Data privacy and information sovereignty.

About this policy

This privacy policy explains what personal information Northken (“Northken”, “we”, “us”) collects when you use its sites, products and identity service, including when you sign in or create an account with Google, why we use it, who it may be shared with, where it may be processed and how to exercise your rights, wherever you are. Northken is an operating platform based in Quebec, Canada. We apply Quebec’s Law 25 (Act respecting the protection of personal information in the private sector), Canada’s federal PIPEDA and, where it applies to you, the European Union’s General Data Protection Regulation (GDPR), its UK equivalent and US state laws such as California’s CCPA/CPRA. Effective version: October 5, 2026. The French and English versions have the same meaning; if they differ, the French version prevails.

Who is responsible for your information

Northken is responsible for the personal information handled by its identity service, which authenticates users of the products it operates and gives them access to their MY space. We have designated a person in charge of the protection of personal information, whom you can reach at any time at [email protected] for any question, request or complaint.

Information we collect

You provide: your email address, your name, your preferred language and, if you choose a password, a cryptographic hash of it (never the password itself). We receive automatically: the date and time of your sign-ins, your IP address, your browser and device type, and security events (successful or refused sign-in, password reset), kept to protect your account and detect abuse. If you write to us, we keep your message and our replies. We do not knowingly collect sensitive information (health, origin, beliefs, biometric data) and ask you not to send us any.

Signing in with Google: what we receive

If you choose “Continue with Google”, we request only the basic permissions (openid, email and profile). Google sends us your Google account’s unique identifier, your email address and whether it is verified, your name and your language. We do not store your profile photo, we do not keep any Google access token and we do not access any other data in your Google account (email, contacts, calendar, files, history). You stay in control: you can remove Northken’s access at any time (see “Your rights”).

Signing in with Google: how we use it

This information is used only to authenticate you, to create your account or link it to an existing account with the same verified email address, and to mark that address as verified. It is not used for advertising, profiling or sale, and it is not used to develop, improve or train artificial intelligence or machine learning models.

Compliance with the Google API Services User Data Policy

Northken’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not allow humans to read this data unless we have your consent, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data is aggregated and anonymized.

Why we use your information and on what basis

We use your information to: create and manage your account and authenticate you (performance of a contract or steps you request); secure our services and prevent fraud and abuse (legitimate interests and security obligations); send you service messages such as verification codes and security notices (performance of a contract); respond to your requests (legitimate interests or consent); and meet our legal obligations. Where we rely on your consent, you may withdraw it at any time without affecting what happened before. We make no fully automated decisions that produce legal effects on you.

Cookies and similar technologies

For sign-in, we use a strictly necessary, protected (HttpOnly, Secure) session cookie that keeps you signed in and that we delete when you sign out; it is not used for tracking or advertising. Strictly necessary cookies do not require consent. If we ever add audience-measurement or advertising cookies, we will first ask for your consent where the law requires it and update this policy. You can set your browser to block cookies, but sign-in may then stop working.

Sharing and disclosure

We do not sell your personal information and we do not “share” it for targeted advertising within the meaning of the CCPA/CPRA. We disclose it only to service providers acting on our behalf and on our instructions (hosting and network delivery, transactional email) who must protect it; where the law, a court order or a competent authority requires it; to protect the security of our services, users or the public; or in connection with a business reorganization, subject to the same protections.

International transfers

Northken is based in Quebec, Canada. Your information may be processed in Canada and in other countries where our providers operate their infrastructure, including the United States, whose laws may offer a level of protection different from your country’s. Before disclosing information outside Quebec, we assess privacy factors as Law 25 requires; for transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, including standard contractual clauses where necessary.

Retention and deletion

We keep your information while your account is active, then for as long as needed for the purposes described here, to meet legal requirements, resolve disputes or enforce our terms. You can ask us to delete your account at any time by writing to [email protected]: your email address, name and password hash are then anonymized, your Google link is anonymized (it can no longer be tied to you) and your sessions are revoked. Some security logs may be kept longer when the law or security requires it.

Security and confidentiality incidents

We protect your information with reasonable measures: communications encrypted in transit (HTTPS), passwords stored only as cryptographic hashes, protected session cookies, access to systems limited to authorized people, and logging. No system is infallible. In the event of a confidentiality incident presenting a risk of serious harm, we will promptly notify the people concerned and, as applicable, Quebec’s Commission d’accès à l’information, the Office of the Privacy Commissioner of Canada or the competent data protection authority.

Children

Our services are not directed to children. We do not knowingly collect personal information from anyone under 14 without the consent of the holder of parental authority, or from anyone below the age of digital consent in their country. If you believe a child has given us information, write to [email protected] and we will delete it.

Your rights in Quebec and Canada

Under Law 25 and PIPEDA, you may: learn what information we hold about you and obtain a copy; have it corrected; withdraw your consent; request deletion or the cessation of dissemination of your information where the law allows; obtain your information in a structured, commonly used technological format (portability); and be informed of decisions based exclusively on automated processing. We respond within 30 days. You may file a complaint with Quebec’s Commission d’accès à l’information or the Office of the Privacy Commissioner of Canada.

Your rights in the European Union, the United Kingdom and Switzerland

If the GDPR or its UK equivalent applies to you, you have the right of access, rectification, erasure, restriction of processing, objection (including to processing based on legitimate interests), portability and to withdraw your consent, as well as the right to lodge a complaint with the data protection authority of your place of residence or work. To exercise them, write to [email protected]; we respond within one month.

Your rights in California and other regions

If you live in California, the CCPA/CPRA gives you the right to know what information we collect and why, to obtain a copy, to ask for its correction or deletion, and not to be discriminated against for exercising these rights. We do not sell or share your information for targeted advertising, so there is nothing to opt out of. An authorized agent may act for you. Depending on your country (for example Brazil’s LGPD, Australia or other US states), you may have similar rights, which we honor to the extent local law applies.

How to exercise your rights and remove Google access

Write to [email protected] stating your account’s email address; we may ask you to confirm your identity before responding, to protect your information. To remove Northken’s access to your Google account, go to https://myaccount.google.com/permissions: you can then sign in with your email address (if needed, by setting a password through “forgot password”). Removing Google access does not delete your Northken account: for that, request deletion as described above.

Changes to this policy and contact

We may update this policy; the effective-version date will change and, if the changes are significant, we will let you know before they take effect. Questions and requests: [email protected]. Our terms of use are available at https://northken.com/legal.