Privacy & Cookie Policy

1. Data controller and contact

Polaris Works AB is the data controller for personal data described in this policy, except where we process data on behalf of NSF Board business customers as described in Section 3.

Privacy and data protection enquiries: info@northstarframework.com

Product support: support@northstarframework.com

2. What we process and why

2.1 Website visitors and Guest mode

NSF Board Guest mode lets you try a board in your browser without an account. Board content is stored locally in your browser (local storage) on your device.

We may process:

• Technical data needed to deliver the site (server logs, IP address, browser type)
• Cookie consent preferences
• Analytics data if you consent (see Section 5)
• First-party product-interest metrics for high-intent actions such as viewing or downloading the free NSF guide, opening a blog post, or using NSF Board in Guest mode (see Section 5.1)

Legal basis: Legitimate interests in operating, securing, and measuring the public site (GDPR Art. 6(1)(f)), and consent for Google Analytics (Art. 6(1)(a), see Section 5).

2.2 NSF Board accounts (business customers)

When you register and use NSF Board with an account, we process:

• Account data: name, email address, password (stored hashed by our auth provider)
• Company data: company name, organisation number (if provided)
• Workspace data: boards, cycles, cards, snapshots, and settings you create
• Membership data: role (owner, editor, viewer), invitations sent and accepted
• Billing data: subscription plan, status, and Stripe customer identifiers (payment card details are handled by Stripe)
• Security and operational logs

Legal basis: Performance of our contract with your organisation (GDPR Art. 6(1)(b)); legitimate interests in operating, securing, and improving the service (Art. 6(1)(f)); compliance with legal obligations where applicable (Art. 6(1)(c)).

2.3 Digital book purchases

When you purchase the digital Book (ePub), we process:

• Contact and billing data (name, email, billing country, payment information via Stripe)
• Purchase details (edition, language, date, amount, VAT)
• Delivery-related data (download link and how many times it has been used, the confirmations you gave at checkout, support correspondence)

Card details are handled entirely by Stripe and never reach our servers. We store the email address you provide at checkout so we can deliver the file and honour our support obligations.

Legal basis: Performance of contract (Art. 6(1)(b)); legal obligations such as tax and accounting (Art. 6(1)(c)).

2.4 Contact forms and enquiries

If you contact us (for example about the book waitlist, the guide, a question from NSF Board, or general enquiries), we process the information you submit — including whether you asked us to reply — and our correspondence with you.

Legal basis: Legitimate interest in responding to enquiries (Art. 6(1)(f)); consent where you opt in to project updates (Art. 6(1)(a)).

3. NSF Board: controller and processor roles

For NSF Board business workspaces, your organisation is generally the data controller for personal data you and your users put on the board (for example employee names and business content).

Polaris Works AB acts as data processor for that workspace data on your organisation's instructions. Our Data Processing Addendum describes processor obligations and is accepted when you subscribe to NSF Board.

We act as independent controller for account administration, billing, service communications, and security processing related to NSF Board.

4. Essential cookies and local storage

We use essential technologies necessary for the site and product to function, including:

• Local storage to keep Guest mode board content on your device
• Authentication session cookies when you are signed in to NSF Board
• Cookie consent preferences stored locally
• Technical data needed to deliver the site securely and reliably

These are used based on legitimate interest in providing a secure, functional service. They do not require consent under EU ePrivacy rules, but we describe them here for transparency.

5. Analytics

If you consent via our cookie banner, we use Google Analytics 4 to collect aggregated information such as pages visited, features used, approximate region, device and browser type, and interaction events.

We use this to understand usage and improve the site and product. We do not use analytics for advertising or sell your data.

Legal basis: Consent (Art. 6(1)(a)). You can withdraw consent at any time via cookie settings or by clearing site data for northstarframework.com.

5.1 First-party product-interest metrics (no cookie)

Independently of the cookie banner, we record a small set of first-party product-interest events so we can understand whether the guide, blog, and NSF Board trial are used. These counters are not Google Analytics, they are not used for advertising or profiling, and they do not require a cookie or a stored visitor id.

Events we may record:

• Guide PDF download or inline view (language, guide name, page source)
• Blog post view (article slug)
• NSF Board trial signals: a visit to /board, loading an example from the dropdown, starting a blank board, entering planning view, focusing a card (column type only — never the card itself), starting a Help tour (Board basics or Board features), or a choice on the guest welcome bar (which row was shown, and whether a tour was started, the bar was dismissed, the intro was opened, or a question was sent)
• Offers and signup: a click on an offer (which offer, and where on the site), and how far an NSF Board signup got (form opened, account created, checkout started, trial or subscription started, trial converted or ended). These are counted per step, not linked to the account

We do not store IP addresses, email addresses, or full user-agent strings. The IP address is used in memory only (rate limiting, excluding our own test traffic, and a daily unique-visitor estimate). That estimate is a one-way hash of a coarse network prefix, a browser family, the UTC date, and a site secret; it cannot be reversed to an IP and it changes every day.

Obvious crawlers are flagged so we can filter them out of product counts. We may exclude traffic from our own known IP addresses entirely.

Legal basis: Legitimate interest (Art. 6(1)(f)) in measuring product interest on our own site. You may object by emailing info@northstarframework.com.

6. Your choices (cookies)

When you first visit, our cookie banner lets you choose:

• Accept all — essential technologies + analytics
• Only essential — no analytics
• Reject all — no analytics, only essential technologies

To change your choice later, clear cookies/local storage for northstarframework.com and reload the page, or use cookie settings if available in the footer.

7. Recipients and sub-processors

We share personal data with service providers who assist us, including:

• Supabase Inc. — database, authentication (EU Central, Frankfurt)
• Stripe, Inc. — payment and subscription processing
• Resend, Inc. — transactional email (invitations, notifications)
• Vercel Inc. — hosting and content delivery
• Google LLC — Google Analytics 4 (only with consent)

These providers process data on our instructions and under their own terms and data processing agreements. Some may process data outside the EU; where required we rely on appropriate safeguards such as Standard Contractual Clauses.

We do not sell personal data.

8. Retention

• Guest mode local storage: Until you clear it or your browser deletes it.
• NSF Board workspace data: For the subscription term, then up to 90 days read-only after cancellation, then deleted unless you use self-service deletion earlier (see our Terms).
• Account and billing records: As long as needed for the contract and to comply with accounting and tax law (typically up to seven years for financial records under Swedish law).
• Book purchase records: As required for contract fulfilment and legal obligations (typically up to seven years for financial records under Swedish law). The download link tied to a purchase stops working 30 days after purchase.
• Google Analytics: According to our Google Analytics retention settings, in aggregated form, and only if you consented.
• First-party product-interest metrics: Raw event rows for up to 7 days, then deleted. Daily totals and unique estimates are kept for up to 24 months.
• Hosting logs: According to our hosting provider's log retention, used for security and debugging.

9. Your rights

If you are in the European Economic Area or UK, you have rights under GDPR including access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time.

NSF Board workspace owners can delete all workspace data via Settings > Subscription. For other requests, contact info@northstarframework.com. If your organisation is the controller for workspace content, you may need to contact your employer or workspace owner first.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

10. Security

We implement appropriate technical and organisational measures, including encryption in transit, access controls, and row-level security in our database. No method of transmission or storage is completely secure; we cannot guarantee absolute security. See our Security page for a public summary of how we run NSF Board.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and update the “Last updated” date. Material changes may be communicated by email or in-product notice where appropriate.

12. Related documents

• Terms and Conditions
• Security
• Data Processing Addendum (NSF Board business customers)