Northwarden Privacy Policy

This Privacy Policy applies to:

• the Northwarden website;
• Northwarden software and applications;
• Northwarden customer accounts;
• integrations with third-party services;
• communications with Northwarden;
• information processed when Northwarden performs scans, monitoring, alerts, and related services.

When a business customer connects systems containing information about its own customers, employees, vendors, subcontractors, or other persons, Northwarden generally processes that information on behalf of the business customer.

In those circumstances, the business customer determines why the information is processed and Northwarden acts as a service provider or processor, as applicable under relevant privacy laws.

We use information to:

• provide and operate Northwarden;
• authenticate users;
• connect authorized third-party accounts;
• perform requested scans and monitoring;
• identify possible operational, financial, customer-service, pricing, and workflow issues;
• generate Northwarden Findings;
• show customers the sources supporting a finding;
• maintain scan history and account settings;
• send alerts and service-related notifications;
• provide customer support;
• process subscriptions and payments;
• diagnose technical problems;
• prevent fraud, abuse, and unauthorized access;
• protect Northwarden, our customers, and our systems;
• comply with legal obligations;
• enforce our agreements.

Northwarden does not use Connected Service Data for unrelated purposes.

Email integrations are a core example of information that requires heightened protection.

When you connect Gmail, Google Workspace, Outlook, Microsoft 365, or another supported email service, Northwarden may access authorized email information for the purpose of detecting business issues and providing features visible to you in Northwarden.

Depending on the service and permissions you approve, this may include message metadata, sender and recipient information, subject lines, timestamps, snippets, message content, labels, thread or message identifiers, and attachment metadata.

For Gmail, Northwarden currently uses read-only access. Northwarden does not send, modify, label, archive, trash, or delete Gmail messages. Northwarden does not download or store Gmail attachment contents; it may retain attachment metadata such as filename, MIME type, size, and an attachment identifier.

Northwarden may retain relevant business-message information that has been synchronized into Northwarden so that historical findings, evidence, and business records remain available after an integration is disconnected. Messages determined not to be relevant to the enabled business-monitoring features may be discarded without being stored.

Northwarden does not claim ownership of your email.

Northwarden will not use connected email content to:

• sell information about you or your customers;
• build advertising profiles;
• serve targeted advertising;
• provide data to data brokers;
• determine a person's creditworthiness;
• conduct unrelated surveillance;
• market third-party products based on private email content.

Northwarden personnel are not permitted to freely browse customer inboxes.

Human access to Connected Service Data will be restricted to circumstances such as:

• when the customer specifically requests support and authorizes access necessary to resolve the issue;
• investigating a security incident, abuse, or technical problem where access is reasonably necessary;
• complying with applicable law or a valid legal requirement.

Access should be limited to the minimum information reasonably necessary for the applicable purpose.

If you connect a Google account, Northwarden receives Google user data only after you authorize access through Google's OAuth authorization process.

Northwarden currently requests the Gmail read-only permission necessary to provide its Gmail monitoring and reconciliation features. This permission allows Northwarden to read Gmail information needed to identify relevant business communications and supporting evidence, but it does not allow Northwarden to send, modify, archive, label, trash, or delete Gmail messages.

For Gmail messages determined to be relevant to enabled Northwarden features, Northwarden may process and retain:

• Gmail message and thread identifiers;
• RFC Message-ID values;
• sender, recipient, and copy-recipient information;
• subject lines;
• timestamps;
• Gmail snippets;
• plain-text message body content;
• Gmail label identifiers;
• attachment metadata, including filename, MIME type, size, and attachment identifier;
• business information derived from the message, such as amounts, topics, relevance indicators, and supporting evidence for Northwarden Findings.

Northwarden does not download or store Gmail attachment contents as part of the current Gmail integration.

Information obtained through Google APIs is used only to provide or improve user-facing Northwarden functionality, including monitoring, reconciliation, historical records, and findings that are visible to the customer.

Northwarden's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data will not be:

• sold;
• transferred to advertising platforms or data brokers;
• used for targeted or personalized advertising;
• used for determining creditworthiness or lending eligibility;
• used for purposes unrelated to the functionality authorized by the user;
• used to create, train, or improve a generalized machine-learning or artificial-intelligence model where prohibited by Google's applicable policies.

Northwarden does not currently send Gmail message content to third-party artificial-intelligence services, advertising services, analytics providers, or data brokers for processing.

Any service provider that processes Google user data on Northwarden's behalf must process that information only as necessary to provide Northwarden's authorized functionality and must be subject to appropriate confidentiality and data-protection obligations.

Users may revoke Northwarden's future Google access through their Google account permissions or through functionality provided by Northwarden where available. Revoking or disconnecting Google access stops future access under that authorization but does not automatically delete Google-derived information that Northwarden previously synchronized and retained as part of its historical records.

A user who wants Google-derived information permanently removed from Northwarden may submit a verified deletion request using the contact information in Section 26. Northwarden will honor eligible deletion requests subject to applicable law and legitimate retention requirements.

