Legal
Privacy policy
What this website collects, why, how long it is kept, and what you can ask us to do about it.
1. Who we are
Northward Compliance & Risk Services Inc. ("Northward", "we", "us") is a corporation incorporated federally under the Canada Business Corporations Act and registered in Ontario, with its place of business in Toronto, Ontario, Canada.
We are responsible for the personal information described in this policy. In data protection language, we are the controller of that information.
Contact us about privacy: privacy@northwardcompliance.com
Postal address: 2627 McCowan Road, Unit 1901, Toronto, Ontario M1S 5T1, Canada
2. What this policy covers, and what it does not
This policy covers this website only: northwardcompliance.com, including the contact form, the free assessment trials, and the Regulatory Risk & Compliance Agent.
It does not cover:
The Northward applications: the compliance suite at app.northwardcompliance.com and Northward Screening at screening.northwardcompliance.com. Those are separate services with their own terms, and access is granted to clients rather than the public.
Information we handle as part of a client engagement. Where we act for a client, that work is governed by the agreement with that client.
We keep this website's data separate from our clients' data, deliberately. This website's information is held in its own database, entirely separate from the systems holding client assessment work. Nothing you submit here reaches those systems.
3. What we collect, and why
We collect only what we need, and each item below exists for a stated reason. We do not buy personal information from data brokers, and we do not build profiles of visitors.
3.1 When you use the contact form
| What we collect | Why |
|---|---|
| Your name | To reply to you properly |
| Your organisation | To understand the context of your enquiry |
| Your organisation email address | To reply to you |
| What you are interested in | To route your enquiry and prepare for the conversation |
| Your message | To answer it |
We use this to respond to you and, if relevant, to follow up about the services you asked about. We will not add you to a marketing list from a contact form submission.
3.2 When you run a free trial (the OFAC assessment, or Screening)
Northward offers two free tools that produce a result by email. Using them is entirely optional.
| What we collect | Why |
|---|---|
| Your name | To address the result we send you |
| Your organisation email address | To send you the result, and to confirm the address is genuinely yours |
| The domain of your email address (for example acme.com) | To operate the one-free-trial-per-organisation limit. See below |
| The answers or search terms you enter | To produce your result |
| The result produced | So we can send it to you, and so we know what you saw if you contact us about it |
| The page you arrived from, and the date and time | To understand which part of our site is useful |
Please read this part, because it is the part people would not otherwise expect.
The free trials are limited to one per organisation, not one per person. To do that, we record the domain part of your email address and check it against domains that have used the trial before. If someone at your organisation has already used it, we will tell you and offer to speak with you instead.
We send the result by email rather than showing it on screen. This confirms the address belongs to you, which is what makes the one-per-organisation limit meaningful.
We ask you to confirm your address before anything is sent or used up. When you submit a guide request, a screening or a trial, we hold what you entered and email you a link. Nothing is sent, no name is screened, and your organisation’s one free run is not used until you press the button in that message. If you never press it, the request expires and we delete it. This is deliberate. It means nobody can put your address into our forms and have us email you, and nobody can use up your organisation’s free run by typing an address at your firm.
When you ask us for a guide you can also tick a separate box to receive our weekly regulatory note. That box is never ticked for you and is never part of accepting the terms of use, and asking for a guide on its own does not sign you up for anything. If you do tick it we keep your address so we can send the note, which goes out at most once a week. Every one of those emails carries a link that stops it, and that link keeps working. When you use it we record that you asked us to stop rather than simply deleting you, because the record of your withdrawal is what stops a later form signing you up again by accident.
We use trial submissions to contact you about our services. This is a genuine purpose and we would rather state it plainly than bury it: the trials are free, and what we get in return is the opportunity to talk to organisations that find them useful. If you would prefer we did not, say so in reply to the result email and we will not contact you again.
3.3 Names you enter into the Screening trial: please read
The Screening trial screens a name you supply against published sanctions lists. That name may belong to somebody other than you.
Do not enter real customer names, client names, or any confidential information into the trial. It is a demonstration tool, not a production screening service, and it is not the right place for other people's data.
To see what the tool actually does, use a name that is already public. Try someone currently on the OFAC or UK sanctions lists, or a well-known politically exposed person. A name that should match tells you more about the engine than a name that should not.
If you do enter a name belonging to a real person, you are responsible for having a lawful basis to do so. We process it only to produce your result.
We retain what you entered as described in section 6, and we do not use names entered into the trial for any purpose other than producing and explaining your result.
3.4 When you use the Regulatory Risk & Compliance Agent
| What we collect | Why |
|---|---|
| The question you type | To answer it, and to understand what visitors need help with |
| The answer given | So we can check the tool is performing accurately |
| Date, time, and a rate-limiting identifier | To prevent abuse and to control our costs |
You do not need an account and we do not ask who you are unless you choose to have an answer emailed to you, in which case section 3.2 applies to that email address.
Please do not include confidential, client or personal information in your questions. The tool is designed to answer questions about published regulatory sources. It does not need, and should not be given, details of a specific business or customer.
We review the questions people ask to improve the tool and to decide what to write about. We look at them as a body of questions, not to identify individuals.
Your questions are not used to train any AI model, ours or anyone else’s. They are processed to produce your answer, and we read them as a body of questions to decide what to write about.
3.5 Automatically, when you visit any page
Standard server and security logs, including IP address, browser type and pages requested, used to keep the site running, to diagnose faults, and to protect against abuse.
