HPT’s Northstar CRM Privacy Policy

Effective date: July 11, 2026
Last updated: July 11, 2026

RMR, Inc. d/b/a High Performance Teams (“HPT,” “we,” “our,” or “us”) operates HPT’s Northstar CRM (“Northstar CRM” or the “CRM”). Northstar CRM is a private business application available only to authorized HPT employees, contractors, and team members.

This Privacy Policy explains how we collect, access, use, store, disclose, retain, and delete information through Northstar CRM and its connected services. It also applies to individuals and business contacts whose information is maintained in the CRM.

1. Scope

This Privacy Policy covers information processed through:

• Northstar CRM;
• Microsoft and Outlook connections;
• QuickBooks Online connections;
• Contact imports;
• Marketing-email features;
• Optional artificial-intelligence features; and
• Authentication, hosting, and security services supporting the CRM.

Third-party services have their own privacy policies and terms. This Privacy Policy does not replace the privacy policies of Microsoft, Intuit, OpenAI, Cloudflare, or other service providers.

HPT independently determines how information is used in Northstar CRM. HPT does not process information on behalf of Intuit.

2. Information We Collect and Process

Authorized-user and access information

When an authorized team member signs in, the authentication service may provide the user’s:

• Name;
• Work email address; and
• Authentication identifier.

We also maintain the user’s CRM role, account status, contact-access scope, revenue-access scope, and account creation or modification dates.

Contact and company information

Authorized users may enter, import, or synchronize business-contact information, including:

• Name;
• Business email address;
• Job title or role;
• Employer or associated company;
• Business, direct, and mobile telephone numbers;
• Mailing or business address;
• Relationship or lead status;
• Assigned HPT team member;
• Last-contact information; and
• Other information an authorized user enters in notes or CRM fields.

Company records may include a company name, main telephone number, address, associated contacts, notes, opportunities, and activity history.

Sales, task, and note information

The CRM may store:

• Opportunity or project name;
• Associated company;
• Estimated value;
• Sales stage and probability;
• Anticipated close date;
• Assigned owner;
• Tasks, due dates, priorities, and completion status; and
• Notes entered by authorized users.

Notes and other free-text fields may contain personal, confidential, or sensitive information if a user chooses to enter it. Authorized users should enter only information reasonably necessary for legitimate HPT business purposes.

Spreadsheet imports

Northstar CRM can import contacts from Excel or CSV files. The source file is processed in the user’s browser. The original workbook, filename, and complete source file are not intentionally stored by Northstar CRM. Only the contact information reviewed and submitted by the user is stored.

Microsoft and Outlook information

When an authorized user connects Outlook, Northstar CRM may request Microsoft permissions including User.Read, Mail.Read, and Mail.Send.

Depending on the feature used, the CRM may access:

• Outlook account name and email address;
• Sender and recipient information;
• Microsoft message identifiers;
• Email subject lines;
• Short message previews;
• Sent and received dates;
• Message direction and status; and
• Information necessary to send an email selected by the user.

Northstar CRM stores email activity associated with CRM contacts, including the contact’s email address, message identifier, subject, direction, date, status, and a message preview of up to approximately 1,000 characters. The CRM does not intentionally store Outlook attachments or create a complete archive of the user’s mailbox.

When scanning for potential contacts, the CRM may examine sender information, subject lines, short previews, and dates from recent inbox messages. The scan applies automated rules intended to exclude obvious spam, newsletters, automated messages, security messages, and existing contacts. Potential contacts remain temporary unless an authorized user chooses to add them to the CRM.

Outlook authentication information is maintained in the user’s browser session. Northstar CRM does not intentionally store Microsoft access or refresh tokens in its CRM database.

QuickBooks Online information

When an administrator connects QuickBooks Online, Northstar CRM may access accounting information authorized through Intuit’s OAuth process.

Information accessed or stored may include:

• QuickBooks company and realm identifiers;
• Company name;
• QuickBooks customer identifiers and customer names;
• CRM-to-QuickBooks customer mappings;
• QuickBooks connection and synchronization dates;
• Cash-basis revenue totals;
• Expense totals;
• Net-income totals;
• QuickBooks Class or revenue-stream names; and
• Monthly, current-year, and lifetime financial summaries.

Northstar CRM stores summarized financial totals used for its internal reporting features. It does not intentionally store complete invoices, payment-card details, bank-login credentials, or raw transaction line items.

QuickBooks access and refresh tokens are encrypted before being stored. The Intuit Client Secret is also encrypted. The Client ID, company identifiers, customer mappings, and summarized financial information are stored as operational CRM records.

