Privacy policy

Who we are

Northstar Goods ("we", "us") operates this storefront. The data controller is the seller identified on the contact page. Contact us through the message center. Postal address: To be published before launch.

What we collect

• Account data: email address, password hash (we never store your password itself), email verification status, last login time and IP.
• Order data: recipient name, phone number, shipping address, order lines, amounts, currency, tax and shipping method, order status history.
• Payment data: when online payment is enabled, payment reference, gateway name and status. Card numbers are handled by the payment provider and never reach our servers. This store currently does not ask for or store card numbers.
• Technical data: IP address, user agent and request ID in server logs, kept short-term for security and debugging.
• Local storage: your cart, sign-in token, selected currency and cookie notice acknowledgement, stored in your browser.

Why we use it

To create and secure your account, process and deliver orders, calculate shipping and tax, handle returns and refunds, send transactional email when email notifications are enabled, prevent fraud and abuse, and meet accounting and consumer-protection obligations. We do not sell personal data and we do not run advertising retargeting pixels on this site.

Who we share it with

Only what is necessary: when online payment is enabled, the payment provider (to take payment and issue refunds); the shipping carrier (name, address, phone, order contents); the email delivery provider when email notifications are enabled (your email address for transactional messages); and authorities where the law requires it. All providers act as processors under contract.

How long we keep it

Order and invoice records: as long as required by tax and accounting law (typically 6–10 years depending on jurisdiction). Account data: until you delete your account, plus a short grace period for backups. Server logs: 30 days. Password reset and email verification tokens: 1 hour and 24 hours respectively, single use.

Your rights

You can request access, correction, export or deletion of your personal data, object to processing, and withdraw consent for optional processing. Contact us through the message center and we will respond within 30 days. You may also lodge a complaint with your local data-protection authority.

Cookies and local storage

This store sets no advertising or analytics cookies. It uses only strictly necessary browser storage: a cart entry, a sign-in token, your currency preference, and a flag recording that you dismissed the storage notice. Clearing your browser storage removes them and signs you out.

Security

Traffic is encrypted in transit. Passwords are hashed, administrative access requires a separate token and optional IP allow-list, and privileged actions are written to an audit log. No system is perfectly secure; if a breach affects your data we will notify you and the competent authority as required.

Children

This store is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided personal data, contact us and we will delete it.

Changes

If this policy changes materially we will post the new version here and update the date above. Continued use after the change means you accept the updated policy.