Back to Northway OS

Privacy Policy

Last updated: September 11, 2026

Northway Automations LLC, a Delaware limited liability company ("Northway," "we," "us") builds Northway OS, a platform that small businesses use to run AI agents across their operations. This policy explains what personal information we handle, why, and what control you have over it.

We handle personal information in two distinct roles, and the difference matters:

• As a controller, for information about our own website visitors, prospects, and the people who administer a Northway OS account. We decide how that information is used, and this policy governs it.
• As a processor, for the customer records a business uploads to or connects with Northway OS: their contacts, purchase history, engagement data. We handle that data only on that business's instructions, under our agreement with them. If you are a customer of a business that uses Northway and you want your data corrected or deleted, contact that business directly. We will support their request.

1. Information we collect

Information you give us. Your name, business name, email address, phone number, and anything else you type into a form, an email to us, or a support conversation.

Account information. When you create a Northway OS account: your email address, display name, role within your organization, and authentication identifiers. Authentication is handled by Google Firebase Authentication. We do not store your password.

Business data you connect. If you connect a tool such as an email marketing platform, a point-of-sale system, a business profile, or an accounting system, we receive the data that integration exposes. That may include your customers' names, email addresses, purchase history, and engagement events. We access only the scopes you approve, and you can revoke a connection at any time from Settings.

Credentials for connected tools. API keys and OAuth tokens for your connected platforms, encrypted at rest with AES-256-GCM under a key held in a managed secret store.

Usage and technical information. IP address, browser and device type, pages viewed, referring URL, and timestamps. Our servers write an append-only audit record for every state-changing action taken in the platform: who did it, what they did, which record it affected, when, from which IP, and a request identifier.

We do not knowingly collect government identifiers, payment card numbers (payment processing, when we add it, will be handled by a PCI-compliant processor and card numbers will not reach our servers), biometric data, or information from anyone under 16.

2. Cookies and analytics

Our public website. We use Google Analytics 4 to count visits and see which pages people actually read. It is measurement, not advertising: Google Signals and ad personalisation are switched off, so the data is not used to build advertising audiences, and we do not sell or share personal information for cross-context behavioural advertising as those terms are defined under California law.

Google Analytics does not load until you make a choice. On your first visit we set no analytics cookies, ask, and remember your answer. If you accept, Google Analytics sets its own cookies (`_ga` and a `_ga_*` cookie, typically lasting up to two years) and receives your IP address, which is anonymised before storage, along with the pages you view, approximate location by country and city, and general device and browser information. If you decline, nothing from Google loads on the page at all. You can change your answer at any time using the "Cookie settings" link in the footer, and you can clear it entirely by clearing site data in your browser.

Google acts as our processor for this data. Its own handling is described in Google's Privacy Policy. You can also opt out across all sites with Google's browser add-on.

We do not run advertising trackers, remarketing pixels, or third-party ad networks.

The application. Northway OS uses a session cookie and local browser storage to keep you signed in and to remember your cookie choice. That is functional, and it is not analytics.

3. How we use information

• To provide, operate, secure, and improve Northway OS.
• To authenticate you and enforce access controls within your organization.
• To generate agent proposals, which means detecting conditions in your data and drafting the associated rationale and copy for a human to review.
• To execute the actions you approve, through the integrations you have connected.
• To respond to your inquiries and provide support.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To comply with legal obligations and enforce our Terms of Use.
• To send service and administrative messages. Marketing email, where we send it, is separately consented and always includes an unsubscribe link that takes effect immediately.

We do not use your business data, or your customers' data, to train foundation models, and we do not permit our model providers to do so with data processed on your behalf.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the platform to you); legitimate interests (securing the service, preventing abuse, improving the product) balanced against your rights; consent (marketing email and any non-essential cookies, withdrawable at any time); and legal obligation (record-keeping, responding to lawful requests).