When you connect a Microsoft account, Northwarden accesses Microsoft data only after the appropriate user or administrator grants permission.

Northwarden is designed to request only permissions reasonably required for enabled functionality.

Microsoft account information is used to provide the Northwarden features for which access was authorized and is subject to the protections described throughout this Privacy Policy.

Users or administrators may revoke applicable Northwarden permissions through Microsoft account or organization controls.

When you connect accounting, job-management, CRM, payment, estimating, or other third-party platforms, Northwarden processes information obtained from those platforms only as necessary to provide the Northwarden services you enabled.

Each third-party service operates under its own privacy policy and terms.

Authorizing Northwarden does not alter your independent relationship with the third-party provider.

Business customers are responsible for ensuring that they have the right and lawful authority to connect accounts and provide information to Northwarden.

A customer that connects an inbox, accounting account, business system, or other data source represents that it has the authority necessary to authorize Northwarden to process the information for the purposes described in this Privacy Policy and the customer's agreement with Northwarden.

Customers remain responsible for their own privacy notices, employee policies, customer disclosures, consent requirements, and other legal obligations applicable to information they control.

Northwarden follows the principle that business information should not be collected or retained merely because it is available.

We seek to limit collection and processing to information reasonably necessary to:

• perform requested monitoring and scans;
• substantiate findings;
• maintain historical business records requested by the customer;
• provide customer-requested functionality;
• protect the Service.

Northwarden may filter or discard information that is not relevant to enabled monitoring features. For example, Gmail messages classified as non-business or otherwise irrelevant to Northwarden's enabled functionality are not intended to be stored as provider records.

Where reasonably possible, Northwarden is designed to retain findings, calculations, identifiers, source references, and relevant supporting records rather than unnecessary copies of entire third-party data sources.

Northwarden retains information for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, preserving customer-requested historical records and evidence, meeting contractual obligations, resolving disputes, maintaining security, and complying with law.

Different categories of information may have different retention periods.

For example:

• Account information may be retained while your account is active and for a limited period afterward as necessary for legal, accounting, security, or dispute-resolution purposes.
• Authorization credentials and access tokens are maintained only while required to operate a connected integration and should cease to be usable when the integration is properly disconnected or authorization is revoked.
• Northwarden Findings, scan history, and relevant supporting records may remain available as part of the customer's historical Northwarden record even after the originating integration is disconnected.
• Relevant synchronized email content may be retained when continued retention is necessary to preserve historical findings, evidence, reconciliation results, or other customer-requested Northwarden functionality.
• Disconnecting an integration does not, by itself, delete information that was previously synchronized into Northwarden.
• A customer may submit a verified request to delete eligible personal information or Google-derived information as described in Section 16.
• Backups may temporarily retain deleted information until backup copies are overwritten through normal backup cycles.

When information is deleted pursuant to an eligible request, Northwarden will delete or de-identify the applicable information subject to legal, security, accounting, dispute-resolution, and other legitimate retention requirements.

Northwarden does not sell customer Connected Service Data.

Northwarden does not sell private email content.

Northwarden does not share Connected Service Data for cross-context behavioral advertising or targeted advertising.

We may disclose information in the following limited circumstances.

Northwarden does not sell personal information in exchange for money.

Northwarden does not sell Connected Service Data to:

• advertisers;
• lead brokers;
• information resellers;
• data brokers;
• marketing databases.

If Northwarden's practices change in a manner that legally constitutes a sale or sharing requiring an opt-out right, we will update this Privacy Policy and provide legally required controls before implementing that practice.

Northwarden does not use the contents of connected business accounts, private emails, invoices, customer records, or other Connected Service Data to target advertisements.

If Northwarden conducts general marketing for its own services, marketing decisions will not be based upon the private contents of a customer's connected accounts.

Northwarden takes the security of customer information seriously and maintains reasonable administrative, technical, and organizational safeguards designed to protect information against:

• unauthorized access;
• unauthorized disclosure;
• alteration;
• loss;
• misuse;
• destruction.

Security measures may include access controls, authentication protections, encryption, logging, credential protections, software updates, and restrictions on personnel access.

Connected-service OAuth access and refresh tokens are protected using application-level encryption before storage. Other customer information is protected through the security controls of Northwarden's hosted infrastructure, including encryption at rest where provided by the hosting platform and account-level access controls designed to restrict records to the applicable customer.

Access to sensitive customer information should be limited to personnel and service providers who have a legitimate need for access.

No internet-connected system can be guaranteed to be completely secure. Accordingly, Northwarden cannot guarantee that unauthorized third parties will never defeat security measures.

If Northwarden discovers a data-security incident requiring notification under applicable law, we will provide legally required notifications.

You control whether Northwarden is connected to supported third-party services.

You may disconnect supported integrations through Northwarden or the applicable third-party provider where those controls are available.

