Privacy

Privacy policy.

This page covers the data Northbench collects from the audit intake form, the /contact form, and (when launched) the client dashboard. We've written it the way we'd want a vendor to write it for us: short, factual, and specific about what we keep and for how long.

What we collect.

Three sources, listed separately so each is auditable on its own.

Audit intake form

Submitted on /audit before payment.

  • · Industry / vertical
  • · Weekly volume (your estimate)
  • · Team size
  • · Bottleneck description (free text)
  • · Business size bracket
  • · Your name
  • · Your work email
  • · Privacy-consent flag (required)
  • · Marketing-consent flag (optional)
  • · Stripe checkout-session and payment-intent IDs (after deposit)
  • · Timestamps for both the intake and the deposit

The intake fields exist in plaintext in our Postgres database, behind access controls scoped to the Northbench team. Stripe handles the payment data on their side; we keep the IDs so refunds and reconciliation are possible.

Contact form

Submitted on /contact when you write us.

  • · Name
  • · Email
  • · Message body (free text)
  • · Timestamp

The message lands in our Postgres database. A human reads it and replies from the inbox listed below; nothing is forwarded to a marketing tool.

Client dashboard (forthcoming)

Will apply once the dashboard ships.

  • · Account email (login identifier)
  • · Login session token and expiry
  • · Role (which workflows the account can see)
  • · The workflow data you upload to each engagement

We'll update this section when the dashboard launches. Nothing here changes retroactively for anyone who hasn't signed in.

Where it's stored.

Two systems. We list them plainly so you can sanity-check what we have access to.

  • Application database. Postgres, accessed through Prisma. Runs on infrastructure provisioned by our host. Holds the audit intake rows, contact-message rows, and (when it ships) dashboard accounts. Encryption at rest is a host-level default; access is limited to Northbench operators.
  • Payments. Stripe. Holds card details, the checkout session, the charge, and the refund record. We never see card numbers; Stripe does.

Retention period.

We don't keep data on the principle of "as long as needed." Every category has a written window.

CategoryWindow
Audit intake (prospect)While the prospect is an active lead, and for up to 24 months after the last touch. If the prospect converts to a client, the engagement record is kept for the duration of the engagement plus 7 years for tax and audit purposes.
Contact messages12 months from submission, then purged.
Stripe payment events7 years (standard financial-record window).
Marketing-consent flagRetained until the prospect withdraws consent. Withdrawal removes the flag and stops any optional marketing use.

How to request deletion.

Email the address on the /contact page with the subject line "Deletion request." Tell us which record — audit intake, contact message, or (when applicable) dashboard account — and include the email address on file so we can verify.

We respond within 30 days. We delete what you ask us to delete, including all related application rows. Stripe payment records stay with Stripe (financial-record retention applies there), but we mark your prospect record as closed so it is no longer used for outreach.

No sale. No third-party sharing.

Northbench does not sell prospect data and does not share it with third parties for marketing or any non-payment purpose. The only third-party data path is payment processing — and it goes to Stripe solely to take the $250 audit deposit.

We do not buy, rent, or trade prospect lists. We do not enrich your record with data from outside services. We do not run retargeting or lookalike audiences off anything you submit through our forms.

What we don't collect.

  • · No device fingerprinting.
  • · No third-party analytics that profile visitors across other sites.
  • · No advertising cookies. The first-party beacon we run is a single page-load pixel that records an anonymous visit ID in our own infrastructure — it does not follow you across the web.
  • · No retargeting pixels built from prospect data.

Changes to this policy.

We'll update this page when the policy changes. The date at the bottom of the page is the effective date; older versions are available on request.

Contact.

Email us at northbench-elhqz7@polsia.app or use the contact form. The same address handles deletion requests, data questions, and anything else this page didn't cover.

Effective 2026-08-20. Northbench.