Privacy Policy

Last updated: 2026-08-14

Governing law: Japan

This Privacy Policy explains how Gftd Japan 株式会社 (Gftd Japan K.K.), GranTokyo South Tower 11F, 1-9-2 Marunouchi, Chiyoda-ku, Tokyo 100-6611, Japan (Corporate Number 1011101086505) (the "Operator", "we") handles personal information in connection with the kotobase.net Service (the "Service").

Our primary framework is the Japanese Act on the Protection of Personal Information (APPI, 個人情報保護法). Where applicable we also address the EU/EEA General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Data controller / business operator

• APPI personal information handling business operator (個人情報取扱事業者): Gftd Japan 株式会社 (Gftd Japan K.K.), GranTokyo South Tower 11F, 1-9-2 Marunouchi, Chiyoda-ku, Tokyo 100-6611, Japan (Corporate Number 1011101086505).
• GDPR controller (for data where we determine purposes and means): the same entity. No EU-UK GDPR Art. 27 representative is designated at this time.
• Data protection contact / DPO: No DPO is designated at this time; contact us at hello@gftd.co.jp.

For much of the Customer Data you ingest, you act as the controller/business and we act as your processor/service provider; in that case your own privacy notice governs your end users, and we handle that data under our agreement with you.

2. Data we collect

• Account and identity data. Tenant DID, CACAO issuer DID, pin owner DID, account status, and — where you authenticate via the Operator's authentication service at https://auth.kotobase.net — the identifiers associated with your bearer token. Email address is collected when you sign in with email OTP (and would be collected from an identity provider if Google/GitHub OAuth were enabled; both are disabled in production). A display name is not required by the apex Worker. Accounts may also be keyed by a hash of email in the same-origin session path (kotobase_session).
• Stored content (Customer Data). Graph data, facts, relationships, pin metadata (pin_id, name, cid, target, status, timestamps, size, content type, archived object keys, error strings), and optional archive payloads (IPLD CARs or raw bytes) that you ingest or pin. This content may contain personal data that you choose to include; you are responsible for its lawful provision.
• Usage and telemetry / operator diagnostics. Request identifiers (x-kotobase-request-id), Cloudflare cf-ray, edge/version identifiers, storage-mode signals, sanitized error summaries, and smoke/health output.
• Security markers. Hashed CACAO replay-nonce markers (issuer, nonce hash, issue time, expiry, seen time). We store a hash of the nonce, not the raw nonce value.
• Payment data (via Stripe). When you subscribe to a paid tier, payment is processed by Stripe. Stripe collects your payment method and billing details; we receive limited billing metadata (e.g. subscription status, tier, tenant DID reference) but not full card numbers.

We do not intentionally collect special-category / sensitive data, and you must not submit secrets or sensitive personal data into fields, logs, or public metadata contrary to docs/DATA-HANDLING.md.

3. Purposes and legal basis

We process personal information to:

• authenticate tenants and enforce namespace isolation and quotas;
• provide, operate, and secure the graph, pinning, and archival functions;
• process subscriptions and billing;
• maintain security, prevent abuse and replay, and diagnose incidents; and
• comply with legal obligations.

APPI: we identify and use personal information within the scope of the utilization purposes above (APPI Arts. 17–18) and do not use it beyond them without consent, except as permitted by law.

GDPR legal bases (for EU/EEA users, where applicable): performance of a contract (Art. 6(1)(b)); legitimate interests in operating and securing the Service (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)); and consent (Art. 6(1)(a)) where relied upon (e.g. certain cookies).

CCPA/CPRA: we process personal information for the business purposes above. The kotobase.net marketing and API surfaces do not load advertising pixels or cross-context behavioural advertising scripts. Unauthenticated GET / and GET /signup set no cookies. We do not disclose personal information for monetary consideration. [CONFIRM: counsel must still confirm this meets CCPA/CPRA "sale" / "share" definitions before that characterisation is treated as a customer-facing representation.]

4. Sharing and subprocessors

We share personal information only with service providers ("subprocessors") that process it on our behalf to deliver the Service, and as required by law. Current subprocessors:

The machine-readable source register is legal/subprocessors.json. Counsel must still verify the complete hosting chain, account entities, processing regions, contract acceptance and transfer safeguards before publication. Do not treat this table as an approved or exhaustive contractual list until that review is recorded.

Content stored as CIDs may also be retrievable by third parties through the public IPFS network, gateways, and caches; this is inherent to content addressing and is not limited to our subprocessors.

5. International transfer

The Operator is based in Japan and uses subprocessors that may process data outside your country, including the United States. The configured production register (legal/subprocessors.json, version 2026-08-03) records Cloudflare as distributed including the United States, Stripe as international including the United States, Resend as United States, and Backblaze as a configured-account region that must still be exported from the provider dashboard.

