For students accessing Northa through a US educational institution, data generated in the app may constitute "education records" under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g.

Northa's role: When your school has a formal DPA with us, Northa acts as a "school official" with a "legitimate educational interest" as defined by FERPA. We operate under the school's direction for those records.

Student rights under FERPA: You (or your parent/guardian if you are under 18) have the right to inspect and review education records, request corrections, and control disclosure to third parties. Contact your school's registrar to exercise these rights — the school is the rights-holder for institutional accounts.

What we don't do: We do not disclose education records to third parties outside the school without written consent, except as permitted by FERPA.

Data retention: We retain education records for the duration of the institutional agreement plus 12 months, or until the student requests deletion, whichever comes first.

Questions: contact your school's registrar or email us at northa.purpose@gmail.com.

Northa is not directed at children under 13. We do not knowingly collect personal information from anyone under 13 in compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq.

Registration requires users to confirm they are 13 or older via our age acknowledgment gate. If we discover that a user is under 13, we will promptly delete their account and all associated data.

Parents who believe their child under 13 has registered should contact us immediately at northa.purpose@gmail.com. We will verify and delete the account within 5 business days.

Students aged 13–17: We apply additional privacy defaults — reflections are private by default and sharing with advisors requires an explicit student action. Institutions deploying Northa to students under 18 must have a signed DPA that addresses parental consent requirements applicable in their jurisdiction.

Legal bases for processing:

• Contract performance — to operate your account and deliver the service.
• Legitimate interests — product analytics and security (only where your rights don't override our interests).
• Legal obligation — where required by law.
• Consent — for optional features like sharing reflections with advisors or optional email engagement communications (withdrawable at any time via Profile → Connections & Privacy).

Your GDPR rights: Access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, and the right to lodge a complaint with your local supervisory authority. Exercise these via your profile settings or by emailing northa.purpose@gmail.com. We will respond within 30 days.

Data transfers: Our infrastructure is hosted by Base44 (US). Transfers outside the EEA rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms.

Subprocessors: Base44 (hosting/database), Resend (transactional email). A current subprocessor list is available on request.

Northa uses AI in two ways: to generate your purpose statement options from your questionnaire answers, and to power Nova — your in-app AI guide who helps you refine your Compass and reflect on experiment patterns.

AI processes your own data only — we do not send identifiable student data to third-party AI providers for model training. Nova's suggestions are generated from your reflections and experiment history and are visible only to you.

AI suggestions are starting points for exploration — not career verdicts or professional advice. You can dismiss or ignore any Nova suggestion. AI output is reviewed periodically for quality and potential bias.