Privacy Policy — TrueNorth Data Shield LLC
Effective date: [date] · Last updated: [date]
TrueNorth Data Shield LLC ("TrueNorth," "we," "us") is a Hawaii limited liability company. This policy explains what we collect through our website (truenorthdatashield.com), our TrueNorth Exposure Scan service (the "Service"), and our consulting work, and how we use it.
1. Who this covers
- Website visitors and prospects who browse our site, book a call, or subscribe to our newsletter.
- Customers and partners (businesses and managed service providers, "MSPs") who buy from us.
- People inside a customer's Microsoft 365 tenant, whose limited directory and sharing metadata is processed when the customer runs a scan. For this data we act as a service provider / processor for the customer, under our Data Processing Addendum.
The Service is for businesses only. It is not directed to children under 16, and we do not knowingly collect their information.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Contact and account | Name, work email, company, phone, billing address | You |
| Payment | Processed by Stripe. We receive the last 4 digits and expiry, not full card numbers | Stripe |
| Website usage | Pages viewed, referrer, approximate location from IP, device type | Cookies / privacy-friendly analytics |
| Tenant scan metadata | Tenant name and verified domains; SharePoint/OneDrive/Teams site, folder and file names and paths; sharing-link type, scope and expiry; email addresses of people a file is shared with; guest account names, emails, created and last sign-in dates; names and user principal names of admin role holders; licence counts; tenant sharing settings | Microsoft Graph, read-only, with the customer admin's consent |
What we never collect: the contents of files, emails, chats or calendars; passwords; or authentication secrets for your users. The Service requests read-only Microsoft Graph permissions and cannot make changes to your tenant.
3. How we use it
- Provide, secure, and support the Service and produce reports.
- Bill, send service notices, and respond to requests.
- Send marketing (newsletter, product updates) where permitted; every message includes an unsubscribe link.
- Improve the Service using aggregated, de-identified statistics (for example, "average number of Anyone links per tenant").
- Meet legal obligations and enforce our terms.
We do not sell personal information, share it for cross-context behavioral advertising, or use customer tenant data to train AI models.
4. Who we share it with
- Subprocessors that help us run the Service: Microsoft Azure (hosting, US regions), Stripe (payments and tax), [email provider], [beehiiv for the newsletter], [scheduling tool]. The current list is at truenorthdatashield.com/subprocessors, and customers get 30 days' notice of changes.
- The MSP that manages your tenant, when your scan was set up through that MSP.
- Authorities, when required by law, or to protect rights and safety.
- A successor, in a merger or acquisition, subject to this policy.
5. Retention
- Scan results and metadata: kept for 90 days by default (configurable), then deleted automatically. Deleted within 30 days after a subscription ends or on request.
- Account and billing records: for as long as the account is active, plus the period required for tax and accounting (generally 7 years).
- Marketing contacts: until you unsubscribe.
6. Security
We use encryption in transit (TLS 1.2+) and at rest; least-privilege, read-only API permissions; secrets stored in a managed key vault; multifactor authentication on all administrative access; logging; and data minimization. No system is perfectly secure. If a security breach affects your personal information, we will notify affected customers and individuals as required by law, including Hawaii Revised Statutes Chapter 487N.
7. Your choices and rights
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws), you may have the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of sale, targeted advertising, or profiling. We honor these requests regardless of state. Email privacy@truenorthdatashield.com. We will verify the request and respond within 45 days. If your data was processed for one of our customers, we will forward your request to that customer. You can appeal a decision by replying to our response with "Appeal."
We honor Global Privacy Control browser signals as an opt-out where applicable.
8. Cookies
We use only essential cookies and [privacy-friendly analytics, e.g. Plausible / Cloudflare Web Analytics]. We do not use advertising cookies. [If you add Google Analytics or ad pixels, update this section and add a cookie banner.]
9. International users
The Service is hosted in the United States. If you access it from outside the U.S., your information is transferred to the U.S.
10. Changes
We will post updates here and change the "Last updated" date. For material changes, we will notify customers by email.
11. Contact
TrueNorth Data Shield LLC · [registered business address] · Mililani, HI [ZIP] · privacy@truenorthdatashield.com · [phone]
Microsoft, Microsoft 365, SharePoint, OneDrive, Teams, Entra, and Copilot are trademarks of the Microsoft group of companies. TrueNorth Data Shield is not affiliated with or endorsed by Microsoft.