Privacy Policy

Last updated: 19 August 2026

Working document. This policy describes how Northern Lights handles personal data today. It is written in good faith by the product team and is pending review by our legal counsel. We will replace it with the reviewed version once that review is complete.

Northern Lights is a workplace improvement product. Your employer, or the company that gave you your account, buys the product and invites you to it. This policy explains what personal data the product collects, why, who else touches it, how long it is kept, and how you delete your account.

Who is responsible for what

Northern Lights is supplied by PT Software Technologies AB ("we", "us"). The product is sold to companies, not to individuals.

• The customer company owns the work content. Every observation, assignment, action, comment and note created inside a customer company's workspace belongs to that company. The company decides what gets recorded, who inside the company can see it, and how long it is kept. In data protection terms, the customer company is the controller of that content.
• We run the service on the company's behalf. We store and process the content so the product works, and we act on the company's instructions. In data protection terms, we are the processor.

If you want to know why a particular piece of information about your work was recorded, or you want it corrected or removed, the customer company is the right place to start. We help them act on those requests.

What we collect

The categories below follow the same checklist Apple uses for App Store privacy labels, so you can match this policy against what the App Store listing says.

Contact information

• Your first name and last name.
• Your email address.

These come from the invitation the customer company sends you and from the sign-in provider when you sign in.

User content

• Photos. Photos you take with the camera or attach from your library to an observation or another record, and the picture you choose as your profile picture.
• Audio recordings. The voice recording made during a Brain Dump session, and the transcript produced from it.
• The work content you create. Observations, assignments, actions, checkpoints, comments, notes, root cause analyses, titles and descriptions, along with who created each record and when.
• Support tickets. When you report an issue or share an idea from inside the app, the ticket and anything you attach to it is read by our own support staff, not only by your company. This is the one thing you write in the app that we look at as a matter of course.

Identifiers

• The identity that your sign-in provider gives us, which is how we recognise you when you return.
• Your account identifier inside the product.
• A push notification token for each device you install the app on, together with the device's own name. iPhones are often named after their owner, so that name can identify you.

Diagnostics

• Technical logs needed to run and troubleshoot the service, such as error records. These can name the person a message was sent to or the title of a work item a notification was about. They are not used to build a profile of you.

What we do not collect

We do not collect your precise location, health or fitness data, financial information, your contacts, your browsing history outside the product, or your advertising identifier. The app carries no advertising and no third party advertising or tracking network. We do not sell personal data, and we do not use it for advertising.

How we use what we collect

• To run the product and show your work to the right people inside your company.
• To sign you in and keep your session secure.
• To notify you about work that concerns you.
• To send you the few emails the account needs, such as your setup link and a password reset.
• To power the AI assistance described in the next section.
• To support you when you contact us, and to keep the service secure and working.

AI processing

Some parts of the product use a large language model. All of it runs on Azure OpenAI inside our own Azure resource, in our own subscription.

The AI features are:

• Observation title inference. Suggests a short title from the text you have written.
• 5-Why coaching. Guides you through a structured root cause analysis and proposes wording as you go.
• Possible Duplicate detection. Turns observation text into a numeric representation so the product can flag an existing observation that looks like the one you are writing.
• Brain Dump. Transcribes the audio you record, separates the speakers, and produces a title, a summary and key points.

Two things we want to state plainly:

• Your data is not used to train models. Not by us, not by Microsoft, not by OpenAI. The content you send to these features is used to produce the answer you asked for and nothing else.
• The processing happens in our own Azure resource. It is not sent to a public chatbot service, and it is not shared with other customers.
• The AI resource is in the United States. It is in the Azure East US 2 region, while our storage, sign-in and email services are in Europe. Text you send for a title suggestion, a 5-Why coaching step, a duplicate check or a Brain Dump transcription is processed in the United States.

Every AI suggestion is a suggestion. You review it, and you decide whether to keep it.

Signing in

Auth0, an Okta company, is our identity provider. Auth0 holds your email address, your name and your sign-in credentials, and it tells us who you are when you sign in. Each customer company is a separate organisation inside Auth0, which is what keeps one company's people out of another company's workspace.

Auth0 has its own privacy notice covering the data it holds as part of that service.

Push notifications

The iOS app can send push notifications through Apple's Push Notification service.

• What they contain. What happened and which record it happened to, for example that an assignment was given to you, that someone commented on your observation, or that a due date is approaching. A notification may include the title of the record and the name of the person who acted.
• What they never contain. Photos, audio recordings, transcripts, or anything you use to sign in.
• The token. We store one delivery token per device so the notification reaches the right phone. The link between that token, you and your company stops being used after 90 days without activity, and it is deleted when your account is deleted. The token itself is deleted too, unless someone else is still signed in on the same device.
• Turning them off. Use the iOS Settings app, under Notifications, at any time. The product still works without them.

Who else touches the data

We use a small number of suppliers to run the service:

Each of these is bound to use the data only to provide their service to us.

How long we keep it

• Work content is kept for the life of the customer company's account, because the company owns it. There is no automatic expiry on it. When a company ends its agreement, removal or hand-back is arranged with that company on request rather than happening automatically.
• Photos and attachments are kept with the record they belong to. When you remove an attachment it stops being visible in the product straight away, but the underlying file stays in our storage. It is not deleted automatically, and removal is arranged with the customer company on request.
• Brain Dump audio is deleted when the session is completed. The transcript, the speaker labels, the summary and the session details are kept as part of the work content, with no automatic expiry.
• Your account details, meaning your name, email address, profile picture and sign in identity, are kept for as long as you have an account. If your company's administrator removes you, you lose access straight away, but these details are kept until you ask for your account to be deleted.
• Notification history, meaning the record of what the product told you and which work item it was about, is deleted after 90 days.
• Push notification tokens are kept while the app is installed and someone is signed in on the device. The link between a token, you and your company stops being used after 90 days without activity, and is deleted with your account, taking the token with it unless another person still uses that device.
• Technical logs are kept for troubleshooting and security. We do not set the retention period for these ourselves; it follows the settings of the suppliers that hold them.

Deleting your account

You delete your own account from the Profile screen in the iOS app. No one has to approve it, and the request is never refused.

Here is exactly what happens:

1. You confirm the request on the Profile screen.
2. The account is scheduled for deletion seven days later. During those seven days you can cancel the request from the same Profile screen, and everything returns to normal.
3. After seven days the deletion completes on its own.

When it completes:

• Your personal data is erased. Your name, your email address, your profile picture, your sign-in identity and your registered devices are removed. You can no longer sign in.
• The work content you created stays with the customer company that owns it. It is kept under an anonymous author instead of your name. The company needs the record of what was observed and what was decided, and that record does not belong to you personally.

If you have already uninstalled the app and you want to cancel a pending deletion, contact your company's Northern Lights administrator or write to us at the address below before the seven days are up.

Your rights

Depending on where you live, you may have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, or to object to how it is used. Because the customer company is the controller of the work content, ask them first and they will come to us where they need to. For your account details, you can reach us directly using the contact below.

Children

Northern Lights is a workplace product. It is not designed for or directed at children, and accounts are created only by a customer company for its own people.

Changes to this policy

When we change how the product handles personal data, we update this page and change the date at the top. Significant changes will also be told to the customer company.

Contact us

Questions about privacy, or a request about your own data:

support@northern-lights.cloud

You can also raise it with your company's Northern Lights administrator, who can reach us on your behalf.