Hadalos

Privacy Policy

Alpha Version | Closed Testing Program
Compliant with Law 25 (Québec) and PIPEDA (Canada)
Effective Date: 2026-04-29

Preamble

Alpha Context: The Hadalos alpha testing program is a closed internal testing environment. This policy describes the personal information handling practices applicable exclusively within this framework.

This Privacy Policy (the "Policy") describes how the Founder of Hadalos (the "Data Controller") collects, uses, retains, and protects the personal information of alpha program participants (the "Users").

This Policy is written in compliance with An Act to modernize legislative provisions as regards the protection of personal information (hereinafter "Law 25", CQLR, c. P-39.1) and the Personal Information Protection and Electronic Documents Act (hereinafter "PIPEDA", S.C. 2000, c. 5).


Article 1 — Identity of the Data Controller

  • Privacy Officer (RPRP): The Founder of Hadalos
  • Province: Québec, Canada
  • Privacy Officer Email: privacy@hadalos.com

Pursuant to Law 25, the Data Controller assumes the function of Privacy Officer (RPRP) and is the designated contact for all requests relating to the rights of data subjects.


Article 2 — Personal Information Collected

2.1 Minimization Principle

Hadalos applies the data minimization principle: only information strictly necessary for the operation of the application is collected. No data is collected for advertising or monetization purposes, structurally and not merely contractually.

2.2 Directly Collected Data

CategoryData CollectedPurpose
IdentityFirst name, last nameIdentification in groups and invitations
ContactEmail addressAuthentication, notifications, invitations
SecurityPassword (Argon2id hashed)Secure authentication
SessionSHA-256 hash of a session tokenAuthenticated session maintenance (JWT is not stored)
Social ID (optional)socialId — OAuth identifier (Google / Facebook / Apple)Third-party provider authentication (if used)
Financial dataAccounts, transactions, accounting entriesCore financial management service
GroupsGroup membership, RBAC roleAccess rights management
FeedbackComments and reports (if submitted)Product improvement

2.3 Automatically Collected Data

  • Audit logs (audit trail): actions performed, timestamp, session identifier required for ledger integrity
  • IP address and User-Agent: collected by the application itself on each authentication (via extractSessionMetadata) and stored in the sessions collection for multi-device management and suspicious activity detection.
  • Application logs: technical errors and security events

2.4 Data NOT Collected

Hadalos does not collect and does not have access to the following data:

  • Credit or debit card numbers
  • Social insurance numbers (SIN)
  • Government-issued identity documents
  • Biometric data
  • GPS location data
  • Information from social networks

Article 3 — Purposes and Legal Bases for Processing

PurposeLegal Basis (Law 25)Details
Account authentication and securityConsent / Service executionSession management, JWT, email verification
Provision of accounting serviceService executionAccount management, transactions, ledger
Transactional communicationsService executionInvitations, ownership transfer, password reset
Immutable audit logLegitimate interest (security)Integrity and traceability of operations
Product improvementConsentOnly via voluntary feedback

No data processing for marketing, profiling, or advertising purposes is performed in the alpha phase or in subsequent phases.


Article 4 — Consent

4.1 Explicit Consent

The User expressly consents to the processing of their personal information by checking the acceptance box during registration. The exact timestamp of this acceptance is recorded at the time of the click (field policyAcceptedAt), constituting electronic proof of consent. This consent is specific (defined purposes), informed (clear information provided), and freely given (no commercial pressure).

4.2 Withdrawal of Consent

The User may withdraw their consent at any time by sending a written request to the Privacy Officer at: privacy@hadalos.com. Withdrawal of consent results in the cessation of the service and the deletion of data as described in Article 7.


Article 5 — Infrastructure and Data Location

5.1 Data Location

The database is hosted in Canada (Azure Canada Central, Toronto). The application backend is hosted in the United States (Google Cloud Run, us-east1 region — South Carolina). This cross-border transfer is disclosed in accordance with Law 25 and PIPEDA requirements. The providers concerned are subject to contractual data protection commitments in accordance with these requirements.

ComponentProviderRegion / Location
Application (backend)Google Cloud Runus-east1 (South Carolina, USA)
DatabaseMongoDB AtlasAzure Canada Central (Toronto)
Transactional emailsSMTP via NestJSProvider to be specified per deployment config.
Landing pageCloudflare PagesGlobal CDN — static content only

5.2 Third-Party Providers

Hadalos uses the infrastructure providers listed above. These third parties act as technical processors and do not have access to the User's financial data. They are selected based on their compliance with security standards (ISO 27001, SOC 2) and their contractual commitment to data protection. Hadalos does not sell, rent, or share Users' personal information with third parties for commercial or advertising purposes.