Marketing-email information

Marketing features may process:

• Campaign names and content;
• Subject lines and preview text;
• Images and links selected by a user;
• Recipient names and email addresses;
• Audience selections;
• Send dates;
• Accepted or failed send status;
• Delivery-provider operation identifiers;
• Error information; and
• Unsubscribe or suppression-list information.

Northstar CRM does not currently perform email-open or link-click tracking.

Marketing emails contain instructions allowing a recipient to request removal. Unsubscribe requests are processed by HPT and added to the CRM suppression list. Suppressed addresses are excluded from future CRM marketing campaigns unless the recipient later asks to resubscribe.

Optional artificial-intelligence features

If an authorized user intentionally invokes an enabled AI feature, Northstar CRM may send the user’s question and a limited CRM summary to an AI service provider.

The summary may include opportunity names, companies, values, stages, probability, anticipated close dates, open-task titles, due dates, priorities, and associated contact names. Contact email addresses and telephone numbers are excluded from the standard AI summary, but names and free-text business information may still be included.

Authorized users should not submit Social Security numbers, financial-account credentials, medical information, payment-card information, or other unnecessary sensitive information to an AI feature.

If the AI feature is not enabled or is not invoked, this information is not sent to the AI service for that purpose.

Technical and security information

The CRM and its service providers may process technical information needed to authenticate users, protect the application, diagnose errors, and operate the service. This may include session information, timestamps, request information, security events, and standard server logs.

Northstar CRM does not use advertising cookies, advertising analytics, or behavioral-profiling tools. Essential authentication cookies may be used by the private sign-in service. The Outlook connection uses browser session storage for its Microsoft authentication session.

3. Sources of Information

We receive information from:

• Authorized HPT users;
• Excel or CSV files selected for import;
• Microsoft Entra, Outlook, and Microsoft Graph;
• Intuit and QuickBooks Online;
• Individuals and businesses communicating with HPT;
• Marketing-email service providers; and
• Hosting, authentication, and security providers.

4. How We Use Information

We use information to:

• Maintain business-contact and company records;
• Manage relationships, opportunities, tasks, and follow-ups;
• Associate communications with the appropriate contact or company;
• Send user-directed business emails;
• Identify potential new business contacts;
• Create and send permitted marketing communications;
• Honor unsubscribe requests;
• Synchronize and summarize QuickBooks financial information;
• Report cash-basis revenue, expenses, and net income;
• Control team-member access and permissions;
• Provide optional AI-assisted business summaries;
• Protect, troubleshoot, and maintain the CRM;
• Comply with legal, tax, accounting, audit, and regulatory obligations; and
• Protect HPT, its clients, contacts, personnel, and systems.

We use QuickBooks information only for the disclosed accounting, customer-matching, and reporting functions of Northstar CRM. We do not use QuickBooks information for unrelated purposes.

5. How We Disclose Information

Information may be available to authorized HPT team members according to their assigned roles and the CRM feature being used. Access varies by permission and feature.

We may disclose information to service providers that support the CRM, including:

• OpenAI or ChatGPT services for private hosting, authentication, and enabled AI functions;
• Cloud infrastructure and database providers;
• Microsoft for identity, Outlook, Microsoft Graph, and email services;
• Intuit for QuickBooks Online connectivity;
• Microsoft Azure Communication Services or another configured email-delivery provider; and
• Professional advisers when reasonably necessary.

Service providers receive information only as necessary to provide their services, protect the application, or comply with legal obligations.

We may also disclose information:

• When required by law, subpoena, court order, or government request;
• To investigate fraud, security threats, or misuse;
• To protect legal rights, safety, property, or systems; or
• In connection with a merger, acquisition, financing, reorganization, or transfer of business assets, subject to appropriate confidentiality and legal protections.

We do not sell personal information. We do not provide QuickBooks-derived information to third parties for their independent marketing, advertising, or unrelated commercial use. We do not share one customer’s QuickBooks information with another customer.

HPT may use business-contact information to send its own business or marketing communications where permitted by law and consistent with the recipient’s relationship with HPT.

6. Retention and Deletion

Northstar CRM does not currently apply one automatic retention period to every category of information. Information is retained while reasonably necessary for HPT’s legitimate internal operations, relationship management, accounting, tax, legal, audit, security, and compliance purposes.

