Skip to main content
// Legal

Privacy Policy

Last updated: September 26, 2026

1. Introduction

RetailNorthstar ("we," "us," or "our") operates the RetailNorthstar platform and the websites retailnorthstar.ai, retail-plan.com, line-board.com and theapparelos.com. This Privacy Policy covers all of them: each site shows the same cookie banner and links here, so the choice you make on any one of them is governed by this policy. (royalty-reporting.com publishes its own privacy policy.) This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit any of those websites or use our platform.

2. Information We Collect

Information you provide directly:

  • Name and work email address (when you request a free trial or a demo, download a resource, or contact us)
  • Company name, job title, and role
  • Planning data you upload to the platform (OTB plans, assortment data, buy plans)
  • Communications you send us (support requests, feedback)

Information collected automatically:

  • Browser type, device information, and operating system
  • IP address and approximate geographic location
  • Pages visited, time spent, and interaction patterns (via Plausible and Google Analytics, and — only if you turn the Analytics category on — Microsoft Clarity; see section 8, which explains what each one stores and when)
  • Referral source and search terms

3. How We Use Your Information

  • To provide, operate, and improve the RetailNorthstar platform
  • To respond to free trial and demo requests and support inquiries
  • To send relevant merchandising and planning content (you can unsubscribe at any time)
  • To analyze website usage and improve user experience
  • To detect and prevent fraud or security issues
  • To comply with legal obligations

4. Data Sharing

We do not sell your personal information. We may share information with:

  • Service providers — hosting (DigitalOcean), analytics (Plausible, Google Analytics, Microsoft Clarity), email delivery, and payment processing, solely to operate our business
  • Legal compliance — when required by law, regulation, or legal process
  • Business transfers — in connection with a merger, acquisition, or sale of assets

5. Your Planning Data

Planning data you upload to the RetailNorthstar platform (OTB plans, assortment data, buy plans, sales history) is your data. We do not access, use, or share your planning data for any purpose other than providing the platform service to you. We do not use your data to train models or share it with other customers.

6. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Marketing contact information is retained until you unsubscribe. We delete or anonymize data when it is no longer needed for the purposes described in this policy.

8. Cookies and Tracking

We group everything on this site into three categories. Analytics and Marketing are off until you turn them on — for every visitor, in every country, from the moment the page loads. Nothing in the banner changes whether you are protected; it only records what you choose.

  • Essential — always on, and not something you can switch off. This covers remembering your cookie choice, security, basic site operation, and counting visits in a mode that writes nothing to your device and reads nothing from it. That last part is why it needs no consent: Article 5(3) of the ePrivacy Directive is about storing or accessing information on your device, and cookieless counting does neither. Two tools run this way — Plausible, which stores nothing anywhere on your device, and Google Analytics 4 running under Google Consent Mode v2 with storage denied, which sends cookieless measurement pings and writes no _ga or _ga_<id> cookie. To be straight about the limit of that: a cookieless Google ping still transmits your IP address and browser user-agent to Google LLC, so it is not accurate to call it private or unshared — only to say that it puts nothing on your device. IP anonymisation is on. One more caveat we would rather flag than hide: the "writes nothing" description covers those two tools, not our own page code, which keeps a small deduplication list in session storage so a scroll or timer event is not counted twice — rn_fired_events, listed further down.
  • Analytics — optional, off unless you turn it on. This is the cookie-writing half of the same tools. Turning it on lets Google Analytics write _ga and _ga_<id>, and loads Microsoft Clarity, which records sessions and heatmaps and sets _clck, _clsk and a _cltk session key. Clarity has no cookieless mode, so until you turn this on its script is never downloaded at all. If you do turn it on, our own page code marks every form, input and text area — including the ones that only appear after the page has loaded — so that what you type is masked in your browser. That is a second layer underneath Clarity's own account-level masking setting, which is the authoritative control and cannot be set from the page; we would rather describe it that way than promise you an outcome the page code alone cannot guarantee.
  • Marketing — optional, off unless you turn it on, and carrying nothing today. We run no advertising pixel, no remarketing tag and no cross-site tracker on this site. The category exists so the advertising signals we send to Google are managed rather than unmanaged, and so that a refusal you record now already applies if that ever changes. Leaving it off today removes nothing, because there is nothing there to remove.

