Last Updated: 23 September 2026
This Privacy Policy explains how the Hidden Information Labs Institute (Institut de Laboratoires d'Information Cachée), a federally incorporated Canadian non-profit organization, collects and uses personal information on hiddeninformationlabs.io, including the Archive Portal, newsletter, and related Institute offerings. It should be read together with the Terms and Conditions.
The Institute operates under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable to individuals in the European Economic Area (EEA), the EU General Data Protection Regulation (GDPR).
This policy covers the Institute's own platforms. It does not govern personal products sold by Dr. Anna Maria Matziorinis in her sole-proprietorship capacity on other websites (for example Field Notes on annamariamatziorinis.ca), which have their own terms and privacy notice.
The Institute adheres to these data-handling principles: collect only what is necessary for service delivery (data minimization), retain data only as long as needed (storage limitation), be transparent about what is collected and why, and give individuals the ability to exercise rights over their data.
General use of the website does not require account creation, login, or the submission of personal information. The website is hosted on Cloudflare Pages. As part of standard service delivery, Cloudflare may process technical metadata such as IP addresses, request headers, and connection information at the network level. The Institute does not independently collect, access, store, or analyze this network-level data for advertising or profiling.
If you subscribe to the Institute's newsletter, your email address is collected and managed through Brevo (formerly Sendinblue), a third-party email service provider headquartered in France. Your email is used solely for delivering newsletter communications. This processing is based on your consent, which you may withdraw at any time by unsubscribing through any newsletter email. Your email data is also subject to Brevo's own privacy policy.
When you access the Archive Portal using an access code, the following processing occurs:
Session tokens. Upon successful login, the server generates a stateless session token that is cryptographically signed using HMAC-SHA256. The token contains your access tier, content permissions, and an expiry timestamp (24 hours from issuance). This token is stored only in your browser's sessionStorage (cleared when the tab is closed) and authenticates subsequent requests. The server does not store a copy of the session token. No email address, name, IP address, device fingerprint, or other directly identifying information is included in the token.
Access code records. Each access code has an associated record in a Cloudflare Workers KV store containing: the access code, tier and content permissions, active/revoked status, usage limits, a usage counter, creation date, and last-used timestamp. Records are retained for the active lifetime of the code.
Indirect personal data. Because access codes are issued to specific individuals (typically through purchase or direct communication), access code records may constitute indirect personal data when combined with external records such as purchase history or email. The legal basis for this processing is legitimate interest in delivering and securing the service.
Interactive tools. Certain tools available through the Archive Portal, including the Auditor, the Regulator, Sentinel NET, and the Basin Profiler, run entirely in your browser. Inputs you enter are processed locally on your device. Where a tool offers to save your work, that information is stored only in your browser's local storage. It is not transmitted to, collected by, or stored on Institute servers. Clearing browser storage permanently removes saved tool data.
Payment information is processed through third-party providers (for example Stripe or Stan Store) and is not stored or handled by the Institute directly. Those providers act as independent controllers for payment data under their own privacy policies and applicable rules (including PCI DSS for card data).
The Institute uses these providers in delivering its platforms:
Data in Cloudflare Workers KV may be processed on internationally distributed infrastructure. Where personal data is transferred to jurisdictions without equivalent protection, the Institute relies on the processor's Standard Contractual Clauses, adequacy decisions, or other safeguards required under GDPR Chapter V and PIPEDA's cross-border transfer rules.
Depending on your jurisdiction, you may have rights to:
To exercise rights, contact info@hiddeninformationlabs.io. The Institute aims to respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada (PIPEDA) or your local data protection authority (GDPR).
This Privacy Policy may be updated by posting a revised version on this page with a new date. Continued use of the website or Archive Portal after an update means you should review the new policy.
Hidden Information Labs Institute
1055 W. Georgia Street, Suite 2480, Vancouver, BC, V6E 3P3, Canada
info@hiddeninformationlabs.io
Related: Terms and Conditions
