Privacy Policy
Last updated: June 28, 2026
Northstar is a product of The Data Duel / Northstar Lead Automation ("we", "us"). This policy explains what we collect, why, and how we protect it.
What we collect
- Account data: your email and a securely hashed password. We never store your password in readable form.
- Payment data: processed by PayPal. We do not store your full card or bank details — only a reference token PayPal gives us so we can bill you for what you authorized.
- Usage data: the scripts you generate and the click/conversion events that flow through your tracking links (timestamps, which page, which vendor, sale amounts reported by affiliate networks).
How your data is isolated
Every account's data is strictly separated at the database level using row-level security. No customer can ever query, see, or access another customer's clicks, sales, scripts, or account details. Isolation is enforced by the database itself, not just by application code.
How we use it
To run the service: authenticate you, generate your scripts, route and attribute your clicks, bill you, and show you your dashboard. We do not sell your data. We do not share it with third parties except the payment processor (PayPal), our email-delivery providers, and the affiliate networks whose postbacks you receive.
Email & marketing communications
We send two kinds of email:
- Service & operational emails (always): verification codes, receipts, billing notices, and important updates about the service, your account, security, policies, or material changes to how the product works. These are part of providing the service, so all active customers receive them.
- Marketing emails (opt-in only): product tips, new features, offers, and newsletters. We only send these if you explicitly opted in (for example, by ticking the optional box at signup). You can unsubscribe at any time using the link in every marketing email, or by emailing us — and we'll stop. Unsubscribing from marketing does not stop essential service emails.
We use a transactional email provider (Resend) and may use an email-marketing platform (Kit) to deliver these messages. We do not sell or rent your email address to anyone.
Cookies
We use a single secure, httpOnly session cookie to keep you logged in. We do not use third-party advertising or tracking cookies. Our click tracking is server-to-server and does not rely on cookies in your visitors' browsers.
Data retention & your rights
Click and conversion records are retained for the attribution window plus a limited audit period, then automatically deleted. You may request export or deletion of your account data at any time by emailing us. (GDPR/CCPA requests honored where applicable.)
Contact
Questions about privacy: [email protected].