Privacy Policy

Section 01Who we are

NorthPath Strategies ("NorthPath", "we", "us") helps mission-driven organizations move from scattered AI experiments to governed, working systems. We do that three ways: advise (AI strategy, governance, policy, training), build (custom platforms, workflow automation, private and local AI, websites), and operate (grant writing, donor CRM management, managed AI operations).

SteadyHarbor is our nonprofit operating platform. It brings donor CRM, grants, tasks, communications, program commitments, and impact evidence into one daily working home, with Harbor AI drafting, prioritizing, and explaining the work. SteadyHarbor is operated by NorthPath Strategies and is covered by this policy. It was previously known as DonorOS.

We work primarily with nonprofits and mission-driven institutions in human services, health, education, arts, and philanthropy.

Section 02Our two roles: controller and processor

This is the most important thing to understand about how we handle data, because it determines who decides what happens to it.

Section 03Data we collect

Website visitors and enquiries

• Name, email address, organization, and whatever you write in a message or booking form
• Meeting details when you schedule through our booking links
• Standard server logs: IP address, browser and device type, pages requested, referring page, timestamps

Account and identity

• Name, email address, organization, role or title
• Authentication identifiers managed by our authentication provider
• Team membership and permission levels within your organization's workspace

Assessment and organizational inputs (NorthPath)

• Survey responses covering structure, process, and governance questions
• Uploaded org charts, CSV exports, and role metadata
• Job descriptions or cost-center summaries, where you choose to provide them

Organizational data in SteadyHarbor

• Donor and constituent records, giving history, and relationship notes your team enters
• Grant applications, funder correspondence, deadlines, and reporting commitments
• Tasks, communications drafts, program commitments, and impact evidence
• Donation page configuration and transaction records

Usage and technical

• Product events (features used, pages viewed, actions taken) and CTA interactions
• Approximate region derived from IP address; raw IP is not retained beyond short-term security logs
• Device and browser attributes, for security and compatibility

Derived and analytical

• NorthPath algorithmic indices (OCI™, HOCI™, JCI™, DSCH, CRF, LEI)
• Benchmark normalization values and scenario model outputs
• SteadyHarbor prioritization signals, suggested next actions, and drafted content

Payments

• Billing contact and subscription status. Card details go directly to Stripe — we never see or store full card numbers.

Support communications

• Emails, support tickets, form submissions, and scheduling notes

Section 04Data sources

We obtain data directly from you, from authorized teammates you invite, from the records your organization imports or migrates into SteadyHarbor, and from system instrumentation. We do not purchase third-party marketing lists, and we do not enrich your records with data brokers.

Section 05How we use data

• Provide and maintain the platform, assessments, dashboards, and algorithmic outputs
• Draft, prioritize, and explain work in SteadyHarbor, subject to your team's review and approval
• Generate benchmarking and scenario modeling
• Deliver consulting engagements and implementation support
• Process payments and manage subscriptions
• Improve the accuracy and reliability of our own products and proprietary algorithms
• Detect, prevent, and investigate security issues, fraud, and abuse
• Comply with legal, tax, accounting, and regulatory obligations
• Send service notices, feature updates, and material policy changes

We do not sell personal information, and we do not share it with third parties for their own advertising.

Section 06Legal bases (GDPR)

Where GDPR applies: (a) Contract — delivering the services you requested; (b) Legitimate interests — product improvement, aggregate analytics, security and fraud prevention; (c) Consent — optional marketing communications and non-essential cookies; (d) Legal obligation — records retention and compliance.

Where we act as processor on your organization's behalf, your organization determines the legal basis for its own processing, and we support it under our agreement with you.

Section 07AI & algorithmic processing

AI is central to what we build, so we are specific about it.

Our own algorithms

NorthPath's proprietary, patent‑pending algorithms (OCI™, HOCI™, JCI™, DSCH, CRF, LEI) compute organizational structure, clarity, and optimization indicators from the assessment inputs you provide.

Harbor AI in SteadyHarbor

Harbor AI drafts communications and proposals, prioritizes work, and explains why it is suggesting something. To do that, relevant context — such as your organization profile, grant requirements, or a donor relationship summary — is sent to an AI model provider for processing and the result is returned to your workspace.

Model providers

We use established providers including Anthropic (Claude), OpenAI, Google (Gemini), and Perplexity. They act as our processors under their API and enterprise terms, which prohibit training on customer content submitted through those channels.

Our commitments

• No training on your data. We do not use your organization's data, your donors' data, or your uploaded documents to train third-party foundation models, and we do not permit our providers to do so.
• Human approval before it leaves your organization. AI-drafted content is a draft. Your team reviews and approves anything before it reaches a donor, funder, or the public.
• No consequential automated decisions. We do not make decisions producing legal or similarly significant effects about individuals through solely automated means.
• Human interpretation on assessments. Expert review accompanies algorithmic output before findings are shared externally.
• Limited model outputs may be cached for performance and cost.

