Privacy Policy

Version: privacy-2026-10-07 · Last updated: October 7, 2026

This Privacy Policy explains what personal information Hidden Information Labs Institute ("HILI," "the Institute," "we," "us") collects through hiddeninformationlabs.io and its related services, why we collect it, who we share it with, how long we keep it, and what your rights are. Those services include the Archive Portal, the Relational Architecture Course, paid downloads, webinars, 1:1 consulting requests, research tools, and HILI Lab Updates emails. Please read it together with our Terms and Conditions (version terms-2026-10-07).

1. Who we are

HILI is a not-for-profit corporation, federally incorporated and registered in British Columbia (Corporation No. 1688008-8, Business Number 705234029), and directed by Dr. Anna Maria Matziorinis.

• Address: 1055 West Georgia Street, Suite 2480, Vancouver, BC V6E 3P3, Canada
• Email: info@hiddeninformationlabs.io

HILI is responsible for the personal information it controls, including information our service providers handle for us.

What this policy does not cover. It covers HILI's own platforms only. It does not cover personal products that Dr. Matziorinis sells as a sole proprietor on other websites (for example Field Notes on annamariamatziorinis.ca), which have their own terms and privacy notice, or third-party websites we link to.

2. Our Privacy Officer

Our Privacy Officer is accountable for our compliance with this policy and with privacy law.

• Privacy Officer: Dr. Anna Maria Matziorinis, Director, Hidden Information Labs Institute
• Email: info@hiddeninformationlabs.io (subject line: "Privacy request")
• Mail: Attn: Privacy Officer, Hidden Information Labs Institute, 1055 West Georgia Street, Suite 2480, Vancouver, BC V6E 3P3, Canada

3. Privacy laws we follow

• British Columbia's Personal Information Protection Act (BC PIPA) for personal information we collect, use, and disclose in British Columbia.
• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) for personal information handled in the course of commercial activity, including when it crosses provincial or national borders.
• The EU and UK General Data Protection Regulation (GDPR), which may apply when we offer services to people in the European Economic Area or the UK (see Section 13).

4. Our principles

We collect only what we need to deliver a service, and keep it only as long as we need it. We tell you what we collect and why, protect it with reasonable safeguards, and make it straightforward for you to use your rights. We do not sell personal information, and we do not use it for advertising or profiling.

5. What we collect and why

5.1 Browsing the website

You can browse without an account and without giving us personal information. The site is hosted on Cloudflare, which processes technical data at the network level (such as IP address, request headers, browser type, and connection details) to deliver pages and protect the site. HILI does not separately collect, store, or analyze this data. When pages load, your browser also fetches fonts and code libraries from third-party servers (see Section 7), which receive your IP address and standard request data.

5.2 Archive Portal and Course access

• Access-code records. Each access code has a record in Cloudflare Workers KV: the code, its access tier and content permissions, its status (active, expired, or revoked), usage limits and a usage counter, its creation, expiry, and last-used dates, and the consent entries described in 5.3. A code record does not contain your name, email address, or IP address.
• Indirect identification. Codes are issued to specific people, by purchase or direct arrangement, so a code record could identify you indirectly if combined with other records (such as a Stripe receipt). We treat code records as personal information for that reason.
• Session token. When you log in, our server creates a signed session token (HMAC-SHA256) containing your access tier, content permissions, a reference to your code, and an expiry time (up to 24 hours). It is kept only in your browser's sessionStorage and cleared when you close the tab. We keep no copy on the server. It contains no name, email, IP address, or device fingerprint.
• Access cookies. When you open Course materials, member tools, or member resources, we set strictly necessary cookies (hili_course, hili_gate) holding a short-lived signed access grant so that the page or file loads. See Section 9.
• Private files. Course and member files are kept in private Cloudflare R2 storage and delivered only through signed, time-limited links.

5.3 Consent records (how we record your agreement to our terms)

We keep a minimal record that you agreed to our terms. Portal and purchase consent records contain no email address, name, or IP address. Tool consent records contain a one-way hash of your IP address, as explained below; they contain no email address or name.

• Portal login. You can log in only after accepting the current Terms and Conditions and the exploratory-use acknowledgment. Each login adds a consent entry to your access-code record with a timestamp, the version of the Terms you accepted, and what you accepted. We keep up to the 50 most recent entries for each code.
• Purchases. Before checkout you tick the terms box on our page and at Stripe Checkout. After payment we store a record in Cloudflare KV with the Stripe checkout session ID, the product purchased, the Terms and Privacy Policy versions the checkout was stamped with, the consent ticks you gave (for example, terms accepted, immediate access, and automatic renewal for the Archive), and timestamps. No email address, name, or IP address is stored in KV. Stripe keeps its own record of the transaction (5.4).
• Interactive tools. Some tools (Sentinel NET, the Auditor, The Interval, and the Basin Profiler) show disclosures you must accept before use. Your browser remembers the acceptance in local storage, and we log a record to a Cloudflare database (D1) containing the tool name, the disclosure version, a random one-time ID created in your browser, a timestamp, and a one-way hash of your IP address (a scrambled form that is not stored as the address itself). This record is kept only as evidence that the disclosures were accepted; it is not used for marketing or to build a profile of you.

