Northlav Cloud Privacy Policy

1. Operator identity and system structure

Northlav Cloud is a business technology platform operated by Northlav Studio, a brand operated by Andy Alejandro Alemán Chávez, a sole trader registered in Costa Rica.

• Northlav Studio: trade name and developer.
• Northlav Cloud: SaaS platform subscribed to by customers to manage their business.
• Northlav OS: internal administration environment used exclusively by authorized Northlav Studio staff for development, support, security audits and technical operations.

2. Data processing roles and applicable laws

Northlav operates from Costa Rica, so its baseline is Law No. 8968, which recognizes individuals’ rights over their personal data and requires strict confidentiality from everyone involved in processing it. Northlav Cloud serves businesses in Latin America and the United States; where the data protection law of the country or state where a person is located grants more rights or protection, Northlav also honors it (see sections 9 and 13).

3. Multi-tenant architecture and data isolation

Northlav Cloud uses a multi-tenant architecture with logical separation. Each customer’s data is isolated with Row Level Security (RLS) policies in the database, so one business’s conversations, knowledge base and customers are inaccessible to other organizations.

4. AI active memory and CRM history

Our AI agents (Mortis and TIMO) use an active window of up to 50 conversation messages, plus structured summaries, CRM data and knowledge bases to generate contextual replies.

ℹ️ The history kept in the CRM at the Customer’s request may be longer than the 50-message active window used by the agents.

5. Channels and integrations

Northlav Cloud supports connecting WhatsApp, Telegram, Instagram, Messenger and future communication channels.

Some integrations (Instagram, Messenger, WhatsApp Embedded Signup and WhatsApp Coexistence) depend on permissions, app reviews, number eligibility and technical availability from their providers (Meta Platforms, Inc.).

When a business disconnects its Instagram account, or asks Meta to delete its data, Northlav deletes that account's access token and link. See Data deletion.

6. Data we process

Depending on the features the Customer enables, Northlav Cloud may process:

• Account data: name, email, phone, company, encrypted credentials and roles.
• Messages and media: text, images, voice notes, videos and documents from conversations.
• CRM data: pipeline stages, labels, opportunities, summaries and AI inferences.
• Knowledge base: documents, FAQs and catalogs uploaded for the agent.
• Technical data: IP addresses, session records, admin logs and human-intervention history.
• Billing data: plan, subscription status and Paddle customer and transaction IDs. Northlav never receives or stores card numbers: customers enter them directly with Paddle.

7. Service providers (processors)

To provide the service we use these providers, which process data only on Northlav’s behalf:

• Paddle.com (UK / US): authorized reseller and Merchant of Record. Processes payments, subscriptions, taxes, invoices and refunds. It handles payment data under its own privacy policy.
• Supabase (US): database and authentication.
• Vercel (US): application hosting.
• Cloudflare (US): media storage and bot protection.
• Google (Gemini API) and OpenAI (US): AI models that draft replies.
• Meta Platforms, Inc.: WhatsApp and Instagram channels connected by the Customer.

Full list at Subprocessors.

8. AI use and no cross-training

Northlav Cloud uses language models from providers such as Google Cloud (Gemini) and OpenAI. None of them use content sent through our API to train their models; with OpenAI we also request that conversations are not stored.

Northlav does not use a Customer's private conversations to train general models for other customers.

9. Your rights over your data

Wherever you are, you may request:

• Access: know which of your data we process and why.
• Rectification: correct inaccurate or incomplete data.
• Erasure: have it deleted when it is no longer needed or you withdraw consent.
• Objection: have us stop processing it for a specific purpose.
• Portability: receive your data in a commonly used format, where the law recognizes it.
• Withdraw consent you have given, without affecting prior processing.

For account data or requests to Northlav, email northlavstudio@gmail.com with your name, the right you want to exercise and how to reach you. We respond within the period set by the applicable law. For data collected by a business customer (for example, your conversations with a store), contact that business, which is the controller; if the request reaches us, we forward it and help them handle it. For payment data, you may also contact Paddle.

If you are not satisfied with the response, you may file a complaint with the data protection authority in your country:

In countries without a general data protection law, Northlav recognizes these same rights.

10. International transfers

The providers listed in section 7 host or process data outside Costa Rica and the Customer's country, mainly in the United States. Before using a provider, Northlav checks that it offers contractual confidentiality and security commitments and processes data only to provide its service.

Where the law of the country of origin requires an additional safeguard to transfer data (for example, model contractual clauses such as those of the Ibero-American Data Protection Network or Brazil's ANPD), Northlav includes it in its relationship with the Customer through the Data Processing Agreement (DPA).

