This Privacy Policy for Northstar Security, Inc. ("Northstar," "we," "us," or "our") describes how we collect, use, disclose, and otherwise process information in connection with Northstar's websites (including northstar.security), applications, services, tools, and features (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" mean you as a user of the Services.
Please read this Privacy Policy carefully to understand how we collect, use, and disclose information in connection with the Services.
UPDATING THIS PRIVACY POLICY
We may modify this Privacy Policy from time to time, in which case we will update the "Last Revised" date at the top of this Privacy Policy. If we make material changes to the way in which we use information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on the Services, or by other means consistent with applicable law) and will take additional steps as required by applicable law.
NORTHSTAR'S COLLECTION AND USE OF INFORMATION
When you access or use the Services, we may collect, receive, process, store, and use certain categories of information from a variety of sources, as described below.
Contact information
Contact information includes your name, role, company name, company details (such as industry), and email address. We collect and use basic contact details to communicate with you, provide and operate the Services, and understand the use and health of our products.
Payment information
Payment information may include billing contact information, billing address, and transaction information. Payment card or bank account information may be processed by our payment service providers. Northstar may receive limited billing and transaction information associated with those payments. We use payment information to process payments and provide the Services.
Account information
Account information may include your username, authentication identifiers, single-sign-on (SSO) information, and other information used to authenticate or secure your account. We collect and store account information as necessary to maintain and secure your account with us. We may share or process this information with a third-party identity service. If you register an account, you are responsible for keeping your account credentials secure. If you believe your account has been compromised, please contact us immediately.
Usage data
Usage data may include your unique device identifier, device type, IP address, browser type, date and time stamps, operating system, log data, approximate location derived from IP address, clickstream data, and product usage (for example, which features you use and how frequently). We collect Usage Data to operate and improve the Services, run analytics, diagnose and correct errors, understand user interaction with the Services, and, where permitted by applicable law, communicate with or market to you.
Integration data
Northstar enables customers to connect the Services with third-party products, platforms, and services selected and authorized by the customer ("Integrations"). These Integrations may include, for example, services provided by Amazon Web Services, Google, Microsoft, Okta, Wiz, ServiceNow, Workday, Qualys, and other security, cloud, identity, IT, HR, and business systems.
When you enable an Integration, Northstar may access, collect, process, and store information made available through that Integration in accordance with the permissions you grant. The categories of information available to Northstar depend on the Integration and its configuration. Where applicable, we communicate or make available the permissions requested through OAuth scopes, API permissions, integration documentation, or configuration options controlled by you.
Integration data may include information relating to assets, devices, users and identities, access privileges and entitlements, security findings, vulnerabilities, configurations, applications, cloud resources, system events, logs, tickets, and other information made available by the systems you choose to connect.
We use Integration data to provide and operate the Services, including to:
- discover and maintain visibility into assets, identities, applications, infrastructure, and other resources within your environment;
- correlate and contextualize information from multiple systems to create and maintain Northstar's context graph;
- identify security risks, exposures, misconfigurations, excessive or inappropriate privileges, coverage gaps, and other security conditions;
- provide security analysis, recommendations, prioritization, reports, dashboards, alerts, and notifications;
- enable Northstar's AI-powered features to answer questions and analyze security information using the context available within your environment;
- initiate or perform workflows and remediation actions, including changes to identity, access, security, or other system configurations, when such actions are configured, requested, or authorized by you;
- communicate with authorized members of your organization through connected communication, ticketing, or workflow systems; and
- operate, secure, troubleshoot, maintain, and support the Services.
Northstar processes Integration data on behalf of its customers and in accordance with the applicable customer agreement and customer instructions. Northstar does not use Customer Data or Integration data to train general-purpose or shared artificial intelligence or machine learning models, unless expressly authorized in writing by the customer.
Customer Data
Our enterprise customers may submit, connect, or otherwise make data available to Northstar through the Services ("Customer Data"), which may include personal information. When Northstar processes personal information contained in Customer Data on behalf of a customer, Northstar processes that information as a processor or sub-processor, as applicable, pursuant to the customer's instructions and the applicable customer agreement, and any applicable data processing agreement. If your personal information has been submitted to the Services by a Northstar customer and you wish to exercise rights relating to that information, you should generally contact that customer directly.
Data you share with us
We also collect any other information you choose to include in communications with us, for example, when sending a message through our Contact Us web form or submitting a support request.
In addition to the uses described above, we may use information to comply with applicable legal obligations, enforce applicable terms of service or customer agreements, and protect or defend the Services, our rights, and the rights of our users or others.
