Privacy

When you create an account

What an account will hold

• Your email address — it is your sign-in, and where receipts, renewal reminders and service notices go.
• How you sign in. Today that means a link emailed to you, so there is no password for us to store or to lose. Sign in with Apple is planned, and this page will say so when it ships.
• Your orders — what you ordered, when, the amount, and where it got to.
• The serial numbers of the receivers you own, and whether each one is currently entitled to Northing RTK.
• Anything you email us about your account, kept with it so the next person to answer you has the thread.

Staying signed in: the one cookie we set

Following a sign-in link sets a single cookie, and it is the only cookie this site sets. Its name begins with northing. What it contains is a random session token — not your email, not your name, and nothing that can be read off it. It is the reason the next page you open still knows who you are.

• It lasts 30 days, and while you keep using the portal it is extended — at most once a day, not on every click. Left alone for 30 days it expires and you sign in again.
• Signing out deletes it, on your device and on our side.
• Scripts on the page cannot read it (it is HttpOnly), it is not sent when another site links to us (SameSite=Lax), and on the live site it is only ever sent over HTTPS.

Alongside it we keep a matching record of the session itself: which account it belongs to, when it was created, when it expires, and the IP address and browser user-agent of the device that signed in. Those last two are there so a sign-in you did not make is something you can be shown rather than something we shrug at. The record goes when the session does.

This is a strictly necessary cookie in the ePrivacy sense: it does one job you asked for, and there is no version of "signed in" without it. That is why there is no consent banner on this site, and why turning it down is not offered — declining it and signing in are the same request cancelling itself out. We set no analytics, advertising or tracking cookies, signed in or signed out.

Counting attempts, so the form cannot be abused

Asking for a sign-in link sends an email to whatever address is typed in, which is a thing worth protecting from a script — both from somebody using it to post mail at a stranger, and from a loop pointed at the payment provider. So we count recent attempts: sign-in requests against the email address asked for and against the IP address asking, and checkout and billing requests against the IP alone.

Those counters are the whole record. There is no history, no log of who tried what: a counter holds a number and the address it belongs to, it runs for one hour, and it deletes itself about a minute after that window ends — the storage expires it, the same mechanism as the waitlist retention above. The basis is legitimate interests in preventing abuse, and the counters are used for nothing else, ever.

Paying, and what we deliberately do not hold

Payments run through Stripe, which acts as our processor. Card details go to Stripe and are never stored on our systems: what we hold is that an order exists, its amount, and its status. TODO(legal): which Stripe entity contracts with an Irish seller, the transfer basis, and exactly which fields come back to us from a payment. Also whether we store the delivery address for a physical shipment or leave it with the processor and the carrier.

Your receiver and the corrections service

To switch corrections on for a receiver, this site tells our own provisioning system two things: the receiver's serial number, and whether it is entitled to the service. It does not send your name or your email with them. The service credentials a receiver uses are issued by that system and never touch this website — which is also why you never see one.

This portal holds entitlement state, not positions. It has no access to the coordinates your receiver computes.

TODO(legal): the honest version of the paragraph that belongs here. A network correction service has to know roughly where a receiver is in order to send it the right corrections, so something location-shaped does leave the receiver. State what, at what precision, what our own server logs, and how long the upstream corrections provider keeps it — answered from the code and the provider contract, because a field position is personal data when it is your farm.

When one of us acts on your account

Charging an order, activating a receiver, issuing a refund: we record who did it, to which account, and when. That log exists so you can be told what happened rather than have it guessed at, and it is not used for anything else. TODO(legal): how long those records are kept.

Analytics once you are signed in

The analytics described above are cookieless and anonymous, and that does not change for anyone browsing the site. Inside the portal there is a decision we have not made: whether product analytics stays anonymous there too, or becomes tied to your account so a support question can be answered with what actually happened rather than with a reconstruction.

TODO(legal): make that decision. If analytics becomes identified for signed-in customers, it very likely needs consent, and the consent has to be built before it ships rather than after. Until then nothing in the portal is identified, and we are not going to start quietly.

Why we would be allowed to hold it

Not consent — that is the basis for the waitlist above and it does not stretch to cover a customer record. Account data would rest on performance of our contract with you (GDPR Article 6(1)(b)) for orders, entitlements and the service itself; legal obligation (Article 6(1)(c)) for the records of a sale we are required to keep; and legitimate interests (Article 6(1)(f)) for the audit log and for preventing fraud and abuse.

How long it would be kept

An account and its order history stay while you are a customer. TODO(copy): needs a sourced number — how long after your last entitlement ends the account is kept, and separately the statutory retention owed on records of a sale for tax. Two different numbers, both missing.

Getting a copy, or getting deleted

The rights set out below apply to account data exactly as they apply to a waitlist signup: email hello@northinggnss.com from the address on the account and we will action it and confirm within 30 days, with no charge and no reason needed.

Where we cannot delete something we will say which record and why, rather than refusing in general terms. Deleting an account ends the corrections service for its receivers — and, as everywhere else on this site, the hardware keeps working without it, on Northing Global.

Who else would touch it

Cloudflare, as above, for hosting and for the database. Stripe, for payments. Our own server, which runs the per-receiver corrections lifecycle and holds the credentials this website never sees. And an email provider, for sign-in links and renewal reminders. TODO(legal): name the email provider, and name the hosting provider and country for our own server. The commitment above — that a mail provider is named here before the first email is sent — covers this one too.