Privacy policy
How True North handles personal information on its website, store, demo, and software.
Contents
1. Who this covers
This Privacy Policy explains how True North LMS LLC ("True North", "we", "us") handles personal information on our website (www.truenorthlms.com), in our store, in the live demo (demo.truenorthlms.com), and in the True North training records software (the "Software"). For questions, send us a message with the contact form on our website.
2. The website
The website does not use advertising, analytics, or tracking cookies, and has no sign in. Like any web host, our hosting provider (Microsoft Azure) records basic request data such as IP address, browser type, and the page requested, which is used to deliver and secure the website. The website serves its own fonts and does not load files from other companies.
When you send a message or ask for a demo code with a form on the website, what you enter (your name, work email, organization, and anything else you fill in) is sent to our demo server, kept there so we can answer you, and emailed to us. We use it only to answer you and to send your demo code, and keep it as business correspondence. Each form also records the time it was sent and uses your IP address to limit repeated messages.
3. Store purchases
Payments are handled by Stripe. Card details go directly to Stripe and are never seen or stored by us. Stripe shares with us the name, email address, billing details, and purchase information needed to deliver your files, send receipts, answer questions, and keep tax and accounting records. Stripe's own use of your information is covered by Stripe's privacy policy. We keep purchase records for as long as tax and accounting rules require.
4. The live demo
The demo opens only with an access code. When we create a code we record the name, company, and (if you give it) email address it is for, and the demo records when the code is used. Each code opens a private copy of a fictional station that only the code holder uses; the copy is deleted a day after the code ends. The demo sets two cookies: one remembers your code and one keeps you signed in to your copy. It does not send email or webhooks. Please enter made up information only. Our host records basic request data as described in section 2.
5. The Software
When an organization uses the Software, that organization decides what personal information goes into it (for example, names, employee IDs, work email addresses, roles, training records, signatures, and sign in and security events) and is responsible for it as the data controller. Individuals should direct questions or requests about their records to their employer's administrator.
- Self hosted. The Software runs on the organization's own servers or cloud account. We have no access to that data unless the organization gives it to us for support.
- Hosted. We run a dedicated instance for the organization on Microsoft Azure in the United States and process its data only to provide, back up, secure, and support that instance, on the organization's instructions. A hosted instance holds one organization's data and is never shared with another customer.
In both cases we do not sell personal information, use it for advertising, or use one customer's records for another customer. The Software's optional lesson writing feature sends only general course content, never personal information or training records, to the AI provider the organization configures.
6. How the Software protects data
The Software hashes passwords, offers two step verification with an authenticator app (which an organization can require), keeps server side sessions with an inactivity timeout, locks out repeated failed sign ins, limits each person to the shops and functions of their role, and keeps a security event log and an audit trail of changes to training records.
7. Sharing
We share personal information only with service providers that help us run our business (Microsoft Azure for hosting, Stripe for payments, and Microsoft 365 for email), when the law requires it, or as part of a merger or sale of our business. We do not sell or rent personal information.
8. Retention
We keep correspondence and purchase records as long as needed for the purpose they were collected for and for tax and legal requirements. Hosted Software data is kept for the term of the subscription and for 90 days after it ends, so the organization has its final archive and binders in hand and can ask for a restore, then deleted. Organizations set their own retention for training records; aviation rules such as 14 CFR 145.163(c) require some records to be kept for at least 2 years.
9. Your choices and rights
You can ask us to access, correct, or delete the personal information we hold about you by sending a message with the contact form. We may need to keep some records where the law requires it. Depending on where you live, you may have other rights under local law, and we will honor them as that law requires. For records in an organization's Software instance, contact that organization.
10. Children
Our services are for businesses and are not directed to children under 13. We do not knowingly collect their information.
11. Changes
We may update this policy and will post the new version here with a new effective date.