Legal

Privacy Policy

Effective date: 6 June 2026

1. What we collect

We collect only what is necessary to deliver the diagnostic experience and its outputs:

Identity data: name, work email, role, and organisation — collected at intake to issue credentials and coordinate team sessions.
Diagnostic responses: scenario choices, dimension scores, and written reflections — stored to generate your Coalition Map, Tension Map, and Strategist Brief.
Technical data: session codes, completion timestamps, and archetype classifications — used for session management and product improvement.

Our hosting and error-monitoring providers process IP addresses and request metadata to deliver and secure the service. We do not use IP addresses to profile individuals. We do not use third-party analytics that track individuals across sessions.

2. How we use it

To generate your personal or team diagnostic outputs.
To issue and verify credentials.
To coordinate multi-participant team sessions.
To notify you of session milestones (completions, brief readiness).
To improve the diagnostic instrument (only in aggregated, anonymised form).

We may combine anonymised scored responses from many organisations to improve our instruments and build benchmarks. Written reflections are not included unless you explicitly agree. This data can't identify you or your organisation, and we never try to re-identify it.

Individual responses are accessible to you and to the session owner. Reflection excerpts can appear in the session owner's participant detail and in the Strategist Brief. Your personal Reckoning is not shown in team outputs.

3. Legal basis

POPIA (South Africa): Personal information is collected with your knowledge via the intake form and used for the stated diagnostic purpose. It is shared only with the processors listed in section 5, to deliver the service.

GDPR (EU/UK): Processing is based on contractual necessity (delivering the diagnostic you requested) and legitimate interest (session coordination and product improvement). You may withdraw consent or request deletion at any time.

4. Data retention

We keep diagnostic responses for as long as needed to provide your outputs and the rescore cycle. We're finalising a formal retention schedule and will update this page when it's in place. You can ask us to delete your responses at any time by emailing support@usenorth.xyz; we action verified requests within 30 days. If your organisation arranged the diagnostic, it is the controller of that data and we may pass your request to it to decide.

5. Third parties

We use the following service providers to run NORTH. Personal information is shared only with these processors, to deliver the service. Each processes it only on our instructions.

Supabase: Data is stored in the EU (Paris, France) with Supabase. It processes all account and diagnostic data.
Vercel: website hosting and delivery; may process data outside South Africa. Processes all site traffic, including IP addresses and request metadata.
Upstash: rate limiting and caching; may process data outside South Africa. Processes short-lived request and session metadata.
Resend (United States): transactional email. Processes email addresses, names and session links.
Stitch: payment processing; may process data outside South Africa. Processes name, email address and payment amount.
Sentry: error monitoring only, and only where enabled. It runs in the email delivery function when a Sentry DSN is configured, and the website does not send errors to Sentry. A report contains the error message and, if an email send fails, the email provider's error response.
Vercel AI Gateway (Zhipu GLM 5.3 Flash): the AI provider. Generates Strategist Briefs and suggestions. Processes reflection text, participants' first names and organisation name.

6. Your rights

You have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (right to be forgotten).
Export your data in a portable format.
Object to processing for product improvement purposes.

To exercise any of these rights, email support@usenorth.xyz. We action verified requests within 30 days.

7. Data residency

Cross-border transfers. Some of these providers, including the Vercel AI Gateway (Zhipu GLM 5.3 Flash) and Resend, process data in the United States, outside South Africa and the EU. We rely on contractual safeguards with each of these providers, as required by section 72 of POPIA and, where it applies, the GDPR.

8. Changes to this policy

We review this policy with each significant change to data handling or infrastructure. Material changes will be notified by email to active users and posted on this page 30 days before taking effect.

Our Information Officer under POPIA is Neville Daniels. You can reach them at support@usenorth.xyz.

Questions? Contact us at support@usenorth.xyz.