Legal
Last updated: September 2026
We believe privacy is a right, not a feature. This policy explains exactly what data we collect, why, and your rights. No legalese — just the facts.
This website does not use cookies, tracking scripts, or analytics that identify you personally. We use Google Analytics (GA4) with IP anonymization to understand aggregate traffic — pages viewed, regions, device types. No personal data is collected by us.
If you email us, we receive only what you send: name, email, and message. We use it solely to reply. We never sell, rent, or share your data with third parties.
We use Google Analytics 4 with the following privacy settings: IP anonymization enabled, data sharing with Google disabled, advertising features disabled, user ID tracking disabled.
GA4 collects: page path, referrer, device type, browser, country/region (from anonymized IP), language. It does NOT collect: name, email, IP address (full), or any identifier that links to a real person.
On your first visit, a consent banner appears. You may Accept (analytics runs) or Decline (analytics blocked). You can change this anytime via the banner link or browser settings.
Data retention: 14 months (GA4 default). You can request deletion by emailing us.
If you email us at contact@northstar.com.ly, we receive your name, email address, and message content. We store this only in our email inbox (hosted by our email provider) and use it solely to respond to your inquiry.
We never add you to mailing lists, newsletters, or marketing databases. No automated profiling or decision-making.
This site links to our Instagram profile. When you leave our site, that platform's privacy policy applies. We have no control over how Meta/Instagram handles your data.
We do not embed social widgets, tracking pixels, or third-party iframes on our pages.
You have the right to: (a) Access any personal data we hold about you — just ask. (b) Request deletion of your correspondence — we'll remove it promptly. (c) Object to analytics — use the consent banner or disable JavaScript. (d) Data portability — we'll provide your data in a readable format.
To exercise any right, email us at the address above. We respond within 30 days.
We use HTTPS everywhere, secure headers (CSP, HSTS), and our email provider encrypts mail at rest and in transit. Access to correspondence is limited to the project team.
No system is 100% secure. In the unlikely event of a breach affecting your data, we will notify you promptly as required by law.
Email correspondence: kept while relevant to the project, then archived or deleted on request. Analytics data: 14 months (GA4 auto-delete). No other personal data is stored.
If this policy changes — for example, if we add a newsletter or change analytics — we will update this page and the date above before the change takes effect. Continued use after changes constitutes acceptance.