Privacy Policy
Last updated: 13 August 2026
This policy explains what we do with your personal data when you use Northstar at vianorthstar.com.
1. Who is responsible
Northstar is operated by Mohammad Shahbazi, trading as Northstar. We are the data controller for the data described here.
Contact: contact@houseofshahbazi.com
If you are in the EU or EEA, you may complain to your own national data protection authority, or to the Romanian authority, ANSPDCP (dataprotection.ro).
[LATER] Replace the name and address above with your company details once the Dubai entity is registered.
2. What we collect
Account data. Your email address and login details, your plan, and your credit balance and transactions.
Job data. What you send us to run a job — your prompts and instructions — and the results we send back, together with the job's status, category and credit cost.
Files you upload. Photos, audio and video you upload for a job, and the files we generate from them.
Consent records. When you clone a voice, we record that you confirmed you had permission, together with your account, the wording you agreed to, the time, and your IP address. For photo editing we record the same without the IP address. We keep these because they are our evidence that permission was given.
Payment data. Your payment is handled by our payment provider. We receive confirmation that a payment succeeded and what you bought. We never see or store your card number.
Technical data. Server logs including IP address, browser type and the pages and actions requested, kept for security and troubleshooting.
We do not use tracking cookies or advertising cookies. We use only what is needed to keep you logged in.
3. Why we use it, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Account data | To give you an account and run the service | Performance of a contract |
| Job data and uploads | To carry out the job you asked for | Performance of a contract |
| Payment records | To take payment and meet accounting duties | Contract / legal obligation |
| Consent records | To show that permission was given for a voice or photo | Legitimate interest — establishing and defending legal claims |
| Server logs | Security, abuse prevention, fixing faults | Legitimate interest |
| Service emails | To tell you a job is ready or that something went wrong | Performance of a contract |
| Marketing emails | Only if you have asked for them | Consent — withdraw at any time |
We do not sell your data, and we do not use your content to train our own AI models.
4. Who we share it with
To run a job we pass the necessary content to the provider handling it. These are our processors:
| Provider | What it handles | Where |
|---|---|---|
| Anthropic | Text jobs, and deciding which provider a request should go to | United States |
| fal.ai | Image generation and photo editing, video, voice, speech transcription and background sound | United States |
| Replicate | Music generation and voice models | United States |
| Vercel | Hosting the website | United States / global |
| Railway | Hosting the backend and database | United States |
| Resend | Sending service emails | United States |
| Stripe | Payment processing | United States |
Providers may change; we will keep this list current.
We may also disclose data where the law requires it, or where it is necessary to investigate abuse or to establish or defend a legal claim.
5. Data leaving Europe
Most of our providers are in the United States, so your data is transferred outside the EEA. These transfers are made under the European Commission's standard contractual clauses or an equivalent safeguard offered by the provider.
6. How long we keep things
- Account data: while your account is open, then deleted within 30 days of closure.
- Jobs and generated files: until you delete them or close your account.
- Consent records: kept for 5 years after the voice or photo was used, or after your account closes, whichever is later. These are deliberately kept after account deletion because they are our evidence that permission existed.
- Payment records: as long as tax and accounting law requires.
- Server logs: up to 90 days.
7. Your rights
If you are in the EU or EEA you have the right to:
- see the data we hold about you and get a copy;
- correct it if it is wrong;
- delete it — although we may keep consent records and payment records as explained above;
- restrict or object to our use of it where we rely on legitimate interest;
- take it with you in a portable format;
- withdraw consent at any time, where we relied on consent;
- complain to a supervisory authority in the country where you live.
To exercise any of these, email contact@houseofshahbazi.com. We will answer within one month.
8. Deleting a cloned voice
You can delete a cloned voice from your account at any time. When you do, we delete the voice model and the recordings it was built from.
We keep the consent record itself, as explained in section 6. It contains no audio.
9. Children
Northstar is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, email us and we will delete it.
10. Security
Traffic is encrypted in transit. Access to the database is limited to what is needed to run the service. Uploaded files are stored under addresses we generate ourselves.
No system is perfectly secure. If a breach affects your personal data and poses a real risk to you, we will tell you and the relevant authority as the law requires.
11. Changes
We will post any change here and update the date at the top. Where a change is significant, we will tell you by email or in the app.
12. Contact
contact@houseofshahbazi.com