Retention practices include the following:

• Contact, company, deal, task, note, and synchronized email records remain until deleted by an authorized user, replaced by updated information, or removed in response to a verified request.
• Deleting a contact or company may remove associated CRM information, but separately maintained marketing-suppression records, send history, accounting records, tasks, or legally required records may remain.
• Marketing suppression records may be retained for as long as reasonably necessary to honor the recipient’s request not to receive future marketing.
• Marketing campaign and send records may be retained for operational, troubleshooting, and compliance purposes.
• Deactivating or removing a team member stops or removes the person’s CRM rights record. Historical notes or records attributed to that user may remain as part of HPT’s business history.
• Disconnecting Outlook ends the connected Outlook session and clears the application’s Microsoft token session from the browser. Email activity previously synchronized into the CRM remains until deleted by an authorized administrator or through a verified deletion request.
• Disconnecting QuickBooks removes the stored OAuth connection and tokens and stops new QuickBooks access. Previously synchronized customer mappings and summarized financial records may remain where needed for the CRM’s stated reporting purpose or HPT’s accounting, tax, audit, or legal obligations.
• Intuit-derived personal information will be securely deleted upon a verified request unless applicable law requires retention. At present, removal of previously synchronized QuickBooks summaries is completed by an administrator rather than through an automatic deletion process.
• Temporary spreadsheet-import and potential-contact-scan information that is not submitted is not intentionally retained by the CRM.

When information is no longer reasonably necessary, HPT will delete, deidentify, or restrict it, subject to legal and operational requirements. Limited residual copies may remain temporarily in protected provider backups or security records until overwritten according to the provider’s normal procedures.

7. QuickBooks Disconnection and Revocation

An authorized administrator may disconnect QuickBooks from Northstar CRM. Authorization may also be revoked through the applicable Intuit account settings.

After disconnection or revocation:

• Northstar CRM stops requesting new QuickBooks information;
• Stored OAuth access and refresh tokens are removed or become unusable;
• Intuit-derived information is not used for new or unrelated purposes; and
• HPT will process verified deletion requests subject to legal recordkeeping obligations.

To request deletion of previously synchronized QuickBooks-derived information, contact HPT using the information below.

8. Outlook Disconnection

An authorized user may disconnect Outlook through Northstar CRM or manage the application’s permissions through their Microsoft account.

Disconnecting Outlook stops future mailbox access through that connection. CRM email-activity records already synchronized are not automatically removed. An authorized administrator or verified privacy request can be used to request their deletion, subject to applicable retention obligations.

9. Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the information, including:

• Private application access;
• Authentication controls;
• Role-based CRM permissions;
• HTTPS connections;
• Encryption of stored QuickBooks tokens and the Intuit Client Secret;
• Browser-session storage for Outlook authentication;
• Input validation; and
• Restricted administrative functions.

No internet-connected system can be guaranteed completely secure. Authorized users are responsible for protecting their accounts, devices, passwords, and authentication methods and for reporting suspected unauthorized access promptly.

10. Individual Rights and Choices

Depending on the circumstances and applicable law, an individual may request that HPT:

• Confirm whether information about them is maintained;
• Provide access to information about them;
• Correct inaccurate information;
• Delete information that is no longer required;
• Restrict or object to certain uses; or
• Stop sending marketing communications.

HPT may need to verify the requester’s identity and authority before acting. Some information may be retained when required for legal, accounting, tax, security, fraud-prevention, or compliance purposes.

Northstar CRM does not currently provide a public self-service privacy-request portal. Requests should be submitted using the contact information below.

11. Marketing Choices

A recipient may request removal from HPT marketing emails by following the unsubscribe instructions in an email or contacting HPT directly.

Unsubscribe requests are reviewed and added to the suppression list by HPT. Because processing is not currently fully automated, recipients should allow a reasonable period for the request to be completed.

Transactional, relationship, administrative, or legally required communications may still be sent where appropriate.

12. Children’s Information

Northstar CRM is a business application and is not directed to children. We do not knowingly use the CRM to solicit information from children under 13. If we learn that a child’s information was entered without appropriate authorization, we will take reasonable steps to remove it.

13. Processing Locations

HPT operates in the United States. Information may be processed in the United States and in other locations where our service providers maintain operations, subject to applicable law and contractual protections.

14. Changes to This Privacy Policy

We may update this Privacy Policy when the CRM, connected services, legal requirements, or data practices change. The revised policy will display a new “Last updated” date.

Material changes affecting authorized users may also be communicated through the CRM, email, or another reasonable method.

15. Contact Us

Questions, privacy requests, correction requests, or deletion requests may be directed to:

RMR, Inc. d/b/a High Performance Teams
905 Jefferson Street, Suite 502
Lafayette, Louisiana 70501
Email: jay@highperformanceteams.net
Telephone: (337) 329-8326

Please include enough information for us to identify the relevant CRM record and verify that you are authorized to make the request. Do not send passwords, Social Security numbers, payment-card information, or other unnecessary sensitive information by email.

16. Trademark Notice

Intuit and QuickBooks are registered trademarks of Intuit Inc. Used with permission.

Microsoft and Outlook are trademarks of the Microsoft group of companies. All other trademarks are the property of their respective owners.