11. Minors

Northlav Cloud is a service for businesses: accounts may only be opened by people over 18 acting on behalf of a business. If a business customer serves minors through its channels, it is responsible for complying with its country’s law on minors’ data, including parental or guardian consent where required.

12. Responsible AI data extraction and prohibited data

Customers who configure extraction fields for their agent (Mortis) must follow the principles of data minimization, purpose limitation and lawfulness (Law No. 8968 and the data protection law of their country, see section 9). Configuring agents to request, store or process the following is strictly prohibited:

• Sensitive financial data: card numbers, CVV/CVC, PINs, bank credentials, IBANs or transfer tokens.
• Credentials: passwords, private keys, API tokens, 2FA seeds or OTP codes.
• Health and biometrics: medical records, diagnoses, treatments, DNA, fingerprints or facial recognition.
• Scanned official documents: ID cards, passports or driving licenses.
• Special categories: religion, politics, union membership, sexual orientation or ethnic origin.
• Criminal records and minors: judicial records or data about minors without legal consent.

13. Notice for United States residents (including California)

This section supplements this policy for people who reside in the United States, in particular under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other state privacy laws (such as those of Virginia, Colorado, Connecticut, Utah, Texas and Oregon). Some of these laws only apply to companies above certain thresholds; Northlav extends these rights to all United States residents regardless.

13.1. Personal information we collect and its sources

In the past 12 months we have collected these categories, for the purposes described in sections 2 to 8:

• Identifiers: name, email, phone number, account username and IP address.
• Commercial information: subscribed plan, subscription status and payment history (processed by Paddle).
• Internet activity: session and dashboard usage logs.
• Audio and electronic information: messages, voice notes, images and documents from the conversations the Customer connects.
• Inferences: pipeline stage, interests and summaries the CRM generates for the Customer.
• Sensitive personal information: only account login credentials, which we use solely to give you access and secure the service. We do not use sensitive information to infer characteristics about anyone.

We obtain it from you, from the business customers that use the Platform, from the channels they connect (for example, Meta's WhatsApp or Instagram) and from our payment processor. We keep each category only as long as needed for those purposes; see Data retention.

13.2. We do not sell or share your information

Northlav does not sell personal information or share it for cross-context behavioral advertising, and has not done so in the past 12 months. Nor do we knowingly sell or share the personal information of consumers under 16. The website and dashboard do not use third-party advertising cookies or pixels. We only disclose it to the service providers in section 7, which process it on Northlav's behalf under contract. If your browser sends a Global Privacy Control signal, we treat it as a valid opt-out request.

13.3. Your rights

• Know and access: what personal information we collect about you, its sources, why we use it and who we disclose it to, and receive a portable copy.
• Delete the personal information we collected from you, subject to legal exceptions.
• Correct inaccurate information.
• Opt out of sale, of sharing for targeted advertising and of profiling with significant effects (although we do none of these).
• Non-discrimination: exercising your rights does not change the price or quality of the service.

13.4. How to exercise them

Email northlavstudio@gmail.com with the subject "US Privacy Request", stating the right you want to exercise and your account email. To protect your information, we verify the request against data we already hold (for example, by confirming from the account email). You may act through an authorized agent with your signed permission. We respond within 45 days, which we may extend once by another 45 days with notice to you.

If we deny your request, you may appeal by replying to our decision; we will respond within the period set by your state's law. If you are not satisfied, you may contact your state Attorney General.

13.5. Other United States notices

• "Do Not Track": we do not track people across third-party websites, so this signal does not change anything. We do honor Global Privacy Control (13.2).
• California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.
• Nevada: we do not sell "covered information" as defined by Nevada law. If this ever changes, we will give notice first.
• Children under 13: the service is not directed to children under 13 and we do not knowingly collect their data (COPPA). If we learn that we have, we delete it. If a business customer serves minors, section 11 also applies.

Data about a business's customers: when Northlav processes conversations and contacts on behalf of a business customer, it acts as a service provider or processor (section 2.2): it does not sell or share that data or use it for anything other than providing the service to that business. Requests about that data should go to the business, and we help it handle them.

14. Security

We protect data with encryption in transit (HTTPS), per-business isolation in the database (section 3), file access only with a signed-in session and expiring links, two-factor authentication for internal accounts, and audit logs. No system is infallible: if an incident affects your personal data, we will notify the affected people and the relevant authorities within the periods required by applicable law.

More detail at Security.

15. Links to other sites

The Platform may link to third-party services (for example, Meta, Paddle or a business’s website). This policy does not cover them: each has its own.

16. Changes to this policy

We may update this policy. When a change is material, we will notify you at the account email or in the Platform before it takes effect, and ask you to accept it again when you sign in. The date at the top shows the current version.