Analytics. We count page views using Vercel Web Analytics, provided by the same company that hosts this site. It is cookieless: it sets nothing on your device, it does not follow you to other websites, and it does not build a profile of you. It records the page visited, the referring site, and coarse information such as country, browser and device type. It does not record your IP address in a form that identifies you, and we cannot use it to work out who an individual visitor is. We use it to learn which pages are read, so we know what to write next.
3.6 Cookies and similar technologies
This site uses only what it needs to function. We do not use advertising cookies, we do not use tracking pixels, and we do not share information with advertising networks.
As built, this site sets no cookies and stores nothing in your browser: no session identifier, no local storage, no tracking token. If the trial flow later needs a strictly necessary session cookie, this section will name it, say what it does and state how long it lasts, before that change goes live.
4. Our legal bases for using your information
Different laws apply depending on where you are. We aim to meet the highest applicable standard everywhere rather than operate to different rules in different places.
In Canada (PIPEDA, and Law 25 in Quebec): we rely on your consent. You give it by choosing to submit a form, run a trial, or ask a question, having been told on the page what we will do with the information. You can withdraw consent at any time (section 7).
In the United Kingdom and the European Union (UK GDPR and GDPR):
| What we do | Our legal basis |
|---|---|
| Reply to your enquiry | Legitimate interests: responding to someone who contacted us |
| Deliver a trial result you asked for | Performance of a service you requested |
| Operate the one-per-organisation limit | Legitimate interests: preventing abuse of a free service |
| Contact you about our services after a trial | Legitimate interests, balanced against your expectations, and stated clearly before you start |
| Send you the weekly regulatory note | Consent: you ticked a box asking for it, and you can withdraw it from any message we send |
| Keep the site secure and available | Legitimate interests |
Where we rely on legitimate interests, you have the right to object (section 7).
5. Who we share it with
We do not sell personal information. We do not share it for anyone else's marketing.
We use a small number of service providers to operate the site. They process information on our instructions and are not permitted to use it for their own purposes.
| Provider | What it does for us | Where it processes data |
|---|---|---|
| Supabase | Stores this site's database: contact submissions, trial records, search logs, and the counters that rate-limit the free tools | United States |
| Resend | Sends email: trial results, and notifications to us | United States |
| Vercel | Hosts and serves the website, and provides cookieless page-view analytics | United States |
| Anthropic | Processes questions asked of the Regulatory Risk & Compliance Agent in order to generate an answer | United States |
We may also disclose information where the law requires it, for example in response to a valid legal order, or where necessary to establish or defend a legal claim.
5.1 Information leaving Canada: please read
The providers above process information in the United States. This means your information is stored and handled outside Canada, and while it is there it may be accessible to United States courts, law enforcement and government authorities under the laws of that country.
We tell you this plainly because under Canadian privacy law you are entitled to know it before you decide whether to use these tools, and because it is exactly the kind of thing we would expect a client to ask us about a vendor.
6. How long we keep it
| What | How long |
|---|---|
| Contact form submissions | 24 months from last contact, then deleted |
| Trial records: your details, inputs and result | 24 months |
| The record that a domain has used a trial | The domain and the date are retained. The name, email address, inputs and result are deleted after the period above. |
| Your email address, if you asked for the weekly regulatory note | Until you ask us to stop. After that we keep a record that you asked, so that we do not add you again |
| Your acceptance of the terms of use: the address, the date, and which version you accepted | 24 months |
| Search questions and answers | 12 months |
| An answer held so that you can ask us to email it to you | One hour, then deleted. If you ask for it by email, the copy waiting on your confirmation follows the row below |
| An unconfirmed request waiting on the link in your email | The link expires after 24 hours; the record is deleted within a day of that |
| Server and security logs | 30 days |
7. Your rights
Whoever you are and wherever you are, you can ask us to:
Tell you what we hold about you, and give you a copy.
Correct it if it is wrong.
Delete it.
Stop using it to contact you about our services.
Withdraw your consent, where we relied on it.
If you are in the United Kingdom or the European Union, you also have the right to object to processing based on legitimate interests, to request restriction of processing, and to receive certain information in a portable format.
How to exercise any of these: email privacy@northwardcompliance.com. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not disclose your information to somebody else.
If you are not satisfied with our response, you can complain to:
Canada: the Office of the Privacy Commissioner of Canada. In Quebec, the Commission d'accès à l'information du Québec.
United Kingdom: the Information Commissioner's Office.
European Union: your national data protection authority.
Include US
We would rather you came to us first, and we will take any complaint seriously.
8. How we protect it
Information is stored in a database separate from any client work, with access controls enforced by the database itself rather than only by our software.
Access is limited to the people who need it.
The site is served over an encrypted connection.
The free tools are rate limited and protected against automated abuse.
We do not ask for, and you should not send us, passwords, banking details, government identification numbers, or client documents through this website.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to create a real risk of significant harm, we will notify the people affected and the relevant regulator as the law requires.
9. Children
This site is for businesses and the people who work in them. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe we have, contact privacy@northwardcompliance.com and we will delete it.
10. Changes to this policy
If we change what we collect or what we do with it, we will update this policy and change the date at the top. Where a change is significant, we will say what changed rather than quietly replacing the text.
11. Contact
Questions, requests or complaints about privacy:
privacy@northwardcompliance.com
Northward Compliance & Risk Services Inc.
2627 McCowan Road, Unit 1901, Toronto, Ontario M1S 5T1, Canada