Privacy Notice

Who we are

Bella Rose LLC (trading as Find North) provides Find North at findnorth.us. For the personal data described here, Bella Rose LLC is the data controller — we decide what is collected and why, and we are accountable for it.

You can reach us about anything in this notice at home@findnorth.us.

What we collect

• Account details: your email address, your first name if you give it, and your password in hashed form (we never see or store the password itself).
• What you write: journal entries, brain dumps, reflections, priorities, check-ins, conversations with North, goals, and anything you save to the Comfort Drawer — including photos and voice notes you upload.
• What North remembers: if you give permission, summarised memories drawn from what you've written, so North can recognise the people, worries and victories that matter to you over time.
• Circle data: if you use North Together, the circle you created or joined, who is in it, and only the items you explicitly chose to share.
• Preferences: how you want North to speak to you, your notification pace and quiet hours.
• Technical data: IP address, browser and device information, and basic security and error logs generated when you use the site.

Why we use it, and on what legal basis

• To provide Find North — your account, your writing, your insights, your circles. Legal basis: performance of our contract with you.
• To generate reflections, rituals, letters and conversations using AI models. Legal basis: performance of our contract with you.
• To remember things across months and years (Deep Memory). Legal basis: your consent, which you can withdraw at any time in Settings.
• To send notifications you've asked for. Legal basis: performance of our contract, and consent where required.
• To keep the service secure and prevent fraud and abuse. Legal basis: our legitimate interests, and legal obligation where applicable.
• To fix problems and improve the product using aggregated, non-identifying signals. Legal basis: our legitimate interests.

What we never do

• We do not sell your personal data. There is no version of this product where that changes.
• We do not use what you write to train third-party foundation models.
• We do not show your writing to anyone in your circles unless you explicitly chose to share that specific item.
• We do not advertise to you inside Find North.

Who we share it with

• Infrastructure and hosting providers who store and serve the application and its database, under contract and on our instructions.
• AI model providers who process the text needed to generate a response. They process it to return that response and are contractually prevented from using it for their own model training.
• Paddle.com, our Merchant of Record, for the sale of memberships, subscription management, payments, tax compliance and invoicing.
• Email and notification delivery providers, for the messages you've asked to receive.
• Professional advisers (legal, accounting) where genuinely necessary.
• Authorities, where we are legally required to do so.

International transfers

Some of the providers above operate outside your country, including outside the UK and EEA. Where personal data is transferred, we rely on appropriate safeguards — adequacy decisions where they exist, and Standard Contractual Clauses where they do not.

How long we keep it

What you write is kept for as long as your account exists, because the whole point is that you can return to it years later. Even after a membership ends, your writing stays readable — nothing is deleted for non-payment.

When you delete your account, your entries, conversations, memories, letters, uploads and circle contributions are deleted or irreversibly anonymised. Limited billing records are retained where tax and accounting law requires it. Security logs are kept for a short period and then discarded.

Your rights

• Access — get a copy of everything we hold. You can export it yourself, any time, in Settings.
• Rectification — correct anything inaccurate.
• Erasure — delete your account and your data, from Settings, without asking us first.
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — turn off Deep Memory or notifications without losing access to anything else.
• Complain — if you're in the UK or EEA, you may complain to your supervisory authority. We aim to respond to any request within one month.

Security

Data is encrypted in transit and at rest by our infrastructure providers. Access to your rows is enforced at the database level, so one person's writing is not reachable by another. Administrative access is limited to what is necessary to operate the service and is logged.

No system is perfect. If a breach affects your personal data, we will tell you and the relevant authority where the law requires it.

Children

Find North is not intended for people under 16. We do not knowingly collect their personal data. If you believe a child has created an account, write to us and we will remove it.

Changes

If this notice changes in a way that matters, we will tell you inside the product before it takes effect, not quietly on a page you never visit.