A current list is available on request at privacy@yournorthstar.cc.

Encryption in transit (TLS), encryption at rest, row-level security on our database, scoped access for staff, audit logging and least-privilege credentials. We notify affected customers and authorities of any qualifying personal-data breach within 72 hours.

You can request access, correction, deletion, restriction, portability and objection. Write to privacy@yournorthstar.cc. We respond within 30 days.

Business customers can request a signed Data Processing Agreement. Email privacy@yournorthstar.cc with your order details to receive the current DPA.