LEGAL BASIS FOR PROCESSING
Where required by applicable law, we process personal information based on one or more of the following legal bases: performance of a contract or taking steps at your request before entering into a contract; compliance with legal obligations; Northstar’s legitimate interests, including providing, securing, maintaining, improving, and promoting the Services, where those interests are not overridden by your rights and interests; and your consent, where applicable.
DATA RETENTION AND DELETION
We retain personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements, unless a longer retention period is required or permitted by law. The applicable retention period will depend on the nature of the information, the purposes for which it is processed, applicable legal and contractual requirements, and our legitimate business and operational needs. Retention and deletion of Customer Data will be governed by the applicable customer agreement, and any applicable data processing agreement, and customer instructions.
You may request deletion of personal information that Northstar controls by contacting us using the information in the "HOW TO CONTACT US" section below. Requests relating to personal information contained in Customer Data may need to be directed to the applicable Northstar customer.
HOW NORTHSTAR SHARES YOUR INFORMATION
In certain circumstances, Northstar may disclose information to third parties for legitimate business purposes and as otherwise described in this Privacy Policy. Such circumstances may include:
- with vendors and service providers that support the Services, such as payment processors, data analytics vendors, cloud hosting and storage providers, IT service management vendors, email and communications providers, identity and authentication providers, security vendors, and other subprocessors;
- to comply with applicable law or legal obligations, including lawful requests from law enforcement, judicial orders, and regulatory inquiries;
- in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or other business transaction;
- to enforce applicable terms of service, customer agreements, or other agreements;
- to protect the safety, rights, property, or security of Northstar, our customers, users, or others;
- when you or your organization requests, directs, or authorizes us to share information with third parties, including through Integrations, workflows, or login functionality; and
- with professional advisors, such as auditors, law firms, insurers, and accounting firms.
To the extent any information disclosed under this section constitutes Customer Data, Northstar will disclose such Customer Data in accordance with the applicable customer agreement and any applicable data processing agreement.
Northstar does not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under applicable privacy laws.
COOKIES AND OTHER TRACKING TECHNOLOGIES
Do Not Track Signals
Your browser settings may allow you to transmit a "Do Not Track" signal when you visit websites. Like many websites, our website is not designed to respond to "Do Not Track" signals received from browsers. Certain jurisdictions may provide additional rights relating to browser-based preference signals, which we will honor where required by applicable law.
Cookies and Other Tracking Technologies
Most browsers accept cookies automatically, but you may be able to control the way in which your device permits the use of cookies, web beacons, clear gifs, and similar technologies. You may block or delete cookies through your browser settings; however, doing so may cause some features or functionality of the Services to work incorrectly. Where required by applicable law, we will provide additional choices regarding non-essential cookies or tracking technologies.
If we use Google Analytics or similar analytics services, available opt-out mechanisms may be provided through our website or the applicable analytics provider. If you have questions regarding the information about you that we process or retain, or your choices regarding our practices, please contact us using the information below.
YOUR PRIVACY RIGHTS
Depending on where you reside and subject to applicable law, you may have certain rights regarding your personal information. These may include the right to request access to or a copy of your personal information, correction of inaccurate personal information, deletion of personal information, and information about how your personal information is collected, used, or disclosed. You may also have the right to opt out of or limit certain processing where applicable.
To exercise a privacy right, please contact us using the information in the "HOW TO CONTACT US" section below. We may need to verify your identity before completing your request. We will not discriminate against you for exercising privacy rights available to you under applicable law. You may also be permitted to use an authorized agent to submit a request on your behalf, subject to applicable verification requirements.
Northstar may process personal information contained in Customer Data solely on behalf of a customer. In those circumstances, Northstar may refer your request to, or instruct you to contact, the applicable customer responsible for that data.
THIRD-PARTY WEBSITES AND LINKS
We may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions. We are not responsible for the privacy or security practices of third-party sites or platforms. Our inclusion of a link does not, by itself, imply endorsement of the third party or its content.
CHILDREN'S PRIVACY
The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe a child under 13 has provided us with personal information, please contact us using the information below to request deletion.
DATA SECURITY
We use administrative, technical, and organizational safeguards designed to protect information in our custody or control. Our data-handling practices include, as applicable:
- encryption of data in transit and at rest;
- least-privilege access controls;
- data segregation; and
- regular security auditing.
No security measures are perfect or impenetrable, and we cannot guarantee absolute security. Please use appropriate care when transmitting sensitive or confidential information electronically and avoid unsecured channels.
ADDITIONAL COMPLIANCE
Google APIs User Data Policy
Northstar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
HOW TO CONTACT US
If you have questions about our privacy practices, this Privacy Policy, or wish to exercise an applicable privacy right, please email us at support@northstar.security or contact us at: Northstar Security, Inc., 171 Main Street #186, Los Altos, CA 94022.