5.4 Payments

Purchases are processed by Stripe. Stripe collects your payment details, billing information, and email address, shows the terms checkbox, and sends your receipt. HILI never sees or stores your full card number. We can see transaction details in our Stripe account (such as your name, email, amount, date, and product) and use them for delivery, order support, refunds, accounting, and tax. Our code reads your email address from the Stripe event only in memory, to send your purchase email (5.5); it does not save it. Past purchases through Stan Store. Some past HILI purchases may have been processed through Stan Store, which collected and processed the buyer's details and payment under its own terms and privacy policy. HILI is moving all sales to Stripe: new purchases go through Stripe, and Stan Store will no longer be used once the move is complete. We keep the records of past Stan Store purchases that we need for order support, refunds, accounting, and tax (see Section 10).

5.5 Purchase (transactional) emails

After a purchase we send the emails needed to deliver it through Brevo, such as your access code, a download link, a webinar join link, a replay code, Archive renewal reminders, and schedule changes. These are part of delivering what you bought, are sent whatever your marketing preferences are, and are not marketing. Your buyer record is never used for marketing.

5.6 HILI Lab Updates (marketing email)

• Marketing emails come only from a separate list called "HILI Lab Updates," run on Brevo. You join only by express, confirmed (double) opt-in: you sign up on our subscribe page, then click the confirmation link we email you.
• Buying something never adds you to a marketing list, and we do not rely on implied consent from a purchase.
• You can unsubscribe at any time with the link in every message or by writing to us. We act on unsubscribe requests promptly, and within 10 business days at most. Unsubscribing never affects your purchases or purchase emails.

5.7 1:1 consulting requests

If you ask for a 1:1 session, the form asks for your name, email, phone (optional), whether you are buying as an individual or a business, the business legal name and your role (optional), your country, province or state, and city, where the business is registered, a GST/HST number (if applicable), organization size, a short description, your preferred session length and times, and the acknowledgments on the form.

• Purpose: to answer your request, schedule the session, issue an accurate invoice, and apply the correct sales tax.
• How it is handled: the form is sent to us by email through Brevo. The website does not save it in a database or file, and the server does not log it.
• Sessions are consulting, not clinical care, not diagnostic, and not therapy. Please do not include health information or sensitive information about other people. If you include it anyway, we use it only to respond to your request.
• If we agree an engagement, we keep your name and email, the hours purchased, and minimal scheduling and session notes.

5.8 Live webinars (Whereby) and recordings

• Webinars run on Whereby, and you join through a link we email you. Whereby processes the data it needs to run the session, such as your display name, audio and video if you turn them on, chat, and technical connection data, partly as an independent controller under its own privacy policy. Live audio and video may be routed through servers outside Canada.
• Sessions may be recorded, and we say when recording starts and stops.
• A webinar recording is used only to give that webinar's buyers a 30-day replay, and is then deleted. It is never added to the HILI Archive and never published anywhere else.
• Participants' faces and voices are never published. The replay shows only the facilitator and the slides; participants' faces, voices, names, and chat messages are removed. Archive lectures are separate solo recordings of Dr. Matziorinis with slides.
• No participant's face, voice, or likeness is ever used to train artificial intelligence, by us or by any service provider acting for us.

5.9 Video streaming (Mux)

Course, Archive, and replay videos are hosted and streamed by Mux. To deliver video and measure playback quality, Mux processes technical data such as IP address, device and browser type, and playback events (start, buffering, errors). HILI does not use this for marketing or profiling.

5.10 AI voice narration (ElevenLabs)

Some Course audio uses synthetic narration produced with ElevenLabs text-to-speech. We send ElevenLabs only script text we wrote. No participant or customer data is sent to ElevenLabs.

5.11 Tools that run in your browser

Our tools (including the Auditor, Sentinel NET, the Basin Profiler, The Interval, and Concord) run in your browser. What you enter is processed on your device and, if a tool saves your work, saved only in your browser's storage. It is not sent to or stored on our servers (the disclosure-acceptance record in 5.3 is the only exception). Clearing your browser storage deletes it permanently.

5.12 Paid downloads

A paid download (for example, the Personal Network Audit) is delivered through a signed link that expires after 7 days. The link contains no personal information, and we do not track who opens it.

5.13 When you email us

If you write to us, we use your message and contact details to reply and keep a record of our correspondence.

