Privacy

When a business installs LeadPulse on their storefront, our script records browsing activity on their site — pages viewed, products viewed, searches typed, items added to cart, and checkouts completed.

Against each of those events we store:

• A random visitor ID we generate — kept in that browser’s local storage and a first-party cookie. It is not linked to any identity until the visitor provides one.
• The IP address the request came from, and a rough location (city, region, country) derived from it.
• Browser, operating system and device type, read from the standard user-agent string.
• The page URL and the time.

If the visitor later submits a form or completes a checkout on that site, the business passes us the name, phone number, email and address details they entered, and we attach their earlier anonymous activity to that record. That linkage is the core of what the product does, and it is worth being plain about it.

In this arrangement the business running the storefront is the data controller and NorthQu is a processor acting on their instructions. Requests to see or delete data collected on a client’s site should go to that business; if you send them to us, we will pass them on.

• We do not sell personal data, and we do not share it between clients. Each client’s data is isolated at the database level, not merely filtered in the application.
• We do not use third-party advertising or tracking networks, and we do not build cross-site profiles. LeadPulse only sees activity on the site it is installed on.
• We do not run behavioural advertising, retargeting pixels, or data brokerage of any kind.

The public NorthQu site sets a cookie only to remember your light/dark theme preference, and — if you log in — the cookies required to keep you signed in. If you submit the contact form, the details you type are stored so we can reply to you.

• Supabase — database, authentication and hosting for stored data.
• Render — runs the API that receives tracking events.
• Vercel — hosts this website and the dashboard.
• ipwho.is — receives an IP address in order to return an approximate location. It receives nothing else.

Contact records are kept for as long as the business we collect them for remains a client, and are removed on request.

We are being straight about one gap: event records, including the IP address on each one, do not yet have a fixed automatic expiry. Adding a defined retention window is an open item on our side, not something we have quietly decided against. Until it ships, deletion on request is the mechanism, and it works today.

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted. If the data was collected through a client’s storefront, contact that business first, as described above.

Reach us at northqu71@gmail.com or through the contact form.