NORTHSTAR TOOLKIT PRIVACY POLICY

Last Updated: April 7, 2025

This Privacy Policy describes how MilestoneX, LLC d/b/a Northstar Toolkit ("Northstar Toolkit," "we," "us," or "our") collects, uses, and discloses information about you when you access or use our websites, applications, or other online services (collectively, the "Services").

1. INFORMATION WE COLLECT

We collect information about you in various ways when you use our Services:

1.1 Information You Provide to Us

• Account Information: When you register for an account, we collect your name, email address, password, and other information necessary to set up and maintain your account.
• Organization Information: We collect information about your organization, including its name, mission, history, goals, achievements, and other details you provide when using our Services.
• Content and Documents: We collect the content and documents you upload, create, or input into our Services, including grant applications, drafts, outlines, and other information related to your grant writing activities.
• Payment Information: When you subscribe to our paid Services, we collect payment information, which may include credit card numbers, billing addresses, and other financial information necessary to process your payment.
• Communications: We collect information you provide when you communicate with us, such as when you request support, provide feedback, or otherwise contact us.

1.2 Information We Collect Automatically

• Usage Information: We collect information about your use of our Services, such as the features you use, the actions you take, and the time, frequency, and duration of your activities.
• Device Information: We collect information about the device you use to access our Services, including the hardware model, operating system and version, unique device identifiers, and mobile network information.
• Log Information: We collect log information when you use our Services, including access times, pages viewed, IP address, and the page you visited before navigating to our Services.
• Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information about your interactions with our Services. For more information about our use of these technologies, please see Section 6 of this Privacy Policy.

1.3 Information We Collect from Third Parties

We may collect information about you from third parties, such as when you sign up for our Services using a third-party authentication service or when we import data from your organization's website at your direction.

2. HOW WE USE YOUR INFORMATION

We use the information we collect for various purposes, including to:

• Provide, maintain, and improve our Services
• Process and complete transactions
• Send you technical notices, updates, security alerts, and administrative messages
• Respond to your comments, questions, and requests, and provide customer service
• Communicate with you about products, services, offers, promotions, and events
• Monitor and analyze trends, usage, and activities in connection with our Services
• Detect, investigate, and prevent fraudulent transactions and other illegal activities
• Personalize and improve your experience using our Services
• Generate and improve AI-assisted features and functionality
• For other purposes described to you at the time of collection

3. HOW WE SHARE YOUR INFORMATION

We may share your information in the following circumstances:

3.1 With Service Providers

We may share your information with third-party vendors, consultants, and other service providers who need access to your information to perform work on our behalf. These service providers are limited in their ability to use your information for purposes other than providing services to us.

3.2 For Legal Reasons

We may disclose your information if we believe it is necessary to:

• Comply with applicable laws, regulations, legal process, or governmental requests
• Protect the rights, property, and safety of Northstar Toolkit, our users, or others
• Detect, prevent, or otherwise address fraud, security, or technical issues
• Enforce our Terms of Service and other agreements

3.3 In Connection with Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

3.4 With Your Consent

We may share your information with third parties when you give us your consent to do so.

3.5 Third-Party AI Services

We use third-party AI services (such as those provided by OpenAI, Anthropic, and Google) to power certain features of our Services. In the process of providing these features, your content may be shared with these third-party AI providers. These third-party AI providers process your information according to their own privacy policies and terms of service.

4. DATA RETENTION

We retain your information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of providing you with the Services, complying with legal obligations, resolving disputes, and enforcing our agreements.

When you delete your account, we will delete or anonymize your information, unless we are legally allowed or required to maintain certain information.

5. YOUR RIGHTS AND CHOICES

5.1 Account Information

You may update, correct, or delete certain account information at any time by logging into your account or contacting us. Please note that we may retain certain information as required by law or for legitimate business purposes.

5.2 Communications Preferences

You may opt out of receiving promotional communications from us by following the instructions in those communications. If you opt out, we may still send you non-promotional communications, such as those about your account or our ongoing business relations.

5.3 Data Rights for California and Other Jurisdictions

Depending on your location, you may have certain rights regarding your personal information:

• Right to Know/Access: You can request information about what personal data we collect, use, share, or sell.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Data Portability: You can request a copy of your personal information in a structured, commonly used, and machine-readable format.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information or the use of your data for targeted advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, please contact us at privacy@northstartoolkit.com. We will respond to your request within the timeframe required by applicable law (typically 30-45 days).

6. COOKIES AND SIMILAR TECHNOLOGIES

6.1 What Are Cookies

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners to make their websites work, or to work more efficiently, as well as to provide reporting information.

6.2 How We Use Cookies

We use cookies for several reasons:

• Essential Cookies: These cookies are necessary for our Services to function properly and cannot be switched off in our systems.
• Preference Cookies: These cookies enable our Services to provide enhanced functionality and personalization.
• Analytics Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Services.
• Marketing Cookies: These cookies are used to track visitors across websites to display advertisements that are relevant and engaging for the individual user.

6.3 Your Choices Regarding Cookies

Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impact your overall user experience.

7. DATA SECURITY

We take reasonable measures to help protect information about you from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. However, no internet or email transmission is ever fully secure or error-free. Therefore, you should take special care in deciding what information you send to us via the internet.

8. DATA BREACH NOTIFICATION

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email and/or prominent notice on our website within 72 hours of discovering the breach
• Provide information about what data was affected
• Offer guidance on steps you can take to protect yourself
• Inform relevant regulatory authorities as required by applicable law

The notification will include information about the nature of the breach, the information affected, steps we are taking to investigate and mitigate the breach, and recommendations for protecting yourself.

9. INTERNATIONAL DATA TRANSFERS

Northstar Toolkit is based in the United States, and our Services are intended for users located in the United States and Canada. When you use our Services, your information will be processed in the United States where privacy laws may differ from those in your country.

9.1 Legal Basis for Transfers

For users in regions with data protection laws that require specific transfer mechanisms (such as the European Economic Area, United Kingdom, or Switzerland), we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Supplementary measures as recommended by relevant data protection authorities
• Data Processing Agreements with our service providers that process personal data

9.2 Cross-Border Transfer Rights

If you are located in a jurisdiction with data protection laws that grant specific rights regarding cross-border transfers, you may have the right to:

• Request information about the specific safeguards we use to protect your information
• Object to certain transfers where we rely on legitimate interests
• Withdraw consent where we rely on consent for transfers

By using our Services, you acknowledge these transfers and safeguards.

10. CHILDREN'S PRIVACY

Our Services are not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and you believe your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from a child under age 18 without verification of parental consent, we will take steps to remove that information from our servers.

11. CHANGES TO THIS PRIVACY POLICY

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification). We encourage you to review the Privacy Policy whenever you access the Services to stay informed about our information practices and the choices available to you.

12. CONTACT US

If you have any questions about this Privacy Policy, please contact us at: