Privacy Policy

Northkey ("Northkey", "we", "us") provides a white-label marketing platform for independent professionals — a branded page, social media publishing, and newsletter tools. This policy explains what information we collect, how we use it, and the choices you have, both if you're a Northkey subscriber ("Agent") and if you're a visitor to an Agent's page or a recipient of their communications ("Client").

1. Information we collect

From Agents, when you create and use a Northkey account:

• Account details: name, email, phone, professional title, license number, and brokerage/firm.
• Billing information, processed directly by Stripe — Northkey never stores your card number.
• Content you upload or create: photos, logos, branding choices, and posts.
• Data about your own clients that you choose to import or enter (name, email, phone, and notes you add), which you control and can delete at any time.
• Access tokens from third-party services you choose to connect — Meta (Facebook/Instagram), YouTube, TikTok, and Telegram — stored encrypted and used only to publish the content you approve on your behalf. We request the minimum scopes needed to do that (for YouTube: uploading a video, and reading which channel is connected along with its public subscriber count, which is shown on your own landing page; we do not read your private videos, analytics reports, or comments). You can disconnect any of them at any time from your dashboard, which deletes the stored token.

From Clients, only what's needed for the specific feature you use:

• Email address, if you subscribe to an Agent's newsletter through their page.
• Any information an Agent adds about you directly, as part of their own client records.

2. How we use information

• To operate the platform: hosting your branded page, publishing approved posts, sending newsletters.
• To process payments and manage subscriptions, via Stripe.
• To communicate with you about your account, including by email or Telegram if you've connected it.
• To improve the product and fix problems, using aggregated, non-identifying usage information.

We do not sell personal information, ever.

3. Third-party services we rely on

Northkey is built on top of a small number of trusted infrastructure providers, each of which processes data on our behalf under their own privacy and security terms:

• Supabase — database and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Meta (Facebook/Instagram) — publishing posts you approve, when you connect an account.
• YouTube — uploading a video to your channel when you connect it and choose to post there. Northkey’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• TikTok — sending a video to your TikTok account when you connect it and choose to post there.
• Telegram — sending you draft posts for approval, if you connect it.
• Resend — transactional and newsletter email delivery.
• AI providers (Anthropic, Google) — used to draft post and newsletter copy from content you provide.

4. Google user data (YouTube API Services)

If you choose to connect your YouTube channel, Northkey uses YouTube API Services. By connecting, you also agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

• What we access. With the youtube.readonly scope: your channel’s ID, title and public subscriber count. With the youtube.upload scope: the ability to upload a video to your channel. We do not access your private videos, playlists, analytics reports, comments, or subscribers’ identities. We also store the OAuth tokens Google issues to us.
• How we use it. Only to provide the features you use: showing which channel is connected, uploading a video that you created and approved, and showing your public subscriber count on your own Northkey page. We do not use it for advertising, lending, profiling, or any other purpose.
• Who we share it with. We do not sell or transfer Google user data to third parties. It is stored with our database provider (Supabase) and hosting provider (Vercel), which process it only on our behalf. We do not send Google user data to AI models, and we do not use it to develop, improve, or train AI or machine-learning models.
• How we protect it. OAuth tokens are stored encrypted, transmitted only over HTTPS, and used only by our servers. Access to production data is limited to the Northkey team.
• Retention and deletion. Your channel ID and title are re-read from YouTube every day while your channel is connected, so we never keep them longer than 30 days without refreshing them. If you revoke Northkey’s access (at myaccount.google.com/permissions), our next daily check detects it and deletes your stored YouTube connection — tokens and channel data — without any action from you. Clicking Disconnect in your dashboard deletes them immediately. You can also ask us to delete your YouTube data at privacy@northkey.app; we do it as soon as possible and within 7 calendar days. The video IDs of videos you upload through Northkey are kept in your post history and re-checked against YouTube daily; they are removed when you disconnect or revoke access. Your subscriber count is displayed but not stored. If you close your account, everything is deleted within 30 days.

Northkey’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data retention

We keep account and client data for as long as your account is active. If you close your account, we delete your data within 30 days, except where we're required to keep billing records for longer to comply with the law.

6. Your rights

You can access, correct, export, or delete your data at any time from your dashboard, or by emailing us. If you're in Canada, this is provided under PIPEDA; if you're in the EU/UK, under the GDPR — either way, the rights and the process are the same for everyone.

7. Cookies

We use only the cookies necessary to keep you signed in and to remember basic preferences (like your chosen language). We don't use third-party advertising or tracking cookies.

8. Children's privacy

Northkey is a business tool and isn't directed at, or knowingly used by, anyone under 18.

9. Changes to this policy

If we make material changes, we'll update the date at the top of this page and, for significant changes, notify Agents by email.

10. Contact

Questions about this policy or your data? Email us at privacy@northkey.app.