Privacy & Cookie Policy

01Overview

This policy explains what information Lanterna Technologies Inc. ("Lanterna Tech", "we") collects when you use Lanterna Tech and its website, why, and what your rights are. It is governed by Quebec's Law 25 (Act respecting the protection of personal information in the private sector) and, where applicable, the GDPR for visitors from the European Economic Area.

Effective September 15, 2026.

02Privacy Officer

In accordance with Law 25, the President of Lanterna Technologies Inc. acts as the person responsible for the protection of personal information. You can reach them at [email protected] for any question, access request or complaint.

03Information we collect

• Account: name, email address, organization, role, language, and — if you enable it — your two-factor authentication (2FA) secret.
• Content you enter: initiatives, assets, compliance assessments and other roadmap data. This data is yours; we act as custodian.
• Forms (demo, partner, lead): contact details you voluntarily provide so we can follow up.
• Technical and security data: IP address, request identifiers, audit and access logs — necessary for operation, security and fraud prevention.

We collect nothing through third-party analytics, advertising pixels or cross-site tracking — there are none on Lanterna Tech.

04Why we use it

• Provide and operate the service (authentication, saving your roadmap, features).
• Security: prevent unauthorized access, log sensitive actions, detect abuse.
• Service communications: transactional emails (scheduled reports, invitations) via our email provider.
• Billing, when you subscribe to a paid plan.
• Support and service improvement.

05Cookies and similar technologies

Lanterna Tech uses only strictly-necessary cookies and functional local storage. No tracking, advertising or third-party analytics cookies.

• Session / authentication cookies (httpOnly, secure): keep you signed in. Without them the service cannot work.
• Anti-CSRF token: protects your requests against forgery.
• Functional local storage (localStorage): display preferences (theme, language, layout, onboarding state). Stays on your device.

Because these cookies are strictly necessary, Law 25 and the GDPR do not require prior consent: we inform you with a notice, without an "accept / refuse" banner. If we ever add audience measurement, we will implement real consent.

06Sharing and sub-processors

We never sell your information. We share it only with the providers necessary to operate the service, bound by contract:

• OVHcloud — infrastructure hosting (Canada).
• Cloudflare — content delivery network and protection (proxy / web application firewall).
• SendGrid (Twilio) — transactional email delivery.
• AWS KMS / Azure Key Vault — encryption key management (for the managed tenants concerned).
• Stripe — payment processing when billing is enabled; Lanterna Tech never stores card numbers.
• Anthropic — assisted generation of remediation descriptions (United States). Optional feature, disabled by default; it is active only if your organization explicitly asks for it.

07Hosting and data location

Production data is hosted in Canada (OVHcloud, Beauharnois, Québec). Some sub-processors (e.g. Cloudflare, SendGrid, Anthropic) may process technical data outside Canada; where they do, we rely on appropriate contractual safeguards.

08Security

Sensitive content is encrypted at rest (AES-256-GCM, KMS envelope-managed keys) and in transit (TLS). We apply per-tenant isolation, two-factor authentication, IP allow-lists, a SHA-256-sealed audit trail and least-privilege access. No measure is, however, infallible.

09Retention

We keep your information for as long as necessary to provide the service and meet our legal obligations. When an account is closed, data is deleted or anonymized within a reasonable period, unless retention is legally required. Audit and access logs follow dedicated retention periods.

10Your rights

Subject to applicable law, you may:

• access your information and request its correction;
• withdraw your consent or request deletion of your information;
• request portability of your information (in a structured technological format);
• request that dissemination of information cease, or that it be de-indexed;
• file a complaint with Quebec's Commission d'accès à l'information (CAI), or with your data protection authority for EEA residents.

To exercise these rights, write to us at [email protected]. We respond within the timeframes set by law.

11Minors

Lanterna Tech is a professional tool and is not directed at individuals under 13; we do not knowingly collect their information.

12Changes

We may update this policy. For significant changes we will update the effective date and, where appropriate, notify you.

13Contact

Lanterna Technologies Inc., Otterburn Park, Quebec. For any privacy question: [email protected].