Return to the app
NORTH + LEGACY LLC

Privacy, Data Retention & Deletion Policy

This policy explains how North + Legacy collects, uses, shares, protects, retains, and deletes information used in N+L Contractor OS, including its Lead Center, Finance Center, Credit Builder, Social Media Command Center, consultation forms, and related customer portals.

Status
Adopted
Effective date
September 20, 2026
Policy owner
Michael McKinnon, Owner
Review cycle
At least annually

1. Scope and controller

North + Legacy LLC is responsible for the information it collects through these applications. This policy applies to customers, prospective customers, property managers, subcontractors, workforce users, and other people who submit information or use a North + Legacy account. It does not replace the separate privacy notices of Plaid, a financial institution, or another independent service provider.

2. Information we collect

Account and identity data

Name, company, email, phone number, role, authentication records, account preferences, and access history.

Customer and project data

Properties, project descriptions, photos, messages, estimates, proposals, contracts, invoices, payments, schedules, files, and service history.

Lead information

Contact details, property information, service needs, referral or campaign information, follow-up activity, and consultation submissions.

Social-media connection and content data

Connected Page and professional-account identifiers, profile details, authorized performance insights, posting permissions, approved media sources, draft and approved content, publishing schedules, and platform delivery results.

Financial and business-credit information

Connected institution and account names, account type, masked account number, balances, transactions, categories, budgets, payables, receivables, job costs, receipt images and extracted receipt details, tax-reserve calculations, business-credit providers, score models, score history, report dates, risk labels, D-U-N-S number, and credit-building plan activity.

Technical information

Device and browser information, service logs, timestamps, security events, and information needed to operate, troubleshoot, and protect the applications.

North + Legacy does not receive or store the bank username and password entered in Plaid Link. We do not intentionally collect full payment-card information through these applications.

3. Sources and purposes

Information comes from you, an authorized company or property representative, application activity, project communications, approved integrations, connected Facebook, Instagram, and other social-media business profiles, Plaid and connected financial institutions, NAV, Dun & Bradstreet, and service providers operating on our behalf. We use it to respond to leads; prepare and manage estimates, proposals, projects, invoices, schedules, files, messages, and payments; analyze authorized business profiles; draft, approve, schedule, and publish business content; provide account access; perform bookkeeping, budgeting, job costing, tax-reserve calculations, business-credit monitoring, funding-readiness planning, tax preparation support, and financial reporting; secure and troubleshoot the applications; meet contractual, tax, insurance, and legal obligations; and improve legitimate business operations.

4. Plaid and financial data

  • Connecting an account is voluntary and begins only when an authorized user selects the connection action and completes Plaid Link.
  • Plaid Link explains the requested financial-data categories and uses. North + Legacy requests account, balance, and transaction information for finance management, bookkeeping, budgeting, job costing, tax preparation support, and related reporting.
  • North + Legacy does not sell Plaid-sourced data, use it for advertising, or initiate payments or transfers through this integration.
  • An authorized Owner may disconnect a bank connection. A person may also manage eligible connections through Plaid's consumer portal where available.
  • North + Legacy limits use of Plaid data to the purposes disclosed when consent is obtained. Additional products or materially different uses require additional consent where applicable.

5. When information is disclosed

North + Legacy does not sell personal information. Information may be disclosed to authorized North + Legacy users based on role and assignment; customers and authorized property representatives; subcontractors or field personnel assigned to relevant work; providers that host, secure, communicate, store, analyze, or process data for the applications; Plaid and connected financial institutions; professional advisers; and government, regulatory, insurance, or legal parties when reasonably necessary or required. Providers receive only the access reasonably needed for their service.

6. Consent and choices

You provide information voluntarily through forms and account workflows. Consultation forms require authorization before North + Legacy contacts you by phone, text, or email. Selecting Connect with Plaid requests the financial connection and transfers you to Plaid's consent flow. Connecting a social platform transfers the Owner to that provider's authorization screen, where the provider displays the requested permissions. Social drafts remain editable and require Owner approval before scheduling. You may decline to submit optional information, disconnect eligible integrations, change account preferences, or ask North + Legacy to stop nonessential communications. Transactional, security, contractual, or legally required communications may still be sent.

7. Data retention schedule

Unconverted leads and consultation requestsUp to 24 months after the last meaningful activity, unless consent is renewed, the person asks for deletion, or the record is converted into a customer or project record.
Account profiles and access recordsWhile the account is active, then up to 24 months after deactivation for security, support, and access-history purposes, unless a longer period is legally required.
Estimates, contracts, invoices, payments, receipts, job costs, tax records, and completed project filesGenerally 7 years after the related transaction, project completion, or tax year, subject to contractual, tax, insurance, warranty, dispute, and legal requirements.
Plaid-connected account and transaction dataWhile the connection is active and the data is needed for the Finance Center. After disconnection, deletion is completed upon verified request unless a record must be retained for accounting, tax, fraud-prevention, dispute, or legal purposes.
Business-credit monitoring and plan dataWhile Credit Builder is active and for up to 24 months after the last update, unless earlier deletion is requested or a longer period is reasonably required for a funding application, dispute, fraud prevention, or legal obligation.
Connected social profiles, content drafts, and publishing recordsWhile the connection or Social Media Command Center is active, then up to 24 months after disconnection or the last publishing activity unless earlier deletion is requested or a record is required for security, dispute, or legal purposes.
Security and operational logsNormally up to 12 months, unless needed longer to investigate an incident, prevent abuse, establish compliance, or satisfy a legal obligation.
BackupsProtected backups may retain deleted information until the applicable backup is overwritten or expires. Deleted information is not intentionally restored to active use except for disaster recovery or legal necessity.

Where several periods apply, North + Legacy uses the longest period reasonably required. A legal hold, active dispute, fraud investigation, warranty, insurance matter, unpaid balance, contract, or government requirement may temporarily suspend deletion. Records are reviewed at least annually and after material legal, service, or application changes.

8. Deletion procedure

  1. Send a request to michael.mckinnon@northandlegacy.com with the subject “Privacy or Data Deletion Request.”
  2. Identify the account, email address, project, or financial connection involved. Do not email passwords, bank credentials, or full account numbers.
  3. North + Legacy will verify identity and authority before releasing or deleting information. Additional information may be requested only when reasonably necessary for verification.
  4. North + Legacy will acknowledge the request and respond within 45 days when reasonably practicable. If more time is required, the requester will be informed.
  5. Approved deletion is applied to active systems and connected access. Information subject to a valid retention requirement is restricted and retained only for that purpose until deletion is permitted.

Authorized users may also request access, correction, a copy, or restriction of their personal information. North + Legacy will not discriminate against a person for making a good-faith privacy request.

9. Protection and incidents

North + Legacy uses role-based access, individual accounts, encrypted network connections, protected service credentials, restricted financial functions, backups, change testing, dependency reviews, and the safeguards described in the Information Security Policy. No system can guarantee absolute security. Suspected unauthorized access or misuse should be reported promptly to the contact below.

10. Children

These business applications are not directed to children under 13, and North + Legacy does not knowingly collect personal information from children under 13 through them. Contact North + Legacy if such information may have been submitted.

11. Changes and contact

Material changes will be posted with an updated effective date and, when appropriate, communicated through the application or email. Questions and privacy requests may be directed to Michael McKinnon, Owner and Privacy Contact, at michael.mckinnon@northandlegacy.com. North + Legacy LLC serves Charlotte, North Carolina and surrounding areas.