Section 08How we share & our subprocessors

We do not sell or rent personal data. Sharing is limited to vetted providers who process data on our behalf under confidentiality and data-protection obligations:

• Supabase — database and authentication for SteadyHarbor, encrypted at rest
• Stripe — payment processing
• Anthropic, OpenAI, Google, Perplexity — AI model processing for Harbor AI features
• SendGrid — transactional and notification email
• PostHog — product analytics
• Automattic / WordPress.com — hosting for northpathstrategies.org
• Namecheap — hosting for steadyharbor.ai
• Cloud hosting, compute, and object storage — application infrastructure
• Calendly — consultation and demo scheduling
• CookieYes — cookie consent management
• Error monitoring and security tooling — reliability and incident response

We also disclose information where required by law, subpoena, or to protect rights, safety, and the integrity of our services; and as part of a business transition such as a merger or asset sale, in which case this policy continues to apply to data collected beforehand. Our subprocessor list may evolve; material changes will be reflected here or communicated directly where our agreements require it.

Section 09Retention

We retain data for as long as your account or engagement is active. On cancellation or written request we (a) queue structured deletion within 30 days, (b) preserve minimal financial and audit records as legally required, and (c) purge encrypted backups on their rolling lifecycle (no more than 90 days).

Where we act as your processor, you control retention of your organization's records inside the platform, and you can export your data before deletion. Website enquiries and support correspondence are kept as long as needed to handle the conversation and for reasonable business records.

Section 10Security

• Encryption in transit (TLS 1.3) and at rest (AES‑256)
• Role‑based access controls with optional multi-factor authentication
• Row-level data isolation between organizations in SteadyHarbor
• Audit logging of administrative actions
• Least-privilege service design and scoped credentials
• Modern security headers on our public sites
• Periodic dependency and vulnerability review

No system is perfectly secure. If we discover a breach affecting you, we will notify you without undue delay and consistent with applicable law — and where we act as your processor, we will notify your organization so it can meet its own notification duties.

Section 11International transfers

We are based in the United States and process data there, along with other regions where our subprocessors operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross‑border transfers. If you are visiting or using our services from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from those in your jurisdiction.

Section 12Your rights

Depending on where you live — including the EU and UK under GDPR, and California under CCPA/CPRA — you may have the right to access, correct, delete, restrict, port, or object to certain processing of your personal information, and to withdraw consent you previously gave.

Submit requests to privacy@northpathstrategies.org. We verify identity before fulfilling requests and respond within the timelines applicable law requires. You will not receive discriminatory treatment for exercising these rights.

Section 13For donors & constituents

If you gave to a nonprofit, or appear in its records, and that organization uses SteadyHarbor, your information is held there under the nonprofit's control — not ours. We are its service provider.

The fastest route is to contact the organization directly; it can access, correct, export, or delete your record itself. If you reach us instead, we will forward your request to the relevant organization and support it in responding, but we cannot change or remove a nonprofit's records on our own initiative.

Section 14Cookies & tracking

We use:

• Essential cookies — session management and authentication
• Functional cookies — remembering configuration and interface preferences
• Analytics — aggregate product and feature usage, primarily through PostHog on the SteadyHarbor platform

Consent banners run on our sites (CookieYes on northpathstrategies.org, a cookie notice on steadyharbor.ai) and you can decline non-essential cookies there or in your browser settings. We do not run behavioral advertising or cross-site ad tracking. CTA tracking stores only anonymized event metadata (for example cta_click, timestamp, destination) without persistent personal identifiers.

Section 15Payments

All card transactions are processed by Stripe, for both NorthPath engagements and SteadyHarbor subscriptions. We never store full card numbers. Stripe acts as an independent controller for payment data — see Stripe's privacy documentation for details. Where your nonprofit uses SteadyHarbor donation pages, gifts from your donors are likewise processed by Stripe under your organization's account.

Section 16Children

Our services are built for professional and organizational use and are not directed to individuals under 16. We do not knowingly collect personal data from children. If your programs serve minors and their information will live in SteadyHarbor, your organization remains the controller of that data and is responsible for the consents and safeguards its programs require; talk to us and we will help configure the workspace appropriately.

Section 17Do Not Track & Global Privacy Control

Because no consistent industry standard exists for Do Not Track (DNT), we do not respond to DNT browser signals. We do honor Global Privacy Control (GPC) signals where applicable law requires. In practice there is little to opt out of: we do not sell personal information, and we do not share it for cross-context behavioral advertising.

Section 18Policy changes

If we make material changes we will update the effective date and version above and provide prominent notice by email or in-app. Continued use after changes take effect indicates acceptance. Prior versions are available on request.

Section 19Contact