Privacy Policy

1. Identity of the data controller

For the purposes of this Privacy Policy, the data controller is Boreal, an early-stage software project building an AI analyst partner for Excel-driven finance and supply chain teams.

You can contact us about privacy questions or to exercise your rights at info@haruk.co.

Our team currently operates remotely across Latin America and the United States. If you require our registered office address for a formal request under local law, we will provide it upon request via email.

2. Data we collect

When you use our landing page and submit the early access form, we may collect the following information:

2.1 Information you provide directly

This includes the information you enter in our forms, such as identification and contact details, professional information about your role and company, and any context you choose to share about your analytics challenges (for example, in a free-text field).

2.2 Information collected automatically when you submit the form

Our forms infrastructure (forms.haruk.co) automatically captures certain technical data when you submit the form. This may include:

• IP address and approximate region inferred from it
• Browser user agent and device information
• Referrer URL and page path where the form was displayed
• Security token information used to protect the form against abuse
• Timestamps and internal identifiers needed for debugging and auditing

2.3 Usage and analytics data

On our marketing site we may use privacy-friendly analytics tools to understand aggregate usage patterns (for example, which pages are visited, rough geographic distribution, and referrers). These tools are configured to avoid unnecessary tracking cookies and do not create cross-site advertising profiles.

3. Purposes of processing

We process your personal data for the following purposes:

3.1 Primary purposes (necessary)

• To review and manage your early access request.
• To contact you about your interest in Boreal and coordinate demos or discovery calls.
• To understand demand and validate our business idea and product direction.

3.2 Secondary purposes (optional)

• To send you occasional product updates, newsletters, or marketing communications.
• To invite you to surveys, beta programs, or user interviews.

You may opt out of secondary purposes at any time by using the unsubscribe mechanism in our emails or by writing to info@haruk.co.

3.3 Who we share your data with

We do not sell or rent your personal data. We share it only with:

• Members of our team and trusted contractors who need the information to operate Boreal and respond to your requests.
• Service providers that host our infrastructure, send emails, provide analytics, or help us manage relationships with interested users, under appropriate confidentiality and data protection terms.
• Public authorities, regulators, or courts when we are legally required to do so.

4. Legal basis and consent

For users located in Mexico, Colombia, Ecuador, Panama, Guatemala, and Florida (USA), we primarily rely on your express, opt-in consent to process the personal data you submit through our form.

• You provide this consent by actively checking the consent box next to the form and submitting your information. We do not use pre-ticked boxes.
• You may withdraw your consent at any time by contacting us at info@haruk.co.

In addition, we may rely on our legitimate interests for limited processing necessary to secure our services (for example, storing IP addresses and user agents in logs to detect abuse, spam, or security incidents), provided such processing is compatible with the protections required by applicable law.

5. International data transfers

Our infrastructure and some of our service providers are located outside of the countries where our users are based. In particular, form submissions may be stored on servers located in the United States or other countries.

By submitting your information and accepting this Privacy Policy, you understand and explicitly consent to this international transfer of your personal data for the purposes described in this document.

We use reputable cloud and infrastructure providers and implement reasonable contractual, technical, and organizational safeguards designed to protect your data in line with applicable data protection laws.

6. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes described above or to comply with legal obligations.

• Contact and form data used to manage early access and product communications is generally kept for up to 2 years from your last meaningful interaction with us (for example, opening an email, replying, or booking a call), unless you request deletion earlier.
• Technical logs (such as IP address and user agent) may be kept for a shorter or slightly longer period where strictly necessary for security, anti-abuse, and auditing purposes.

When data is no longer needed, we will delete it or irreversibly anonymize it so it can no longer be linked to you.

7. Your rights (ARCO and similar rights)

Depending on your country, you may have some or all of the following rights under applicable data protection laws (including Mexico's LFPDPPP, Colombia's Law 1581, Ecuador's LOPDP, and similar regulations in Panama, Guatemala, and Florida):

• Access: to know whether we process your personal data and, if so, to obtain a copy of it.
• Rectification: to request correction of inaccurate or incomplete data.
• Cancellation / Deletion: to request deletion of your data when it is no longer necessary or when you withdraw consent, subject to certain legal exceptions.
• Opposition: to object to certain processing, such as direct marketing.
• Data portability: where applicable, to receive a copy of your data in a structured format or request that we transmit it to another provider, when technically feasible.

To exercise these rights, please send an email to info@haruk.co with the subject line Privacy Rights Request. In your message, please include:

• Your full name
• The email address you used on our site
• Your country of residence
• A clear description of the right(s) you wish to exercise

We will review your request and respond within the timeframes required by applicable law (typically within 15-20 business days), and we may ask you for additional information to verify your identity when needed.

8. Security measures

We implement reasonable technical and organizational measures designed to protect your personal data against unauthorized access, loss, misuse, or alteration. These measures include secure transmission of form data, restricted access to databases, and logging of access for auditing purposes.

No online service can guarantee absolute security, but we aim to apply industry-aligned safeguards appropriate to the sensitivity of the data we handle.

9. Children's privacy

Our site and early access program are intended for professionals and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. If you believe that a minor has provided us with personal data, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in our product, legal requirements, or infrastructure. When we make material changes, we will update the effective date at the top of this page and, where appropriate, provide additional notice (for example, via email or a banner on our site).

We encourage you to review this page periodically to stay informed about how we protect your data.