Privacy notice

1. Scope and responsibility

This review draft covers northstone.app, the Northstone workspace, and support communications. The contracting legal entity, registered address, and designated privacy officer still require confirmation. It is not an effective final notice until those details and the practices below have been approved.

Northstone is powered by Loomlogic (loomlogic.io).

For account administration, website operations, security, and direct support, the service operator determines the purposes of processing. For contacts, transaction records, communications, and files uploaded by a customer organization, that organization generally determines the purposes and Northstone processes on its instructions. A separate signed data-processing agreement must define those roles. A brokerage’s own privacy notice also applies to its clients.

2. Information and sources

Information comes from you, workspace administrators, people authorized by the customer, connected services when enabled, and ordinary website requests. Collect only information needed for the intended task; avoid uploading identity documents, health information, payment-card details, or other sensitive records without an approved purpose and safeguards.

3. Purposes, legal bases, and consent

Proposed permitted purposes are providing requested services, authenticating users, maintaining security, assisting customers, and meeting legal obligations. For processing governed by GDPR, the appropriate basis must be documented for each purpose: contract for account services where appropriate, assessed legitimate interests for proportionate security, legal obligation where required, and consent for optional uses that require it. A business subscription alone does not establish a contractual basis for processing an employee’s personal information; assess the person’s relationship and the actual purpose. These bases are not interchangeable with Canadian consent requirements.

Under applicable Canadian and Québec rules, provide meaningful information before collection and obtain valid consent when required, including express consent for sensitive information where required. Optional marketing, tracking, recording, and new unrelated uses need their own assessment. Signing in or accepting service terms does not automatically authorize every processing purpose.

4. Service providers and disclosure

The current hosting and account architecture uses Vercel, Cloudflare, Google Firebase, and Supabase. Google Fonts supplies web fonts; OpenFreeMap supplies map styles and tiles when a map is displayed. These providers may receive ordinary network-request information. Communication, voice, calendar, geocoding, and AI capabilities can involve additional providers when a customer enables them. A capability listed in the product is not evidence that it is active for a particular workspace.

Before a production feature processes customer information, its actual recipients, contractual protections, purpose, access, region, and retention must be recorded in the approved subprocessor schedule. The current draft does not assert that every supported integration is an active recipient. Disclosures to advisers, authorities, or a business successor require a lawful basis, appropriate limits, and any required notice.

Sale of personal information and sharing for cross-context behavioral advertising have not been approved as purposes in this draft. This is not a verified statement about every provider’s independent practices; the operator must confirm actual arrangements before issuing a final notice. Applicable sale/sharing opt-outs and Global Privacy Control must be honored if such processing occurs.

5. International processing

Do not assume that information stays in Québec, Canada, or the European Economic Area. Hosting and provider choices can cause cross-border processing. The approved service schedule must identify relevant processing locations and transfer safeguards.

Before transferring Québec personal information outside Québec, perform the required privacy impact assessment and enter an appropriate written agreement. For restricted EEA transfers, establish a valid mechanism, such as applicable adequacy or appropriate contractual safeguards, and assess supplementary protections when needed. A provider’s marketing statement alone does not establish compliance.

6. AI, profiling, and human review

Northstone can display inferred facts, scores, summaries, and suggested actions. These may be incomplete, inaccurate, or biased. Review the AI transparency notice for permitted uses, limitations, and regional obligations.

The proposed service scope excludes solely automated decisions about housing eligibility, lending, employment, or other decisions with legal or similarly significant effects. A customer proposing such a use must first obtain a separate assessment and approval. Where applicable, an affected person must receive the required automated-decision notice, meaningful explanations and correction opportunities, and access to human review. A nominal reviewer who cannot change the outcome is insufficient.

7. Retention, deletion, and safeguards

Retain each category only for an identified service, contractual, security, or legal purpose. Customer instructions, account closure, legal recordkeeping, disputes, backups, and incident evidence affect the period. Exact periods and backup expiration still require owner approval; no automatic deletion timetable is promised by this draft.

Access restrictions, tenant permissions, secure transport, and audit controls support protection of information. Safeguards reduce risk but cannot guarantee absolute security. Incident handling must include investigation, containment, records, and notification to affected people and regulators when the applicable legal threshold is met.

A deletion request requires an authorized, tenant-specific plan that covers files, derived facts, connected providers, and backups, subject to documented lawful exceptions. Deleting an account in one service does not prove that all related records have been erased.

8. Your choices and rights

Send privacy requests to support@loomlogic.io. Specify your country or province, relationship to the workspace, relevant organization, and the request. Do not email passwords or identity documents. We may request proportionate verification or authority for a representative. If your information is in a customer’s workspace, we will coordinate with the responsible customer rather than disclose another organization’s records.

Depending on applicable law, rights may include access, correction, deletion, portability, restriction, objection, withdrawal of consent, and review of qualifying automated decisions. California residents may also have rights to know, opt out of sale/sharing, limit qualifying sensitive-information uses, and receive equal service when exercising rights. Québec portability applies to qualifying computerized information and excludes information created or inferred by the organization, with other statutory limits. Some rights have lawful exceptions.

Requests must be handled within the applicable statutory deadlines; generally PIPEDA and Québec private-sector access requests have a 30-day baseline, GDPR requests one month, and CCPA access/deletion/correction requests 45 days, subject to lawful extensions and specific exceptions. Withdrawal does not undo lawful prior processing. You may complain to the relevant privacy regulator, including the OPC, Québec CAI, California CPPA, or the competent EU supervisory authority.

9. Children and policy changes

Northstone is intended for authorized adult business users. It is not designed for children or for collecting children’s information. Report unintended collection through the privacy contact so the responsible organization can investigate.

The final notice must carry an effective date and a version. Material changes require appropriate notice and new consent where the law requires it. This draft’s review date is not an effective date.