Effective Date: September 10, 2026

Northflow ("we," "us," or "our") operates the Northflow platform, including Northflow Flux. This policy explains how we handle personal data across our website, platform, and services (the "Platform").

Data Controller: Northflow, United States. Contact: accounts@northflow.io

We have not appointed a Data Protection Officer. Privacy questions go to accounts@northflow.io.

1. Two Roles We Play

When we are the controller. For your account, billing, support, and marketing, we decide how and why data is used. This policy governs that data.

When we are a processor. For content in your workspace, including episodes, guest records, files, transcripts, and anything our agents produce, you are the controller and we process on your instructions. If you use Northflow through an employer or client account, that organization's policy governs.

Business customers can request a Data Processing Agreement at accounts@northflow.io.

2. Information We Collect

You provide: name, email, billing and payment information, optional profile image, communication preferences, and support messages.

Collected automatically: IP address, browser type and version, pages visited with time and date, referral source, device information, and feature usage.

Content you upload: audio and video recordings, documents, images, contact lists, and other files.

Cookies: see section 6.

3. Legal Basis for Processing

If you are in the EEA or UK:

PurposeLegal basisProviding the Platform, managing your account, processing paymentsPerformance of a contractService and transactional emailsPerformance of a contractMarketing emails, non-essential cookiesConsentProduct improvement, security monitoring, fraud preventionLegitimate interestsTax, accounting, and legal record keepingLegal obligation

Where we rely on legitimate interests, those interests are keeping the Platform secure and reliable, understanding which features are used so we can improve them, and preventing abuse. You can object at any time.

4. Guests, Contacts, and Other Third Parties

Northflow lets customers manage information about people who do not have accounts, including podcast guests, clients, and collaborators.

If you are one of those people: the Northflow customer who added your information is the controller of it. We process it on their behalf. Our Intake Agent may ask you for a bio, headshot, files, or a signed release. Our Guest Recruiter may send you outreach on a customer's behalf, from a list that customer provided.

You have the rights in section 8. Because the customer controls the data, we will normally forward your request to them and tell you who they are. You can also write to accounts@northflow.io and we will help.

If you are a Northflow customer: you are responsible for having a lawful basis to upload other people's information and to contact them, and for meeting your own notification obligations under Article 14 GDPR. Rules on unsolicited outreach vary by country and are stricter in some EEA member states than others.

5. AI Agents and Automated Processing

What the agents do. Transcribe audio and video, prepare drafts of blog posts and newsletters, draft outreach, request information from guests, and surface work that needs attention.

Third-party model providers. Relevant content is sent to third-party AI providers who process it on our behalf under data processing agreements. These providers are listed in section 10. We do not permit them to use your content to train their models.

Recordings may contain sensitive information. Interviews sometimes touch on health, beliefs, political views, or other special categories of data. If you record and upload that content, you are responsible for having a lawful basis under Article 9 GDPR.

A human always decides. Agents draft and prepare. Nothing publishes or sends without a person approving it. We do not carry out automated decision-making within the meaning of Article 22 GDPR.

6. Cookies

When you first visit, you choose which cookie categories to allow. Strictly necessary cookies, which keep you logged in and the site working, do not require consent. Preferences, statistics, and marketing cookies are only set if you allow them.

You can change your choices at any time through the Privacy settings link in our footer. A full list of the cookies we use is on our Cookie Policy.

7. How Long We Keep Data

DataRetentionAccount dataLife of your account, then 30 days after closureWorkspace content, including recordings and transcriptsLife of your account, then 30 days, unless you delete it soonerBilling and tax records7 years, as required by lawSupport conversations3 years from last contactMarketing contact dataUntil you unsubscribe, then a suppression record so we do not contact you againServer and security logs90 days

After these periods we delete or irreversibly anonymize the data. You can request earlier deletion under section 8.

8. Your Rights

If you are in the EEA or UK you have the right to access your data, correct it, have it deleted, restrict how we use it, object to processing based on legitimate interests or direct marketing, receive it in a portable format, and withdraw consent at any time without affecting processing that already happened.

To exercise any of these, email accounts@northflow.io. We respond within one month and may ask you to verify your identity. There is no charge unless a request is clearly unfounded or excessive.

You also have the right to complain to your local data protection authority. We would rather hear from you first, but you do not have to contact us before going to them.

9. California and Other US State Rights {#california}

We do not sell your personal information.

Under the California Consumer Privacy Act, "sharing" also covers disclosing personal information for cross-context behavioral advertising. You can control this at any time by turning off the Marketing category in our Privacy settings, linked in our footer. We honor Global Privacy Control signals automatically.

California, Colorado, Connecticut, Texas, Virginia, and other state residents may request access to, correction of, or deletion of personal information, may request that we limit the use of sensitive personal information, and may appeal a denied request. Email accounts@northflow.io. We will not discriminate against you for exercising these rights.

An authorized agent may submit a request on your behalf by contacting us at the same address with proof of authorization.

10. Who We Share Data With

We share data with service providers who work on our behalf under contract. Each processes personal data only for the purpose described and is bound by a data processing agreement.

ProviderPurposeLocation[HOSTING PROVIDER]Application hosting[REGION][DATABASE PROVIDER]Data storage[REGION][FILE STORAGE]Media and file storage[REGION][MODEL PROVIDER]Agent drafting and content generationUnited States[TRANSCRIPTION PROVIDER]Audio and video transcription[REGION][PAYMENT PROCESSOR]Subscription billing[REGION]ResendTransactional and product emailUnited StatesFramerMarketing website hostingNetherlands / United StatesCookiebot (Usercentrics)Cookie consent managementGermany

We will update this list before adding a new provider. Customers with a Data Processing Agreement can request advance notice at accounts@northflow.io.

We also disclose data to legal authorities when required by law or valid legal process. In a merger, acquisition, or sale of assets, data may transfer to the acquiring party, subject to this policy.

We do not sell personal data.

11. International Transfers

We are based in the United States, and our providers may be located outside the EEA. Where we transfer personal data internationally we rely on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can request a copy of the relevant transfer mechanism at accounts@northflow.io.

12. Security

We use technical, administrative, and physical safeguards to protect personal data, including encryption in transit, access controls, and regular review of our providers.

If a breach occurs that is likely to result in a high risk to your rights, we will notify you without undue delay, and we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR.

13. Children

The Platform is not directed to anyone under 18 and we do not knowingly collect their personal data. If you believe a child has given us information, contact accounts@northflow.io and we will delete it.

14. Third-Party Links

Our Platform links to other websites and services. We are not responsible for their privacy practices, and we encourage you to read their policies.

15. Changes

We may update this policy. If a change materially affects how we handle your personal data, we will notify account holders by email or through the Platform before it takes effect. Otherwise we will update the date at the top of this page.

16. Contact

Email: accounts@northflow.io

If you need this policy in an alternative format, or help exercising your rights, contact us and we will assist.