Privacy policy

This policy covers two things: buying from our shop, and using the True North platform to keep your station's training records. It is written in plain language on purpose.

1. Shop purchases

What we collect. When you buy a kit, Stripe handles your payment and shares your name, email, and billing country with us. We never receive or store full card numbers. If you email us, we keep that conversation.

How we use it. To deliver your purchase, help you with support, keep the tax and business records the law requires, and, only if you opted in at checkout, send occasional product updates. Every marketing email has a way to opt out.

2. The True North platform

Whose data it is. Records entered into the platform belong to your repair station. We process them on your behalf and only to run the service. We do not sell them, share them with other customers, or use them for advertising.

What the platform stores about employees. Work identity (name, job title, employee ID), certificates and ratings, training and qualification history, sign offs, and the audit log of changes. The platform does not ask for Social Security numbers, home addresses, medical information, or bank details, and we ask that you not enter them.

How it is protected. Connections are encrypted with HTTPS and stored data sits on encrypted storage. Passwords are hashed and never stored in readable form. Access is limited by role and by site. Every change is written to a tamper evident log. Each station runs in its own private instance with its own database, never a shared pool. Hosted plans are backed up daily.

Who can see it. Your own users, according to the roles you assign. True North staff access a customer instance only to provide support you asked for or to fix a fault, and that access is logged. We share data with a third party only when the law requires it, and we will tell you if that happens unless we are legally barred from doing so.

If something goes wrong. No system can be promised to be unbreakable. If we ever learn of unauthorized access to your data, we will notify you without undue delay, tell you what we know, and tell you what we are doing about it.

Leaving. You can export every record at any time. When a subscription ends, we delete your instance and its backups within 90 days of your request, or sooner if you ask.

3. Your choices

To see, correct, or delete information we hold about you, or to stop marketing emails, email david.burton@truenorthlms.com. We answer within a few business days.

4. Who we are

True North is operated by David Burton, Virginia, USA. Our hosting providers are Microsoft Azure and Amazon Web Services, both of which meet the security standards common to regulated industries.