Privacy policy

• Account information: the name and email address of each person a customer invites to its workspace.
• Email from connected mailboxes: when a customer connects a Google Workspace or Microsoft 365 mailbox, the messages and attachments in that mailbox, including senders, recipients, subjects and bodies.
• Records the team creates: the replies, approvals and other actions people take in Northbound.
• Calls and text messages: when a customer uses Northbound’s calling or text messaging, call audio, transcripts and the messages sent and received.

We use customer data only to provide Northbound to that customer:

• to recognize carrier quotes, invoices, tracking updates and delivery messages, and show them in the customer's workspace;
• to draft replies for the team to review, and to send the replies the team approves;
• to keep the service secure, investigate abuse and fix problems.

We do not sell customer data and do not use it for advertising.

When a customer connects a Google Workspace mailbox, Northbound asks for Gmail read and modify access. With it, Northbound:

• reads the messages in that mailbox, to find the freight email described above;
• applies labels to messages, so the team can see what Northbound has handled;
• creates drafts, and sends the replies a person on the team approves.

Northbound uses this data only to provide those features for the customer who connected the mailbox. We do not sell it, do not use it for advertising, and do not use it to train AI models. People at Capture Lab do not read Gmail data unless the user has given consent (for example, to resolve a support request), it is needed to investigate security or abuse, it is required to comply with the law, or it has been aggregated and anonymized for internal operations.

Northbound's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft 365 and Outlook mailboxes connect the same way through Microsoft Graph, and the same limits apply to the data Northbound receives from them.

To understand messages and draft replies, Northbound sends message content to Anthropic. When a customer turns on calling, call audio and transcripts are processed by ElevenLabs and the language model it is configured to use. We do not use customer data to train AI models.

Each customer’s data is kept in its own workspace, and only the people that customer invites can see it. These service providers process customer data on our behalf:

• Anthropic, to read messages and draft replies;
• ElevenLabs, for voice calls, when a customer turns on calling;
• Twilio, for text messages and phone numbers;
• Clerk, for sign-in;
• Railway and Vercel, for hosting;
• Google and Microsoft, only for the customer's own mailbox, through the access the customer grants.

They process it under their own terms, and only to provide their service to us. We share customer data with no one else, except when the law requires it.

Laurie, the freight assistant in Northbound, texts only people who opted in: a member of the freight team who ticks the consent box in the Northbound app, a carrier or customer contact who agrees by phone, or someone who texts the number first, who gets replies in that conversation. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. The full terms are in our SMS terms.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all of the sharing described above and will not be shared with any third parties.

Customer data is stored in the United States (US West): records in a Postgres database and documents in S3-compatible object storage, both hosted on Railway. Access tokens for connected mailboxes are encrypted at rest.

We keep a customer’s data while it uses Northbound. A customer can disconnect a mailbox at any time from Settings → Connections; Northbound then deletes the stored access token, revokes its access with Google, and stops reading the mailbox. To have your data deleted, email aidan@capture-lab.com.

• Disconnect a mailbox at any time from Settings → Connections.
• Remove Northbound’s access from your Google Account at myaccount.google.com/permissions.
• Ask for your data to be deleted by emailing aidan@capture-lab.com.

Questions about this policy or your data go to aidan@capture-lab.com, or write to Capture Lab Inc., 1800 Owens St., San Francisco, CA 94158.