Your consent choice. When you answer the banner we set rn_consent, a first-party cookie lasting six months. It records two things only: whether you allowed Analytics and whether you allowed Marketing. We cannot honour a "no" without remembering it, so this cookie is strictly necessary and is set without consent, as the law permits. It contains no identifier and is never shared with anyone else; like any first-party cookie it is sent to this site along with your requests.

Closing the banner counts as declining. If you close the banner with the X rather than answering it, we record that as a refusal of both optional categories and we do not ask you again. We never treat closing the banner, scrolling, or simply carrying on browsing as consent.

Where we ask. We show the banner to every visitor, everywhere, until they decide. Your approximate country — worked out from the IP address your request arrives with, then discarded — changes only how the buttons are laid out: in the EU, EEA, UK and Switzerland, Accept and Decline are shown identically, because refusing has to be exactly as easy as accepting. If we cannot work out where you are, you get that same layout. Before September 2026 we asked only European visitors, which left everyone else permanently in the denied default with no way to opt in; that is what this change fixes.

Other first-party cookies and browser storage. Separately from the analytics tools above, this site keeps a small number of its own items in your browser. None of them is shared with a third party, sent to an advertising network, or used to build a profile across other websites.

  • rn_share_ref — set for 30 days only if you arrive through a shared link that carries a referral code, so we can tell which shared link brought you here. It holds that code and nothing else.
  • rn_tier — set for 30 days when you use one of the interactive calculators or assessments. It holds a single word describing how far through the site you have got, so the next-step suggestion is relevant. The same state is also mirrored in your browser's local storage under rn_funnel, and the calculators and assessments keep your in-progress answers there too so a refresh does not wipe them; that data stays on your device unless you submit the form.
  • rn_access_* — set for 30 days after you unlock a downloadable resource, so you are not asked for your email again for the same file.
  • rn_fired_events — a short list of which page-engagement events have already been sent, kept in your browser's session storage so a scroll or timer event is not counted twice. It holds no identifier and it clears when you close the tab.

To be straight with you: of these, only rn_access_* is strictly necessary to deliver something you asked for. rn_share_ref, rn_tier / rn_funnel and rn_fired_events are not, and today they are still written without being covered by the banner — rn_share_ref in particular is first-touch attribution, which belongs behind the Marketing category, and rn_fired_events belongs behind Analytics. Moving them behind the same gate as the analytics tools is outstanding work, not a finished job, and we would rather say so here than let the list above read as exhaustive. You can clear or block them in your browser settings at any time and the site will keep working.

Legal basis. For the Analytics category — Google Analytics cookies and Microsoft Clarity — and for the Marketing category, the basis is your consent, under Article 5(3) of the ePrivacy Directive and Article 6(1)(a) UK/EU GDPR. For the Essential category no consent is required: cookieless counting stores nothing on your device and reads nothing from it, so Article 5(3) is not engaged, and the rn_consent cookie is strictly necessary to deliver a choice you made.

Changing or withdrawing your choice. Use the Cookie settings link in the site footer. It re-opens the banner with your current choices shown, so you can switch a category off, switch one on, or decline everything in one click. Withdrawing is as easy as giving consent, and you can do it as often as you like.

What happens when you turn Analytics off. We stop the cookie-writing mode straight away, expire the _ga, _ga_<id>, _clck and _clsk cookies we can reach from the page, and reload so that a Clarity script your browser has already run is gone rather than merely told to stop. Two honest limits. First, _cltk is not a cookie — it is a key in your browser's session storage, our expiry step does not touch it, and it goes when you close the tab. Second, a script the browser has already executed cannot be removed in place, so if that reload is blocked it stops at your next page view instead. The cookies and the signals sent to Google have already changed by then.

You can also delete the rn_consent cookie in your browser settings, which resets you to undecided and brings the banner back, or block cookies entirely — the site works without them. If you would like us to delete analytics data already associated with you, contact our privacy team →

9. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Request deletion of your personal information
  • Opt out of marketing communications
  • Request a copy of your data in a portable format

To exercise any of these rights, contact our privacy team →

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.

11. Contact

If you have questions about this Privacy Policy, contact our privacy team →