Privacy policy
Effective 2026-09-01
1. Who we are
Northline Ops ("Northline", "we", "us") is a platform for managing client work. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we retain it, and the rights available to you.
2. What we collect
Account information
When you sign in with Google we receive your name, email address, and profile photo. We do not store passwords.
Workspace data you create
Clients, leads, projects, proposals, contracts, invoices, payments, time entries, documents, portal contacts, and every other record you enter into your workspace. You are the data controller for any personal data contained in these records (see our Data Processing Agreement).
Technical and operational data
- Service logs: basic technical details such as IP address and request outcome, used to protect the service. Retained for 90 days.
- Error reports: diagnostic information without your content. Retained for 90 days.
- Cookie consent state: your recorded consent choices and the policy version.
Analytics data (opt-in only)
If you grant analytics consent, we collect aggregated feature-usage counts, such as the number of invoices created and pages visited. We never collect the content of your records through analytics. Analytics cookies are off by default.
3. What we do not do
- We do not sell personal data to anyone.
- We do not use your business data for advertising.
- We do not train AI models on the content of your workspace.
- We do not share workspace data between customers.
- We do not use tracking pixels or third-party advertising cookies.
4. Legal basis for processing
| Processing activity | Legal basis |
|---|---|
| Operating your workspace | Performance of contract (these Terms) |
| Sending transactional emails | Performance of contract |
| Protecting the service from abuse | Legitimate interest (security) |
| Analytics | Consent (opt-in via cookie banner) |
| Browser push notifications | Consent (opt-in via cookie banner) |
| Responding to support requests | Performance of contract / legitimate interest |
5. How we use your data
We process your data solely to provide and improve the Service: running your workspace, delivering emails you send through the platform, presenting records to your team and portal clients, generating invoices, reconciling payments, and maintaining service reliability.
6. Who we share data with
We share data only with the sub-processors listed on our Sub-processors page. Each sub-processor is bound by its own security programme and publishes independent attestations. We do not add or change a sub-processor without updating that page.
We may disclose data if required to comply with a valid legal obligation, such as a court order, subpoena, or regulatory requirement. In such cases we will notify you where legally permitted.
7. International data transfers
Our sub-processors operate in the United States, the European Union, and India. We rely on the transfer safeguards published by each provider, including Standard Contractual Clauses where applicable. See Sub-processors for location details.
8. Data retention
| Data category | Retention period |
|---|---|
| Active account data | As long as your account is active |
| Cancelled workspace data | 30-day read-only grace → 90-day retention → permanent deletion |
| Deleted account data | 7-day reversal window → permanent deletion |
| Service and error logs | 90 days maximum |
| Disaster-recovery backups | 7-day rolling window, used only for recovery |
9. Your rights
Depending on your jurisdiction, you may have the following rights. All of these can be exercised from within the product or by emailing us.
- Access and export. Download your workspace data at any time from Account settings → Export Data. Formats include a complete backup, individual CSV files, and accounting exports for QuickBooks and Xero.
- Rectification. All records are editable inside the workspace at any time.
- Erasure. Delete your account and associated data via Account settings → Delete Account, subject to the 7-day reversal window.
- Client anonymisation. Anonymise a specific client's personal data through the compliance actions in the client record.
- Restriction and objection. Contact us to restrict or object to specific processing activities.
- Portability. Exports use standard JSON and CSV formats with no proprietary lock-in.
- Withdraw consent. Change analytics and push consent at any time via the cookie preferences in the footer.
- Lodge a complaint. You have the right to lodge a complaint with your local data protection authority.
10. Children's privacy
The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
11. Cookies
For details on what cookies we set, their purpose, and how to manage consent, see our Cookies Policy.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes are communicated via in-app notification and email at least 30 days before the new effective date. The effective date at the top of this page indicates the most recent revision.
13. Contact
Privacy questions or data-subject requests: privacy@northlineops.com.