Privacy Policy
NorthStar OS is operated by Infinite Way Ventures LLC (“we,” “us,” or “our”). This policy explains how we collect, access, use, store, share, and delete information in our business operating workspace, including data you authorize us to access through Google.
Your Google connection is optional. Signing in with Google identifies your account. Connecting Google services is a separate permission decision. We use connected Google data for the features described below, not for advertising or training general-purpose AI models.
1. Information we process
- Account information: Your email address, name, business name, account identifiers, authentication details, and workspace membership.
- Workspace information: Contacts, customer notes, priorities, business plans, content, reports, settings, and other material you enter, import, or generate in NorthStar.
- Operational information: Service requests, error and security logs, browser or device information provided with requests, and connection settings needed to operate and protect the service.
- Billing information: Subscription status and payment references used to manage access. Payment processing is handled through Stripe; NorthStar does not require you to enter payment card details directly into its workspace.
- Website tracking and lead information: If a workspace connects its site tracker or lead forms, we process page-view events, site identifiers, and submitted contact or audit details for that workspace's analytics and CRM features.
We use this information to provide the workspace, authenticate users, save work, operate integrations, process authorized messages, provide support, manage subscriptions, and protect the service. Workspace owners are responsible for having permission to upload or collect information about their contacts and site visitors.
2. Google account access and purposes
Google authorization happens through Google's sign-in or consent interface. You can decline Google service access and continue to use features that do not need it. Available features depend on your subscription and the permissions you grant.
| Feature | Data accessed | Purpose |
|---|---|---|
| Sign in with Google | Google account identifier, email address, email-verification status, and available name/profile information. | Verify your identity and create, link, or sign in to your NorthStar account. Sign-in alone does not authorize Analytics, Search Console, or Gmail access. |
| Google Analytics | Accessible Analytics accounts and properties, property identifiers, and aggregate session and active-user metrics for your selected property and reporting period. | Let you select an accessible property and display its performance in KPI Manager and connected reporting views. Access is read-only. |
| Search Console | Accessible site identifiers and permissions, and search-performance information such as queries, clicks, and impressions for the selected site. | Let you select a site and review search performance in the Google tools view. Access is read-only. |
| Gmail sending | The recipient, subject, and message you provide, a send response/message identifier, and permission to send through the connected Google account. | Send a message you initiate through the Gmail Send feature. The requested send permission does not authorize reading your inbox or existing messages. |
Permission choices: The KPI Manager connection requests Google Analytics read-only access. The broader Google connection requests Analytics read-only, Search Console read-only, Gmail send, and basic identity permissions. Review the permissions shown by Google before approving that connection. NorthStar does not request Google Drive or Google Calendar access in these connection flows.
Email delivery: Connecting Google does not automatically enroll contacts in nurture messages. NorthStar's nurture email delivery through Resend is a separate feature using workspace contact information and authorized email content.
3. Storage, protection, and retention
NorthStar stores account and workspace records in its service database. For a connected Google service, it stores the connection's account label, granted permissions, selected property or site, connection status, and an encrypted refresh token. The refresh token lets NorthStar obtain temporary access tokens to refresh reports or perform the actions you authorize without repeatedly asking you to connect.
Google reports are fetched to display in the app. Selected property and site settings are saved; reports or derived information you choose to save, export, or copy into workspace records can remain with those records. Information displayed in the browser is processed in your session, and authentication information may be retained in browser storage to maintain sign-in.
We use HTTPS for network requests, encryption for stored Google refresh tokens, and authenticated, business-scoped access checks for workspace APIs. These measures reduce risk but do not guarantee that any online service is completely secure.
Account and workspace records are retained while needed to provide your service, until deletion is requested, or as needed for security, billing, legal obligations, or dispute resolution. A connected Google refresh token is retained until its connection is removed or the related records are deleted. Copies in backups or required records may remain until their applicable retention lifecycle completes. Revoking Google's authorization stops authorized API access but does not automatically delete your NorthStar account, saved reports, or exported files.
4. Sharing and service providers
We use service providers for hosting, database storage, payment processing, transactional email, and support. They process information necessary to perform those services. Google receives requests necessary to authenticate your account, retrieve authorized reports, or send a message; Gmail recipients receive the message you choose to send. Authorized members of your business workspace may access information available to that workspace.
When you request an AI drafting feature, your submitted prompt and relevant workspace inputs may be processed by the configured AI provider, such as OpenAI or Anthropic. The Google reporting and Gmail connection flows described above do not automatically send their API responses or credentials to those AI providers.
We do not sell Google user data. Transfers of Google user data are limited to providing or improving the visible features you authorize with your consent, necessary security purposes, applicable legal obligations, or a business transfer only after obtaining your explicit prior consent. These restrictions also apply to aggregated or derived Google data.
5. Google API Services and Limited Use
NorthStar OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- Google user data is used only to provide or improve appropriate user-facing features that are visible in NorthStar.
- Google user data is not used or transferred for advertising, retargeting, data-broker services, surveillance, creditworthiness, or lending decisions.
- Google user data is not used to develop, improve, or train generalized or non-personalized AI or machine-learning models.
- We do not allow human access to Google user data except with your affirmative agreement to view specific data, when necessary for security or applicable law, or for permitted internal operations using aggregated data consistent with Google's policy.
6. Disconnecting, revoking, and deleting information
- Disconnect Analytics: Use the Google disconnect control in KPI Manager. This removes the Google connection record, including its stored credential and connection settings, from the active service database.
- Disconnect a broader Google connection: Remove the Google connection from Integrations. This removes the stored connection record and credential. Because the connection is shared by the business's Google features, removing it can affect those features too.
- Revoke Google's authorization: Visit your Google Account's third-party connections, choose NorthStar OS, and remove its access. Reconnecting requires a new authorization decision.
- Request deletion or correction: Email support@infinitewayventures.com with your NorthStar account email and the information or workspace involved. We verify your identity and authority before processing the request. Do not send passwords, OAuth tokens, or payment card information.
Disconnecting does not delete messages already sent, data held by Google, records you separately saved in NorthStar, or exports held by you or others. You can delete supported workspace items in the app or ask us to help with remaining records. Removing a Google service connection is separate from deleting an account that uses Google sign-in.
7. Browser storage and external services
NorthStar uses browser storage to support authentication and the app's operation. Google sign-in and connected providers may use their own cookies or storage under their policies. Public pages may load fonts from Google Fonts, which receives the network information necessary to serve those files. Links to other services take you to their own websites and privacy practices.
8. Children and policy updates
NorthStar is a business service and is not directed to children under 13. Contact us if you believe a child's information was provided. We update this policy when our practices change. Material changes in Google data access or use will be disclosed, and we will seek additional consent before using Google data for a new purpose requiring it.
9. Contact
Operator: Infinite Way Ventures LLC
Application: NorthStar OS
Privacy, data requests, and support: support@infinitewayventures.com.