Article 6 — Security Measures

6.1 Implemented Technical Measures

  • Encryption in transit: TLS 1.3 on all communications
  • Encryption at rest: AES-256 via MongoDB Atlas
  • Password hashing: Argon2id with high hardening parameters
  • JWT token authentication (access token + refresh token) with session rotation
  • Immutable audit log: SHA-256 cryptographic chaining per account (accountId)
  • Granular access control (RBAC): Owner / Administrator / Editor / Observer
  • Mandatory email verification at registration
  • Protection against (NoSQL) injections: strict input validation via NestJS Pipes

6.2 Information Leak Prevention

Hadalos applies security-by-design principles: API responses do not reveal the existence or non-existence of an account or group to an unauthorized third party.

6.3 Security Limitations — Alpha Phase

During the alpha phase, certain security measures intended for the production environment (penetration testing, external audit, SOC 2, continuous monitoring) are not yet in place. The User is informed of this and assumes this risk by participating in the program.


Article 7 — User Rights

7.1 Rights Guaranteed by Law 25 and PIPEDA

RightResponse TimeProcedures
Access to data30 calendar daysWritten request by email to the Privacy Officer
Rectification30 calendar daysDirectly in the profile or by request
Deletion (right to erasure)30 calendar daysWritten request for complete data deletion
PortabilityReasonable timeExport in structured format (CSV/JSON)
Objection / Withdrawal of consentImmediateSuspension of access and deletion
Notification of incidents72 hours (Law 25)Email notification in case of serious incident

7.2 Exercise of Rights

To exercise one of these rights, send a written request to the Privacy Officer at privacy@hadalos.com with the subject: "Request | Privacy Rights | Hadalos". The Data Controller will acknowledge receipt within five (5) business days and provide a complete response within thirty (30) calendar days.

7.3 Right of Recourse

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) or the Privacy Commissioner of Canada (OPC).


Article 8 — Data Retention and Deletion

8.1 Retention Periods

Data TypeRetention PeriodJustification
Transactions and financial data7 yearsTax and accounting obligation (ITA, s. 230)
Groups, accounts, members3 years after closureGeneral civil prescription (CCQ, art. 2925)
Audit logs (audit trail)2 yearsFraud detection and forensics
Aggregated session statistics90 daysPerformance analysis — non-personal data
Data after account deletionMaximum 30 daysComplete deletion guaranteed
Security incident registerDuration required by Law 25Regulatory obligation (art. 90.3)

8.2 Deletion Procedure

Upon closure of the alpha program or upon a deletion request, the User's personal data is securely erased from all systems, including active backups, within a maximum period of thirty (30) days. Security incident logs may be retained to the extent required by law, in anonymized form.


Article 9 — Privacy Incident Management

9.1 Notification Procedure

In the event of a privacy incident presenting a serious risk of harm, the Data Controller shall:

  • Notify the Commission d'accès à l'information du Québec (CAI) within 72 hours of becoming aware, in accordance with article 90.1 of the Access Act
  • Notify affected Users as soon as possible by email
  • Maintain a privacy incident register in accordance with applicable regulations

9.2 Incident Register

An incident register is maintained in accordance with article 90.3 of the Access Act (Law 25). It contains the description of the incident, the information affected, the causes, the corrective measures, and the persons concerned.


Article 10 — Connection Cookies

Hadalos does not use cookies for authentication. Access tokens (JWT) are transmitted exclusively via the HTTP Authorization: Bearer header and stored client-side only. Only the SHA-256 hash of the session token is stored in the database for multi-device management purposes.

Hadalos does not integrate any advertising network, behavioral analytics tool, or third-party tracking technology.


Article 11 — Minors

Hadalos is not intended for minors (under 18 years of age). The Developer does not knowingly collect personal information from minors. If a minor were to participate in the alpha program, their data will be deleted as soon as this situation comes to the attention of the Data Controller.


Article 12 — Policy Changes

The Developer reserves the right to modify this Policy at any time. Any material change will be notified by email to Users with five (5) business days' notice. The current version is always accessible at: hadalos.com/privacy-policy.


Article 13 — Governing Law

This Policy is governed by the laws of the province of Québec and the federal laws of Canada, including:

  • An Act to modernize legislative provisions as regards the protection of personal information (Law 25, CQLR, c. P-39.1)
  • Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5)
  • Act respecting Access to documents held by public bodies and the Protection of personal information (CQLR, c. A-2.1)

In the event of any divergence between the French and English versions (if applicable), the French version shall prevail.


Article 14 — Privacy Officer Contact Details

For any question, request, or complaint regarding the protection of personal information:

  • Email: privacy@hadalos.com
  • Province: Québec, Canada

Competent regulatory authorities:

  • Commission d'accès à l'information (CAI): www.cai.gouv.qc.ca / 1 888 528-7741
  • Privacy Commissioner of Canada: www.priv.gc.ca / 1 800 282-1376

© 2026 Hadalos. All rights reserved.
Confidential document | Closed internal Alpha Program | Law 25 / PIPEDA