Privacy Policy

1. Who we are

NorthQuest LLC ("NorthQuest", "we") runs the NorthQuest app and the website northquest.io. Contact: legal@northquest.io, 30 N. Gould Street, Ste N, Sheridan, WY 82801, USA.

This policy is the one privacy policy for everything NorthQuest runs. It explains how we handle personal data of website visitors, of people who use NorthQuest (account users), of our Done for you clients, and of personal data that our customers put into NorthQuest.

2. Two roles

For account users (your name, email, sign-in and billing details) NorthQuest decides how the data is used: we are the controller.

For data our customers add or sync (their leads, the emails they send and receive, notes and files) the customer decides: they are the controller and NorthQuest processes the data on their behalf as their processor or service provider. Our commitments to customers for that data are in the Data Processing Agreement.

See: Data Processing Agreement

3. If you received an email from a NorthQuest customer

The business that emailed you is responsible for having your details and for contacting you; NorthQuest provides the software it used. To stop its emails, use the unsubscribe link in the email or reply asking it to stop. To ask what data it holds about you, contact that business. You can also write to legal@northquest.io and we will pass your request to the business and help it respond.

4. Our website and its chat

On northquest.io you can chat with our assistant. The assistant is an AI, and a NorthQuest team member may read the conversation and reply in person. We store what you type in the chat, the business and contact details you choose to give (such as name, work email, company and website) and basic technical data (such as the time and your browser). We use it to answer your questions, see whether our service fits your business, follow up with you and keep business records.

To answer, the chat sends your messages to our AI provider, OpenAI. When you are ready to buy or ask for a person, we alert our team through Slack, with a short summary. If you go ahead with Done for you, the agreement is signed through BreezeDoc and paid through Stripe. Please don't type passwords, card numbers or other sensitive data into the chat. AI answers can be wrong; nothing in the chat is a contract.

We keep chat conversations to follow up and as business records. You can ask us to delete yours at any time at legal@northquest.io.

5. What we collect

Depending on how you use NorthQuest:

• Account data: name, work email, password (stored only as a hash by our authentication provider), authenticator settings and backup codes (stored hashed), signed-in devices (device, IP address, last activity). If you sign in with Google or Microsoft, we receive your name and email address from them.
• Workspace data: workspace names, team members and roles, invitations, settings.
• Mailbox connections: the email address of each mailbox you connect and an access credential (OAuth refresh token or SMTP/IMAP password), stored encrypted.
• Email and lead data you add or sync: leads, campaigns, sent emails, replies, bounce notices, attachment names and sizes, and, when a customer turns tracking on for a campaign, approximate open and link-click events. Attachment files are fetched from your mailbox when you download them; we don't store their contents.
• Billing data: plan, subscription status and invoices, held by Stripe. We never see or store full card numbers.
• Technical data: logs and error reports needed to run and secure the Service, with secrets removed before they leave the app.

6. Why we use it

To provide the Service you asked for (contract); to keep it secure, prevent abuse and enforce limits such as one free trial per company (legitimate interests); to bill you and keep records (legal obligation and contract); to send account emails such as confirmations, password resets, invitations and security notices (contract); to answer website chat questions, follow up and measure website visits you agreed to (legitimate interests and consent). We do not sell personal data, do not share it for cross-context behavioral advertising, and do not use it for advertising.

7. Google user data

When you connect a Google mailbox, NorthQuest asks for permission to send email and read email (Gmail send and read-only access). We use this access only to send the emails you create in NorthQuest, to find replies, bounces and the receipts of those emails, and to download attachments you request. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your permission, for security, or where the law requires.

NorthQuest's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft mailboxes are handled the same way, with Microsoft Graph permissions to read and send mail.

8. Who helps us

We use these service providers (sub-processors) to run NorthQuest:

• Supabase: database and authentication.
• Vercel: hosting of the app.
• Stripe: payments and invoices.
• Resend: account emails (confirmations, password resets, invitations and notifications).
• Sentry: error monitoring.
• Cloudflare Turnstile: bot checks on sign-in, sign-up and password reset.
• Anthropic: only if your workspace uses Draft with AI or NorthQuest AI, to write a reply draft from the conversation or to answer a question in the app using what you typed and a short summary of the workspace (counts and campaign names).
• OpenAI: answers in the website chat.
• Slack: internal alerts to our team about website chats and errors.
• BreezeDoc: signing Done for you agreements.
• Vercel Web Analytics and Speed Insights: website visit statistics, only if you accept analytics.
• Google, Microsoft and your SMTP/IMAP provider: only for the mailboxes you connect, to send and sync your email.
• Cal.com, Calendly, HubSpot, Pipedrive and Salesforce: only if you connect them, to record booked meetings or hand over opportunities.

See: Data Processing Agreement

9. Where data is stored

NorthQuest is based in the United States. We store and process your data in the United States, where our database and app run. Some of the providers above, such as Stripe, Google and Microsoft, operate worldwide under their own terms. For personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the EU Standard Contractual Clauses with the UK Addendum and the Swiss amendments, as described in the Data Processing Agreement.

See: Data Processing Agreement

10. How long we keep it

We keep account and workspace data while your account or workspace is active.

When a workspace is deleted or closed, sending stops at once and its data is erased 30 days later; until then it can be restored on request. When you delete your account, it is erased at once. Erased data may remain in backups for up to 30 more days.

We keep only billing records, the audit trail of account and workspace actions, the sign-in security log, records of who authorized sending from a mailbox, and suppression lists (people who unsubscribed or bounced, kept so they are never emailed again), and data we must keep by law.

Website chats are kept as business records until you ask us to delete them (legal@northquest.io).

11. Security

Encryption in transit, encrypted storage of mailbox credentials, workspace isolation checked by automated tests, two-factor authentication with backup codes, and immediate sign-out of removed team members. No system is perfectly secure; if a breach affects your personal data, we will notify affected customers and people, and authorities, as the law requires.

12. Your choices and rights

You can update your profile, export a workspace's data, disconnect mailboxes and delete a workspace or your account in the app. Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, to withdraw consent, and to complain to a data protection authority. Email legal@northquest.io; we may need to confirm your identity, and we answer within the time the law requires. Requests about data a customer holds are passed to that customer.

13. California and other U.S. state privacy rights

If you are a California resident (or live in another U.S. state with a similar law), you may ask to know what personal information we collected about you, to correct or delete it, and to opt out of its sale or sharing. In the last 12 months we collected the categories in sections 4 and 5 (identifiers, website chat messages and the business contact details given in the chat, account and billing records, internet activity such as sign-in and device data, and the email content our customers sync) for the purposes in section 6, and disclosed them only to the service providers in section 8. We have not sold or shared personal information, and we do not knowingly sell or share data of anyone under 16. We will not treat you differently for using these rights. You or an authorized agent can make a request at legal@northquest.io. For data a customer holds, NorthQuest is that customer's service provider and passes the request to it.

14. Cookies and local storage

The app uses only what it needs to work: your sign-in session, and preferences such as your theme, layout choices and unsent drafts stored in your browser. Cloudflare Turnstile checks the sign-in pages for bots.

The website stores your cookie choice and, if you open the chat, a chat ID so the conversation continues when you come back. Analytics (Vercel Web Analytics and Speed Insights) load only if you accept them in the cookie banner; you can change your choice by clearing the site's data in your browser. We use no advertising or cross-site tracking cookies.

15. Children

NorthQuest is a business tool and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data was given to us, email legal@northquest.io and we will delete it.

16. Changes

We will post updates here, change the date at the top, and tell account owners about material changes by email or in the app before they take effect.