1. Introduction
Northset ("we," "us," or "our") builds commitment assurance software that helps teams keep the commitments they make to each other. It works by analyzing signals from the tools your organization connects, such as Slack, GitHub, Google Calendar, Jira, Linear, and YouTrack. This policy explains what data we collect, how we use it, and the rights you have over it.
For workspace data from your connected tools, Northset acts as a data processor. Our customers, meaning the organizations that use Northset, are the data controllers. We process workspace data only on their instructions, under our customer agreement.
2. Information We Collect
Workspace data
When an administrator connects a tool, we read work signals such as who is working on what, its status and due dates, and the conversations where commitments are made. This data identifies individuals, including ticket assignees, pull request authors and reviewers, and Slack members. We link a person's identity across connected tools where that is needed to deliver alerts correctly.
Our Data access page lists exactly what we read from each tool, what we store, and for how long.
What we never collect
- We never read direct messages or group direct messages in Slack.
- The product contains no advertising trackers, third-party analytics, or session recording.
Usage data
Server and error logs needed to operate the service. These can include usernames and identifiers that appear in the events being processed.
3. How We Use Your Information
- Delivering the Northset service and surfacing alerts.
- Improving the service.
- Security monitoring and abuse prevention.
- Customer support and account communication.
Reporting is at the team level. Northset does not produce individual performance scores or comparisons. To decide who should get an alert, Northset works out who is best placed to act on each commitment. This is used only to route alerts and is never shown as a report. Individual alerts may name the people involved in the work they describe, because delivering the alert requires it.
4. Data Sharing
We share data only with the subprocessors needed to run the service.
- Render. Cloud hosting and PostgreSQL database, in the United States.
- Sentry. Error monitoring. Error reports are scrubbed before sending, but may include identifiers such as repository names or ticket keys.
- Anthropic. AI analysis to detect commitments and write alerts. Anthropic receives Slack message content, Jira comment text when your history is first imported, and basic facts about issues mentioned in messages, which are the issue ID, whether it is open or done, whether anyone is assigned (never who), its due date, and when it last changed. Anthropic is contractually prohibited from training on customer data. Anthropic deletes what we send it within 30 days, except where it must keep data longer to enforce its usage policy or to comply with the law.
Alerts are delivered into your own Slack workspace. We do not sell personal information. We do not share data with advertisers and do not run advertising on the product.
5. Data Retention and Deletion
Retention
We keep workspace data while your organization is connected, except where a shorter period applies. Raw events that GitHub and Jira send us are redacted within hours and deleted within 30 days. Records of who changed, was assigned to, reviewed, or commented on work are kept for 8 weeks. One-sentence AI-written summaries of commitments, and the text of alerts, are deleted 3 years after they were last updated, or sooner when the original message is deleted. The Data access page lists the period for each tool.
Deletion
To delete your organization's data, email privacy@northsetapp.com. We permanently delete it from production systems within 30 days of a verified request, and confirm by email when it's done, including any steps left on your side.
Removing Northset from a tool stops new data from being read, but does not delete what is already stored. Email us to delete it.
When we delete your data, we remove our own access to GitHub, Slack, and Google Calendar. If another Northset organization uses the same Slack workspace or GitHub installation, the app stays installed for them. Atlassian, Linear, and YouTrack do not let apps remove their own access, so your administrator removes it. This means removing Northset from your Atlassian connected apps (including any Forge app or webhook), deleting the Linear API key, and deleting the YouTrack permanent token.
What remains after deletion
- Records of your organization's lifecycle, such as when it was disabled and deleted, and the result of removing our access.
- Alerts already delivered to your Slack workspace.
- A record of the access code used to sign up.
- Combined counts and benchmarks across customers, which contain no content from your tools, kept for up to 2 years.
- Copies in service logs, error reports, and database backups, until they expire on their normal schedules.
6. Security
How we protect your data is described on our Security page.
7. International Transfers
Northset is hosted on Render's infrastructure in the United States, so customer data is processed and stored in the US. For customers subject to GDPR, we support transfers under Standard Contractual Clauses. Contact us to put them in place.
8. Your Rights
Subject to applicable law, you have the following rights over your personal data.
- GDPR. Access, deletion, portability, restriction, rectification, and objection.
- CCPA/CPRA. The right to know, delete, and opt out of the sale or sharing of personal information. Northset does not sell personal information.
To exercise any of these rights, email privacy@northsetapp.com. If you are an end user of a Northset customer, please contact that customer first. We will help them respond.
9. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days notice by email and in the product before the changes take effect.
10. Contact
Questions, requests, or concerns about this policy can be sent to privacy@northsetapp.com.