6. Legal bases and consent

Canada (BC PIPA and PIPEDA). We rely on your consent, which is express (for example, ticking the terms box, confirming a Lab Updates sign-up, or sending a consulting request) or implied (for example, using information you gave us to deliver a service you asked for). We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate. You can withdraw consent at any time, subject to legal or contractual limits, and we will explain how that affects a service (for example, without a payment record we cannot process a refund).

EEA and UK (GDPR).

7. Service providers and who receives data

We share personal information only with providers that help us run our services, only for those purposes, and under contracts or terms that require them to protect it.

The embedded Brevo newsletter form on our homepage is run by Brevo, which may use its own spam protection in that form. We may also disclose personal information where the law requires it (for example, a valid court order), to protect the rights, safety, or security of HILI or others, or to our professional advisers (lawyers and accountants) under a duty of confidentiality. If HILI ever reorganizes or merges, personal information may be transferred as the law allows and would remain protected by this policy.

We do not sell or rent personal information.

8. Transfers outside Canada

Several of our providers are in the United States or elsewhere outside Canada (Section 7). Your information may therefore be stored or processed outside Canada and may be accessible to foreign courts, law enforcement, and national-security authorities under those countries' laws. We use contracts and other measures so that providers protect it to a standard comparable to Canadian law. For people in the EEA or UK, where data goes to a country without an adequacy decision, we rely on the safeguards our providers offer, such as the EU Standard Contractual Clauses (and UK Addendum) or the EU-U.S. Data Privacy Framework where a provider is certified. Questions about our providers outside Canada can go to our Privacy Officer.

9. Cookies and similar technologies

We use only what the site needs to work and stay secure.

Analytics. HILI does not use website analytics or advertising tracking (no Google Analytics, Tag Manager, Meta or LinkedIn pixels, or similar). The only measurement involved is Mux's video playback-quality monitoring (5.9). You can block or delete cookies in your browser; if you block strictly necessary cookies, the portal, Course, or security checks may stop working.

10. How long we keep information

We keep personal information only as long as we need it for the purposes above or as the law requires, then delete or anonymize it.

11. Email marketing and CASL

We follow Canada's Anti-Spam Legislation (CASL). We send marketing ("commercial electronic messages") only to people who have given express consent, confirmed by double opt-in. We do not rely on implied consent from a purchase or an enquiry. Every marketing email names HILI, gives our mailing address and contact details, and has a working unsubscribe link, and we keep records of when and how consent was given. Purchase emails, such as receipts, access codes, download links, webinar links, and renewal reminders, are not marketing and are sent without marketing consent.

12. Your rights and how to make a request

You may ask to access the personal information we hold about you and learn how it has been used and to whom it has been disclosed; correct inaccurate or incomplete information; withdraw consent (for example, by unsubscribing); and delete your information where we are not required to keep it. In the EEA and UK you may also object to processing based on legitimate interests, restrict processing, and receive a portable copy of data you gave us.

How to ask. Email info@hiddeninformationlabs.io with the subject "Privacy request," or write to the Privacy Officer (Section 2). Because we hold very little identifying information (code records contain no name or email), we may ask for details to verify your identity and find your records, such as the email you used at checkout, your access code, or a receipt, and we use them only for your request. Deleting your information before a replay or access period ends may end that access.

Response time. We respond within 30 days of receiving a complete request (for EEA and UK requests, within one month). If we need more time, as the law allows, we will tell you why and when to expect an answer. Requests are free. If we refuse a request, we will explain why and how to complain.

13. Visitors from the EU, EEA, and UK

For GDPR purposes, HILI is the controller of the personal information described in this policy. Our legal bases are in Section 6 and our transfer safeguards in Section 8. You may complain to the data protection authority where you live or work.

14. Security

We use reasonable physical, organizational, and technical safeguards suited to the sensitivity of the information, including encrypted connections (HTTPS and HSTS), signed and time-limited tokens and links, private file storage, restricted administrator access, and keeping identifying information out of our own databases wherever we can. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected people and the regulators as the law requires.

15. Children

Our services are not directed to people under 18, and we do not knowingly collect their personal information. If you believe such a person has given us personal information, please contact us and we will delete it.

16. Complaints

If you have a concern, please contact our Privacy Officer first; we will investigate and respond. If you are not satisfied, you can complain to the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca), the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in the EEA or UK, your local data protection authority.

17. Changes to this policy

We may update this policy. We will post the new version here with a new version name and date. If a change is significant, we will give notice on the website or by email before it takes effect, and will ask for new consent where the law requires. Previous versions are listed on our Terms archive page, or available by emailing info@hiddeninformationlabs.io.

18. Contact

Hidden Information Labs Institute, Attn: Privacy Officer
1055 West Georgia Street, Suite 2480, Vancouver, BC V6E 3P3, Canada
info@hiddeninformationlabs.io