Privacy Notice

Who we are

SoD AS (Study of Directions), Stavanger, Norway, is the data controller for personal data processed through northstarxr.com and the Northstar XR software. This means we decide why and how your personal data is processed. Contact: mads@northstarxr.com.

Data we collect and why

• Account data (name, email, password hash, profile picture) — to create and run your account. Legal basis: contract.
• Order and license data (company name, email, plan, license key, expiry) — to deliver and manage your subscription. Legal basis: contract and legal obligation (bookkeeping).
• Device data (device ID, device name and model of the headset or computer using a license) — to bind licenses to devices and prevent misuse. Legal basis: contract and legitimate interests.
• Usage and technical data (IP address, license check timestamps, logs) — for security, fraud prevention and keeping the service working. Legal basis: legitimate interests.
• Support messages — to answer your questions. Legal basis: contract and legitimate interests.

Card and payment details are collected directly by Paddle, not by us.

Who we share data with

• Paddle (Paddle.com Market Ltd), our Merchant of Record, for the sale of our products, subscription management, payments, tax compliance and invoicing.
• Service providers who host our website, database and email delivery on our behalf.
• Professional advisers such as legal and accounting advisers.
• Authorities where required by law.

We do not sell your personal data.

International transfers

Some providers may process data outside the EEA. Where this happens, we rely on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions.

How long we keep data

We keep account and license data while your account or license is active, and order records as long as required by Norwegian bookkeeping law (generally 5 years). Data is then deleted or anonymised when no longer needed.

Your rights

Under the GDPR you have the right to access, correct, erase, restrict or object to processing of your data, to data portability, and to withdraw consent at any time where processing is based on consent. Contact us to exercise your rights; we respond within one month. You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls and private, owner-only storage for profile images.

Cookies

We only use essential cookies and local storage needed for sign-in and checkout. We do not use advertising cookies. You can clear these through your browser settings, but sign-in will then stop working.