Privacy Policy

This privacy policy ("Policy") explains how Nordax Digital, a trade name of Northern Axis, LLC ("Nordax," "we," "us"), collects, uses, and shares personal information when you use our website ("Site"), our client platform NordaxOS (the "Platform," available at portal.nordaxdigital.com and client subdomains), and any services we provide. By using the Site or Platform, you agree to this Policy.

Scope

This Policy covers three contexts: (1) visitors to our Site, (2) clients and their team members using the Platform, and (3) visitors to our clients' websites where our clients have installed Platform features (such as contact forms, booking, or Nordax Analytics). In the third case we act as a service provider (processor) on behalf of our client, who is responsible for their own site's privacy disclosures.

Collection of Information

We collect personal information such as your name, email address, phone number, and billing information when you register for the Platform, request a quote, or become a client. We use this information to provide our services, communicate with you about your account, and send relevant updates.

We also collect non-personal information such as IP address, browser type, and device information when you use the Site or Platform, used to improve service quality and user experience.

Use of Information

We use personal information for the following purposes:

• To provide our services and respond to inquiries and requests.
• To operate Platform features you or your business enable (invoicing, booking, CRM, messaging, analytics, and similar).
• To communicate with you about our services and, with your consent, promotions.
• To improve the Site, the Platform, and our services.
• To comply with legal obligations and resolve disputes.

Google User Data

Platform users may connect their own Google accounts to enable specific features. When you connect a Google account, we request only the scopes needed for the feature you are enabling:

• Google Calendar (events, free/busy) — to check availability, create booking events, attach Google Meet links, and update or cancel those events when appointments change.
• Google Analytics, Search Console, Google Ads, and Business Profile (read-only) — to display your own marketing performance inside your Platform dashboard and in reports prepared for you.
• Basic profile (email address) — to identify which account was connected.

Google user data is used only to provide these features to the account owner and authorized members of their business. We store OAuth tokens encrypted, do not sell or share Google user data with third parties, do not use it for advertising, and do not allow humans to read it except with your permission, for security purposes, or as required by law. You can disconnect at any time from the Platform or revoke access at myaccount.google.com/permissions.

Nordax's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Meta Platform Data

Platform users may connect their own Meta (Facebook/Instagram) ad accounts. We request read-only permissions to list the ad accounts you can access and to display your own ad performance (spend, impressions, clicks, leads) in your dashboard and reports. Meta data is shown only to the account owner and authorized members of their business, is never sold or shared, and connections can be removed at any time from the Platform or from your Meta settings.

Nordax Analytics (First-Party Website Analytics)

Clients may install Nordax Analytics on their own websites. On those sites, the script collects page views, referrer and campaign parameters, device and browser type, approximate location (country, derived from IP at our edge network), scroll depth, time on page, click positions, and events the site owner defines (such as form submissions). It does not use cookies, does not collect form contents or passwords, and identifies repeat visits only with a random identifier stored in the visitor's own browser. This data belongs to the client whose site it is and is processed by Nordax solely to provide them analytics. Questions about a specific website's data should be directed to that website's owner.

SMS & Text Messaging

Where you have provided a mobile number and consented to receive text messages (for example appointment reminders or status updates from a business using the Platform), message and data rates may apply. Message frequency varies. Reply STOP to opt out at any time or HELP for help. Consent to receive texts is not a condition of purchase. Phone numbers and opt-in status are stored to honor your preferences and are not sold or shared with third parties for their own marketing.

Sharing & Subprocessors

We never sell or rent personal information. We share it only with service providers who process it on our behalf under contractual confidentiality, with your consent, or as required by law. Our core subprocessors include:

• Vercel (hosting) and Neon (database) — United States.
• Stripe (and financing options such as Klarna and Afterpay where offered) — payment processing. We do not store full card numbers.
• Amazon Web Services (SES) — transactional and marketing email delivery.
• Clerk — authentication and account security.
• Twilio — SMS delivery where text features are enabled.
• Anthropic — AI processing for the features described below.

AI Features

Some Platform features (such as drafting content, summarizing analytics, or reading receipts) send the relevant content to our AI provider to generate a result. This content is used only to produce the feature's output for you; per our provider agreements it is not used to train their models. AI-generated output can contain mistakes and should be reviewed before use.

Protection of Information

We take reasonable measures to protect personal information from unauthorized access, alteration, disclosure, or destruction, including encryption in transit and at rest for sensitive values (such as OAuth tokens), role-based access controls inside the Platform, and secure infrastructure. Platform data is segregated per client account: every record is scoped to the owning business and only that business's authorized users can access it.

Cookies & Other Technologies

We use cookies and similar technologies on the Site and Platform. Cookies are small text files stored on your device that help us recognize your browser and remember certain information.

• Essential cookies — Required to function (session management, authentication, security).
• Analytics cookies — Help us understand how visitors use the Site so we can improve it.
• Functionality cookies — Remember preferences and settings.

You can control cookies through your browser settings. Disabling cookies may affect certain features, including the ability to sign in.

Analytics & Tracking on Our Own Properties

On our own Site we use:

• Google Analytics 4 — pages visited, time on site, device and browser type, region, and traffic sources, aggregated to improve the Site. See Google's Privacy Policy.
• Microsoft Clarity — heatmaps, anonymous session replays, and usage metrics to identify usability issues. Clarity does not collect passwords, payment details, or sensitive form inputs. See Microsoft's Privacy Statement.
• Nordax Analytics — our own cookie-free analytics, collecting the same categories described in the Nordax Analytics section above.

We only enable analytics cookies if you accept them via our cookie consent banner. You can withdraw consent at any time by clearing your browser cookies or adjusting your settings.

Third-Party Links

The Site and Platform may contain links to third-party websites or services. We are not responsible for their privacy practices or content and recommend reading their privacy policies before providing personal information.

Your Rights, Export & Deletion

You may access, correct, or delete personal information we hold about you, and object to or restrict certain processing. Platform clients own their business data: the Platform provides self-service export of your records (contacts, invoices, documents, and other business data) in portable formats, and you may request account deletion, which permanently and irreversibly removes your account data from the Platform. To exercise any right, use the Platform's export tools or contact us at [email protected].

Children's Privacy

The Site and Platform are not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13.

Changes to Policy

We may update this Policy from time to time. We will post the revised Policy on the Site and update the date above. Your continued use of the Site or Platform after changes are posted constitutes acceptance of the changes.