Privacy Policy

In providing the Service we collect the following information.

• (1)Account information: your name, email address, profile image and the identifiers used for authentication. We obtain these through the authentication platform we use (Clerk). If you sign in with an external account such as Google, we receive the email address, name, profile image and similar data provided by that service. Passwords are held by Clerk; we do not store them.
• (2)API key issuance and usage data: the name of each API key, a hash of the key, the dates of issuance and last use, your plan, and per-request usage logs (timestamp, endpoint, token cost, response status, response time, data volume, cache layer and country of origin). The plaintext key is shown only once, at issuance; we store only its hash.
• (3)Subscription and billing data: your plan, the customer ID, subscription ID and transaction IDs issued by Paddle, subscription status, billing period, and the date and amount of each transaction. Payment details such as card numbers, expiry dates, security codes and billing addresses are collected and stored by Paddle, our Merchant of Record; we do not receive them.
• (4)Technical data and analytics: IP address, browser and operating system, referrer, pages viewed, access times, and identifiers such as cookies. Our website and API are delivered through the Cloudflare network, and we obtain this data through the logging and analytics features Cloudflare provides and through Google Analytics (Section 4).
• (5)Enquiry data: the name, email address and content you provide when you contact us, and the record of our correspondence.
• (6)Information about contacts at corporate customers: the names, departments, titles, email addresses and addresses of contacts and signatories provided by corporate customers for quotes, contracts and billing, and records of invoices issued and bank transfers.

We use the information we collect for the following purposes.

• (1)Providing the Service, verifying identity, and managing accounts and API keys.
• (2)Enforcing usage limits (monthly quotas and rate limits) and displaying usage in the dashboard.
• (3)Sending service notifications by email, such as usage alerts that tell you when your monthly token usage reaches a share of your limit. You can turn usage alerts off, or add recipients, at any time on the settings page of the dashboard.
• (4)Managing paid-plan subscriptions, billing and confirming payment status, including through our integration with Paddle.
• (5)Detecting and preventing abuse, breaches of the Terms of Service and security threats.
• (6)Responding to enquiries and sending important notices such as outages, maintenance and changes to our terms.
• (7)Improving the Service and developing new features through statistical analysis of usage.
• (8)Under an organisation contract (an Enterprise organisation), showing or reporting members' participation, number of API keys and usage (such as token counts) to the administrators of the contracting organisation, and handling quotes, contracts and billing.
• (9)Complying with legal obligations and handling disputes.
• (10)Sending information about the Service, such as new features and plans. You can opt out of these communications at any time.

We do not provide personal information to third parties without your prior consent, except in the following cases.

• (1)Where required by law.
• (2)Where necessary to protect a person's life, body or property and it is difficult to obtain your consent.
• (3)Where we need to cooperate with a national or local government body, or a party entrusted by one, in performing duties prescribed by law, and obtaining your consent would impede those duties.
• (4)Where information is transferred in connection with a merger, business transfer or other succession.

Under Article 8, paragraph 4 of the Terms of Service (special provisions for Exchange Data), we may provide Tokyo Stock Exchange, Inc. with your name, email address, account ID, API key usage and other information necessary for its investigation into our use of Exchange Data (stock prices and the like), to the extent necessary for that investigation. By agreeing to the Terms of Service when you register, you consent to this provision.

If you join a corporate organisation (an Enterprise organisation) as a member, we provide the contracting organisation (its administrators) with your name, email address, membership status, number of API keys and usage (aggregated token and request counts, etc.) through the dashboard, usage-alert emails and usage reports. By joining an organisation as a member you consent to this.

To the extent necessary to provide the Service, we entrust the handling of personal information to, or share information with, the following providers. Some of them are located outside Japan (in the United States, the United Kingdom and elsewhere), and each handles information in accordance with its own privacy policy.

• (1)Clerk, Inc. (United States): authentication platform. Handles account information, credentials and sign-in history.
• (2)Cloudflare, Inc. (United States): hosting of the website and API, CDN, security, logging and usage aggregation, and the database that stores accounts, API keys, usage and subscription status.
• (3)Paddle.com Market Limited (United Kingdom) and its affiliates: sale, billing, payment processing and tax handling for paid plans (Merchant of Record). We receive your email address, customer ID, subscription status and transaction data from Paddle.
• (4)Google LLC (United States): website analytics (Google Analytics; as described in Section 4, for users in the European Economic Area, the United Kingdom and Switzerland only with consent).
• (5)Amazon Web Services, Inc. (United States): the data platform on which we collect and store the financial, price and other data provided through the Service (as a rule, no personal information of users is stored there), and delivery of service notification emails such as usage alerts (Amazon Simple Email Service). To deliver these emails it handles the recipient's email address and the subject and body of each message.