Disconnecting or revoking an integration stops future access under the revoked authorization. It does not automatically delete information that Northwarden previously synchronized, generated, or retained as part of the customer's historical Northwarden record.

For Google integrations, users may also revoke Northwarden's authorization through their Google Account permissions.

Deletion of previously synchronized information is a separate process described below.

Customers may request deletion of their Northwarden account, eligible personal information, or Google-derived information by contacting Northwarden at the address listed in the Contact Us section.

Northwarden does not require customers to delete historical records merely because an integration is disconnected. Historical records may continue to be retained as part of the Service unless the customer submits a separate deletion request or another retention rule applies.

For a request involving Google-derived data, Northwarden may verify the requester's identity and authority over the applicable Northwarden account before processing the request.

Subject to applicable law and legitimate retention requirements, Northwarden will delete or de-identify eligible information covered by a verified deletion request.

Certain information may be retained where reasonably necessary to:

• comply with law;
• prevent fraud or abuse;
• maintain security records;
• resolve disputes;
• enforce agreements;
• maintain financial or tax records;
• demonstrate compliance.

Disconnecting an integration, requesting deletion of Google-derived data, and deleting a Northwarden account are separate actions.

Depending on where you live, applicable law may give you certain rights regarding your personal information.

These rights may include the right to:

• know whether we process your personal information;
• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• obtain a portable copy of certain information;
• object to or restrict certain processing;
• opt out of certain sales or sharing;
• opt out of certain targeted advertising;
• appeal a denied privacy request;
• receive equal service without unlawful discrimination for exercising privacy rights.

Northwarden does not discriminate against users for exercising rights available under applicable privacy law.

To exercise an applicable privacy right, contact us using the information below.

We may need to verify your identity before completing a request.

If Northwarden holds information solely on behalf of one of its business customers, we may direct the request to that business because the customer controls that information.

Where the California Consumer Privacy Act, as amended, applies, California residents may have rights including access, correction, deletion, portability, opt-out, limitation of certain uses of sensitive personal information, and protection against discrimination.

Northwarden does not sell personal information for monetary consideration and does not use Connected Service Data for cross-context behavioral advertising.

California residents may contact Northwarden using the information below to exercise applicable rights.

Residents of Connecticut and other states with applicable comprehensive privacy laws may have additional rights concerning access, correction, deletion, portability, targeted advertising, sales of personal information, profiling, and appeals.

Northwarden will honor applicable rights where required by law.

Northwarden is based in the United States.

If you access Northwarden from outside the United States, information may be transferred to and processed in the United States and other countries in which Northwarden or its service providers operate.

Where legally required, Northwarden will use appropriate safeguards for international transfers of personal information.

Northwarden may use cookies, local storage, session technologies, and similar mechanisms necessary to:

• authenticate users;
• maintain sessions;
• remember preferences;
• protect account security;
• operate website functionality.

Northwarden does not use Connected Service Data to create advertising cookies or advertising profiles.

If we introduce non-essential analytics, advertising, or tracking technologies that require notice or consent under applicable law, we will provide the appropriate disclosures and controls.

We may send administrative communications concerning:

• security;
• account activity;
• integrations;
• billing;
• subscription status;
• significant product changes;
• privacy or legal updates.

These transactional messages may be necessary to provide the Service.

Marketing communications, where used, will include any opt-out mechanisms required by applicable law.

Northwarden may automatically analyze authorized business information to identify patterns, discrepancies, possible missed items, operational risks, or other findings.

Northwarden Findings are intended to assist business owners and personnel.

They should not be treated as guaranteed determinations of financial loss, legal liability, accounting accuracy, fraud, or wrongdoing.

Northwarden does not use this analysis to make decisions producing legal or similarly significant effects concerning individuals on behalf of advertisers, lenders, employers, insurers, or data brokers.

Northwarden is a business service and is not directed to children.

Individuals under 18 should not independently create or operate a Northwarden business account.

We do not knowingly collect personal information directly from children for the purpose of providing individual consumer accounts.

Business information processed on behalf of customers may incidentally contain information concerning individuals of various ages. Such information is processed only as part of the customer's business data and subject to the restrictions in this Privacy Policy.

We may update this Privacy Policy as Northwarden changes or as legal requirements evolve.

When we make changes, we will update the "Last Updated" date at the top of this policy.

If changes materially affect how we use customer information, we will provide additional notice when required by law or when reasonably appropriate.

We will not retroactively use Google user data or other sensitive Connected Service Data for materially different purposes without obtaining authorization where required.

Questions, privacy requests, deletion requests, or concerns regarding this Privacy Policy may be directed to:

Northwarden

Website: northwarden.org

Support and Privacy Email: support@northwarden.org

Customers may also contact Northwarden through any privacy or support mechanism provided within the Service.

For requests to delete Google-derived data, please identify the Northwarden account associated with the request. Northwarden may take reasonable steps to verify account ownership or authority before completing the request.