Skip to main content
// Legal

Privacy Policy

Last updated: August 6, 2026

1. Introduction

RetailNorthstar ("we," "us," or "our") operates the retailnorthstar.ai website and the RetailNorthstar platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our platform.

2. Information We Collect

Information you provide directly:

  • Name and work email address (when you book a demo, download a resource, or contact us)
  • Company name, job title, and role
  • Planning data you upload to the platform (OTB plans, assortment data, buy plans)
  • Communications you send us (support requests, feedback)

Information collected automatically:

  • Browser type, device information, and operating system
  • IP address and approximate geographic location
  • Pages visited, time spent, and interaction patterns (via Plausible, Google Analytics, and Microsoft Clarity — see section 8, which explains what each one stores and when)
  • Referral source and search terms

3. How We Use Your Information

  • To provide, operate, and improve the RetailNorthstar platform
  • To respond to demo requests and support inquiries
  • To send relevant merchandising and planning content (you can unsubscribe at any time)
  • To analyze website usage and improve user experience
  • To detect and prevent fraud or security issues
  • To comply with legal obligations

4. Data Sharing

We do not sell your personal information. We may share information with:

  • Service providers — hosting (DigitalOcean), analytics (Plausible, Google Analytics, Microsoft Clarity), email delivery, and payment processing, solely to operate our business
  • Legal compliance — when required by law, regulation, or legal process
  • Business transfers — in connection with a merger, acquisition, or sale of assets

5. Your Planning Data

Planning data you upload to the RetailNorthstar platform (OTB plans, assortment data, buy plans, sales history) is your data. We do not access, use, or share your planning data for any purpose other than providing the platform service to you. We do not use your data to train models or share it with other customers.

6. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Marketing contact information is retained until you unsubscribe. We delete or anonymize data when it is no longer needed for the purposes described in this policy.

8. Cookies and Tracking

We run three analytics tools. None of them writes an analytics cookie to your device before you consent. Analytics consent defaults to denied for every visitor, in every country, from the moment the page loads — the choice below only changes whether we ask you, never whether you are protected.

  • Plausible — aggregate traffic counts. Cookieless: it stores nothing on your device and reads nothing from it, so it needs no consent and runs for everyone. No personal data leaves your browser through it.
  • Google Analytics 4 — traffic sources and page performance. It loads with Google Consent Mode v2 set to denied, which means it sends anonymous, cookieless measurement pings but writes no _ga or _ga_<id> cookies. Those cookies are only written after you accept. IP anonymisation is on.
  • Microsoft Clarity — heatmaps and session recordings. It has no cookieless mode, so the script does not load at all unless you accept. Nothing is downloaded, and its _clck and _clsk cookies and _cltk session key are never created. If you do accept, every form on this site is marked so that what you type is masked inside your browser — form contents are never transmitted to Clarity or stored in a recording.

Your consent choice. When you answer the banner we set rn_consent, a first-party cookie lasting six months that records only whether you accepted or rejected. We cannot honour a "no" without remembering it, so this cookie is strictly necessary and is set without consent, as the law permits. It contains no identifier and is never shared.

Other first-party cookies and browser storage. Separately from the analytics tools above, this site sets a small number of its own first-party cookies. None of them is shared with a third party, sent to an advertising network, or used to build a profile across other websites.

  • rn_share_ref — set for 30 days only if you arrive through a shared link that carries a referral code, so we can tell which shared link brought you here. It holds that code and nothing else.
  • rn_tier — set for 30 days when you use one of the interactive calculators or assessments. It holds a single word describing how far through the site you have got, so the next-step suggestion is relevant. The calculators and assessments also keep your in-progress answers in your own browser's local storage so a refresh does not wipe them; that data stays on your device unless you submit the form.
  • rn_access_* — set for 30 days after you unlock a downloadable resource, so you are not asked for your email again for the same file.

To be straight with you: of these, only rn_access_* is strictly necessary to deliver something you asked for. rn_share_ref and rn_tier are not, and today they are set without being covered by the banner. Bringing them behind the same consent gate as the analytics tools is outstanding work, not a finished job. You can clear or block them in your browser settings at any time and the site will keep working.

Legal basis. For Google Analytics and Microsoft Clarity, the basis is your consent, under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) UK/EU GDPR. For Plausible and the rn_consent cookie, no consent is required — Plausible stores nothing, and rn_consent is strictly necessary to deliver a service you asked for.

Where we ask. We show the consent banner to visitors in the EU, EEA, UK, and Switzerland, determined from the approximate country your IP address resolves to. If we cannot determine your location, we show the banner rather than assume. Visitors elsewhere are not asked, but the denied-by-default behaviour described above applies to them identically.

Withdrawing consent. Deleting the rn_consent cookie in your browser settings resets your choice: analytics returns to the denied default, any Google Analytics and Clarity cookies already set can be cleared at the same time, and you will be asked again on your next visit if the banner applies to you. You can also block cookies entirely through your browser — the site works without them. If you would like us to delete analytics data already associated with you, contact our privacy team →

9. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Request deletion of your personal information
  • Opt out of marketing communications
  • Request a copy of your data in a portable format

To exercise any of these rights, contact our privacy team →

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

11. Contact

If you have questions about this Privacy Policy, contact our privacy team →