For providers located outside Japan, we make available, in accordance with the APPI, information about the country concerned, the personal-information protection regime of that country and the protective measures taken by the provider, through this Policy and our contact address. We confirm, through each provider's terms, certifications and published materials, that it continuously takes measures equivalent to those we are required to take under the APPI.

Our website uses cookies and browser local storage for the following purposes, all of which are necessary to provide the Service.

• (1)Keeping you signed in and managing sessions (cookies set by Clerk).
• (2)Remembering preferences such as display language, light or dark theme and which documentation sections are open (local storage).
• (3)Security (cookies set by Cloudflare to protect against unauthorised access and bots).
• (4)Purchasing a paid plan (cookies set by Paddle when you open the checkout).

Analytics (Google Analytics). To improve the website, we use Google Analytics provided by Google LLC (United States). For users visiting from the European Economic Area, the United Kingdom and Switzerland, it is loaded only after you give consent in the consent banner. Users in other regions can stop the measurement at any time from "Cookie settings" at the bottom of the page. We do not use advertising features (such as ad personalisation or Google signals).

Disclosure of external transmission under the Telecommunications Business Act of Japan. When Google Analytics is loaded, the following information is sent from your device to Google LLC.

• (1)Recipient: Google LLC (United States).
• (2)Information sent: URL and title of pages viewed, referrer, date and time, device and browser type, screen size, language settings, approximate region (estimated from the IP address; the IP address itself is not stored), and identifiers stored in cookies.
• (3)Purpose: understanding and improving how the website is used.
• (4)How to opt out: reject in "Cookie settings" at the bottom of the page, or use the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

Apart from the above, we do not use cookies or tracking technologies for advertising. Fonts are served from our own servers, so loading fonts does not send your IP address or other data to third parties.

You can disable cookies in your browser settings, but some features of the Service, including signing in, may then be unavailable.

To prevent the leakage, loss or damage of the personal information we handle, and otherwise to keep it secure, we take the following measures.

• (1)Encryption of all communications with TLS.
• (2)Storing API keys only as hashes, and not storing passwords.
• (3)Minimising access rights and using multi-factor authentication.
• (4)Checking the security arrangements of providers before entrusting them with data.
• (5)Maintaining and periodically reviewing security measures required under the APPI.

We keep personal information only for as long as necessary for the purposes described above, after which we delete or anonymise it without undue delay. As a guide:

• (1)Account information and API keys: deleted within 30 days of account deletion (and progressively removed from backups).
• (2)API usage logs: per-request logs are kept for 90 days; daily and monthly aggregates are kept for the life of the account.
• (3)Subscription and transaction records: kept for 7 years after the transaction, in line with retention obligations under tax and other laws.
• (4)Email delivery records (time sent, masked recipient, subject and delivery result): kept for 90 days after sending. We do not store message bodies.
• (5)Enquiry records: kept for 3 years after the matter is closed.

Under the APPI you may ask us to notify you of the purposes of use of your personal information, to disclose it, to correct, add to or delete it, to suspend its use or erase it, and to stop providing it to third parties.

Please send requests from your registered email address to our contact address (support@zenithcode.net). After verifying your identity we will respond within a reasonable period in accordance with the law. If the law does not allow us to comply with a request, we will tell you so and why. As a rule we do not charge a fee for such requests.

You can view and change your account information (name, email address, profile image and so on) yourself in the dashboard settings. You can revoke API keys from the dashboard at any time.

The Service may contain links to external websites and services, such as the Paddle checkout and the websites of our data sources. We are not responsible for how those external services handle personal information.

We may change this Policy in response to changes in the law, the Service or otherwise. We will announce material changes by posting on the Service or by notice to your registered email address. The amended Policy takes effect when it is posted on the Service.

For questions, complaints and requests concerning personal information, please contact: Controller: Crabgrass Inc.; Personal information protection manager: Sohei Taniguchi, Representative Director; Contact: support@zenithcode.net. Our address and other company details are given in the operator block at the end of this page.