• APPI: where we provide personal data to third parties in foreign countries, we do so under the conditions of APPI Art. 28 (consent with prescribed information, equivalent-standard countries, or contractual/other equivalent safeguards). [CONFIRM safeguard basis per subprocessor, including the actual Gftd Japan account entity.]
• GDPR: transfers out of the EEA rely on an adequacy decision (Japan holds an EU adequacy decision) or on appropriate safeguards such as Standard Contractual Clauses. [CONFIRM SCCs / transfer mechanism per subprocessor.]

6. Retention

• Edge-request audit receipts expire after the configured AUDIT_RETENTION_DAYS; the deployed default is 365 days. Existing records keep the TTL assigned when written, so changing the setting is not legal hold.
• Credential-custody audit events expire after 400 days.
• Tenant identity/control-plane records remain until verified tenant decommission. That operation does not remove account identities, browser sessions, graph/pin/archive data, billing records or edge audit receipts.
• Pin metadata deleted via DELETE /pins/:id is marked as deleted; this does not guarantee cryptographic erasure of previously archived content-addressed bytes.
• CACAO replay-nonce markers are retained to prevent replay and are not routinely deleted.
• Content-addressed bytes may remain retrievable from IPFS peers, gateways, caches, or off-site archives after local metadata deletion.
• The authoritative operational baseline is legal/retention-schedule.json. Customer-specific pin/archive periods and the effective account, billing, transactional-email, diagnostics and tombstone periods remain unqualified until the applicable contract, provider settings and counsel-approved schedule record them.

7. Security

• Data is transmitted over TLS with HSTS; edge responses enforce nosniff and frame denial.
• Authentication uses cryptographically verified CACAO capabilities (did:key EdDSA verified at the edge in archive mode; other CACAO types verified in the backend) and/or issued bearer tokens.
• Tenant isolation is enforced by namespace binding and a Durable Object tenant lock; an internal secret makes kotobase.net the sole external write surface.
• Secrets, credentials, tokens, and private tenant data are excluded from public metadata (/_app/meta), logs, and error responses by design.
• Cloudflare Workers, KV and Durable Objects are encrypted at rest by Cloudflare as the platform default. Backblaze B2 encrypts objects at rest under the provider's default. This Operator does not currently run customer-managed KMS/HSM or cryptographic shredding; those remain roadmap items, not shipped defaults. Analytics facts persisted by the Worker are stored in plaintext.

8. Your rights

Subject to applicable law and to verification of your identity, you may request:

• Access / disclosure of the personal information we hold;
• Correction of inaccurate personal information;
• Deletion / erasure (subject to the content-addressing limits in Sections 6 and to legal retention obligations);
• Portability of data you provided in a structured, machine-readable form;
• Restriction / objection to certain processing.
• APPI: rights of disclosure, correction, addition/deletion, and suspension of use under Arts. 33–35, and the utilization-purpose notice under Art. 32.
• GDPR: rights under Arts. 15–21, and the right to lodge a complaint with a supervisory authority.
• CCPA/CPRA: rights to know, delete, correct, and to opt out of sale/sharing; and the right not to receive discriminatory treatment for exercising rights.

To exercise rights, contact us at hello@gftd.co.jp. Because deletion of content-addressed data cannot be fully guaranteed, we will explain the limits of any erasure request.

9. Cookies

Unauthenticated GET https://kotobase.net/ and GET /signup set no cookies (measured 2026-08-14). After sign-in, session cookies may be set:

• gftd_session — issued by auth.kotobase.net, used to authenticate browser navigations to kotobase.net (HttpOnly / Secure / SameSite as configured by the authentication service);
• kotobase_session — same-origin Worker session (HttpOnly; Secure; SameSite=Lax; Max-Age=2592000).

Both are strictly necessary for an authenticated session. The marketing pages do not load analytics or advertising scripts. Visit telemetry (kaiyu) is recorded server-side from the request Referer and does not set a cookie. The API surface is token/CACAO-authenticated and does not rely on cookies.

10. Children

The Service is not directed to children. You must be at least 18 years of age (owner commercial decision, run 0006). If we learn we have collected account records of a person under 16, we will delete the identity/control-plane records we control; content-addressed Customer Data cannot be guaranteed erased. [CONFIRM: APPI 2026-amendment under-16 handling if any residual processing remains after account deletion.]

11. Changes to this Policy

We may update this Policy; material changes are indicated by updating the "Last updated" date and, where appropriate, by additional notice.

12. Contact

Email: hello@gftd.co.jp. The Operator's registered address is GranTokyo South Tower 11F, 1-9-2 Marunouchi, Chiyoda-ku, Tokyo 100-6611, Japan (Corporate Number 1011101086505). No DPO or EU-UK GDPR Art. 27 representative is designated at this time.