5. How we share information

We do not sell personal information. We share it only in these circumstances:

Service providers ("subprocessors") who process data on our behalf, under contract, for the purposes we specify:

A current subprocessor list is available on request, and we will give notice before adding one that materially changes how your data is handled.

Within your organization. Other members of your Northway OS organization can see the records, proposals, and audit entries for that organization, according to their role.

Legal and safety. When we are legally required to, or when disclosure is reasonably necessary to protect the rights, property, or safety of Northway, our clients, or the public. Where we are legally permitted to notify you of a demand for your data, we will.

Business transfer. If Northway is involved in a merger, acquisition, or sale of assets, personal information may transfer as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

6. Data from platforms you connect

When you connect an account — your email platform, your Facebook Page, your Google Business Profile — Northway acts on that account only to carry out actions a person at your organization has explicitly approved. We request the narrowest permissions that allow those actions, and nothing about a connected account is read or written outside them.

Google user data. Northway's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice, for Google Business Profile we request the `business.manage` scope, and we use it only to list the business locations you manage, to publish the posts you approve, and to read and reply to reviews where you have asked us to. We store the access and refresh tokens for that connection encrypted at rest, the identifiers of the locations you selected, and a record of what was published and when. We do not use Google user data for advertising, we do not sell it, we do not transfer it to anyone except as needed to provide the feature you connected, and we do not use it — or allow our model providers to use it — to train foundation models.

Meta Platform Data. For Facebook and Instagram we request only the permissions needed to list the Pages and linked Instagram Business accounts you manage and to publish the posts you approve. We handle that data on the same terms set out above, consistent with Meta's Platform Terms and Developer Policies.

Your data stays yours, per organization. A connected account belongs to the organization that connected it. Credentials are sealed with per-record encryption and are never returned to a browser, never logged, and never accessible to another client.

Revoking access. You can disconnect any integration in Settings at any time, which deletes the stored credential immediately. You can also revoke Northway's access directly with the provider — for Google at myaccount.google.com/permissions, for Meta in Settings → Business Integrations. Revoking at the provider stops all further access straight away; disconnecting in Northway additionally removes what we hold.

7. International transfers

We operate in the United States, and information we process is stored and processed there. If you access Northway OS from outside the United States, you are transferring information to a country whose data protection laws may differ from your own. Where we transfer personal data out of the EEA or UK, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

8. Retention

We keep account information for as long as your account is active, and for a reasonable period afterward to meet legal, tax, and dispute-resolution obligations. Audit records are retained for the same period, because their value is that they cannot be edited after the fact.

Business data connected through an integration is retained while that connection is active. When you disconnect an integration or close your account, we delete or de-identify the associated data within 90 days, except where retention is legally required.

9. Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate.
• Delete your personal information.
• Port your information to another service in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time, without affecting processing already carried out.
• Opt out of sale or sharing of personal information (we do not sell or share, so there is nothing to opt out of).
• Not be discriminated against for exercising any of these rights.

To exercise a right, email privacy@northwayautomations.com. We will verify your identity before acting, and we respond within the timeframe the applicable law requires: 30 days under the GDPR and 45 days under the CCPA/CPRA, extendable where the law permits.

If you are in the EEA or UK, you may also lodge a complaint with your local supervisory authority.

10. Security

We authenticate every request server-side and verify tokens against revocation, so a disabled account loses access immediately. Each organization's data is isolated behind a membership check that runs before any handler. Integration credentials are encrypted at rest. Every state-changing action is written to an append-only audit log. Model calls are made server-side with managed credentials; no model API key is ever shipped to a browser.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulator without undue delay and as required by law.

11. Children

Northway OS is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email privacy@northwayautomations.com and we will delete it.

12. Changes to this policy

We may update this policy as the product changes. When we do, we will revise the "Last updated" date above. For material changes, we will give notice through the application or by email before the change takes effect.

13. Contact

Questions, requests, or complaints about privacy:

Northway Automations LLC
New York, United States
privacy@northwayautomations.com