Legal

Privacy Policy

Effective July 29, 2026

This Privacy Policy explains how Koastar LLC, doing business as Paul Mitchell Schools North Star Group ("North Star Group", "we", "us") collects, uses, and protects information in connection with our software applications (the "Apps") and our communications with prospective and enrolled students, including by email, phone, and text message. The Apps are internal business tools used by authorized staff and enrolled students.

Our Apps are internal business tools, not consumer products — access to them is limited to authorized North Star Group personnel and enrolled students. Separately, we communicate with prospective and enrolled students by email, phone, and (with consent) text message, as described in this policy.

1. Information we collect

Account & identity

When staff sign in with their North Star Group Google Workspace account (single sign-on), we receive the user's name, email address, and profile photo, and we maintain role and permission assignments.
Authentication and session data needed to keep users signed in across the Apps.

Prospective & enrolled student information

Contact details you provide when you inquire, apply, attend an event, or enroll — such as name, email address, mobile phone number, and the information needed to process an application or manage enrollment.
Education records for enrolled students (see FERPA, below).

Business data processed in the Apps

Prospect, lead, and applicant records; student information; and financial and accounting records — entered by staff or synced from connected systems of record.
Email and messaging content. With authorization, the Apps read mail from North Star Group Google Workspace mailboxes and let staff collaborate on it (assign, tag, note, reply), and record the phone calls and text messages exchanged with students where permitted by law.
Usage and log data (pages viewed, actions taken, timestamps, IP address, device/browser) for security and troubleshooting.

2. How we use information

To provide, operate, secure, and improve the Apps.
To authenticate users and enforce role-based access.
To manage admissions, enrollment, student records, communications, and accounting workflows.
To contact prospective and enrolled students by email, phone, and (with consent) text message.
To detect, investigate, and prevent security incidents and misuse.

3. Text messaging (SMS)

With your consent, we send text messages through two programs:

Admissions outreach — to prospective students who have expressed interest (for example, by submitting an inquiry or application, or attending an event), to help them through the admissions process.
Education communications — to enrolled students, for scheduling, attendance, financial-aid, and other school-related messages.

Message frequency varies. Message and data rates may apply. You can reply STOP at any time to opt out of a program, and HELP for help. Consenting to receive text messages is not a condition of enrollment or of any purchase.

We do not sell your personal information, and we do not share your mobile opt-in information or consent with third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in data and consent are shared only with the service providers (such as our telecommunications provider) that help us deliver these messaging programs on our behalf, and only for that purpose.

4. Google user data & Limited Use

The Apps use Google Workspace APIs to read and send email and to read directory information on behalf of authorized North Star Group accounts. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we use Google user data only to provide and improve the features described here; we do not sell it, do not use it for advertising, and do not allow humans to read it except with your consent, for security or to comply with law, or where the data is aggregated/anonymized.

5. How we share information

Within North Star Group: with authorized personnel who need it for their role.
Service providers: infrastructure and software vendors that host or support the Apps and our communications (e.g. Google Cloud/Workspace, our telecommunications provider, and our accounting and payment integrations), bound to handle data only on our instructions.
Legal: where required by law or to protect rights, safety, and security.
We do not sell personal information, and we do not share mobile opt-in or consent data with third parties for their own marketing.

6. Data retention

We retain information for as long as needed to operate the Apps and to meet our legal, accreditation, financial-aid, and recordkeeping obligations, after which it is deleted or de-identified.

7. Security

We protect information with measures including encrypted secrets, encryption in transit, single sign-on, and role-based access controls. No method of transmission or storage is perfectly secure, but we work to protect data commensurate with its sensitivity.

8. Student records (FERPA)

Education records processed in the Apps are handled in accordance with the Family Educational Rights and Privacy Act (FERPA) and North Star Group's student privacy policies. Students and parents with rights under FERPA may exercise them through the school's registrar / financial-aid office.

9. Your choices

Staff and students may request access to, or correction of, their information by contacting us, and may opt out of text messages at any time by replying STOP. Because the Apps are internal tools tied to your role and enrollment, some data cannot be deleted while a business or educational record must be retained.

10. Changes to this policy

We may update this policy; material changes will be reflected by the effective date above and, where appropriate, communicated to users.

11. Contact

Questions about this policy or our data practices: it@northstar.paulmitchell.edu.