Privacy Policy

1. Information we collect

In providing the Service we collect the following.

• Account information: email address, name or contact person, company or organisation, and a hash of your password.
• Billing information: plan, contract period, payment status and billing details. We never hold the credit card number itself; it is processed by our payment provider.
• Service usage data: API request metadata, audit logs, access timestamps, IP address and User-Agent.
• Data handled by each product, as set out in section 2.
• The content of your enquiries and the contact details you give with them.

2. Data handled by each product

The products differ in the data they touch. None of them collects beyond the scope defined in advance.

• PP-TSA: we receive only the fingerprint (hash) of your data, the hash algorithm and the request metadata. There is no path by which the content of the original data reaches us.
• AEP: we store, as proof, the sources an AI agent consulted, its decisions, the approver, the time and the configuration. Credentials such as passwords, authentication codes, API keys and access tokens are never included in proof or in notifications. Collection is limited to the signed-in organisation and the permissions granted to it; we do not collect or publish data outside that scope.
• NCC: observation is carried out only against authenticated targets, within the scope permitted by a signed job. We do not probe outside that scope. What we collect is the network state before and after the change, and the result of the fixed-rule evaluation.
• SSA: we handle communication facts observed on the network (metadata for TLS, DNS, HTTP, SMB, Kerberos and the like), signals, findings, incidents and evidence data.

SSA runs in the environment of the partner that licenses it under an OEM or licensing agreement. The controller of data observed in that environment is that partner, and our involvement is limited to what is set out in our contract with them.

Certificates and timestamps are designed not to carry personal names or contact details that the proof does not need. What is certified is an organisation, a domain or a network change — not a person.

3. Purposes of use and legal bases

We use the information we collect for the following purposes. Where the GDPR applies, the corresponding legal basis is shown.

Account information

Providing the Service, authenticating users, administering the contract. Legal basis: performance of a contract.

Billing information

Charging, payment and tax compliance. Legal basis: performance of a contract and compliance with a legal obligation.

Service usage data and audit logs

Keeping the Service running, preventing misuse, investigating faults and security incidents. Legal basis: our legitimate interests. We weigh these against your rights and keep the processing to the minimum needed.

Data handled by the products

Providing product functionality on your instructions. Legal basis: performance of a contract.

Enquiries

Answering you and sending necessary notices. Legal basis: performance of a contract or our legitimate interests.

Announcement and marketing email

Telling you about new features and availability. Legal basis: consent. You can unsubscribe at any time.

4. Disclosure to third parties

We do not disclose the information we collect to third parties, except in the following cases. We never sell personal data.

• Where you have consented.
• Where required by law, or in response to a lawful request from a court or public authority.
• Where necessary to protect a person’s life, body or property and it is difficult to obtain consent.
• Where we have the processors listed in section 5 handle it, within the scope necessary for the purposes of use.

5. Subprocessors

We engage the following processors to provide the Service.

Amazon Web Services

Hosting and email delivery for the Service (the SaaS products). We use the Tokyo region; data is stored in Japan.

Stripe

Credit card payment processing. Stripe collects the card number directly; it does not pass through our systems.

The packet-pilot.net website is served from servers we manage ourselves. If you only browse the website, no personal data reaches the processors above.

We require processors by contract to apply safeguards equivalent to this policy, and we supervise them. If we add or change a processor we will publish it on this page and in the Data Processing Agreement, which carries the current list.

6. International transfers

Personal data in the Service is stored and processed in Japan (AWS Tokyo region) as a rule.

Where personal data is transferred from the European Economic Area (EEA) to Japan, Japan holds an adequacy decision from the European Commission, so the transfer does not require separate Standard Contractual Clauses.

For payment processing, some personal data may be transferred to Stripe in the United States. Stripe participates in the EU-US Data Privacy Framework and additionally offers transfer mechanisms based on Standard Contractual Clauses.

We make no other third-country transfers. If one becomes necessary we will update this policy and put a lawful transfer mechanism in place first.

7. Retention periods

Account information

During the contract and for 30 days after it ends, then deleted.

Authentication and access logs

During the contract and for 30 days after it ends, then deleted.

Enquiry and support records

During the contract and for 30 days after it ends, then deleted.

Billing records

The period required by the Companies Act and tax law. That period is fixed by statute, so we cannot shorten it on request.

Business verification records

During the contract and for the period required by law.

Issued certificates and timestamps

Retained after the contract ends so that they remain verifiable.

We do not keep data indefinitely without a defined period. Except where the law requires retention, information past the periods above is deleted or put beyond recovery.

8. Security measures

To prevent leakage, loss or damage of the information we hold, we apply the following.

• Encryption in transit (TLS) and encryption of stored data.
• Secrets held in a key management service (KMS / Secrets Manager), never in source code or configuration files.
• Least-privilege access and role-based access control (RBAC).
• Two-factor authentication on administrative interfaces.
• Tenant isolation, separating each customer’s data.
• API key management. A complete API key is shown only at issue and is never shown again. If a key is lost, a new one is issued and the old one revoked.
• Audit logging.
• Regular backups, with restore procedures tested.
• Restricted direct access to production databases.

If a personal data breach or similar incident occurs, we assess its impact under our internal procedure and notify the supervisory authority, and where required the individuals concerned, as the law requires. Where the GDPR applies, notification to the supervisory authority is made within 72 hours of becoming aware, as a rule.

9. Cookies and third-party requests

packet-pilot.net sets no cookies and stores nothing in browser local storage. We use no analytics, no advertising trackers and no heatmaps.

The product pages (/products/) and legal pages (/legal/) are served entirely from our own servers, fonts included. Viewing them generates no request to any third party.

The top page and the news pages (/packet_news/) load the styles and scripts they need from the following external CDNs. When they load, the visitor’s IP address and browser information are sent to each provider.

• cdn.tailwindcss.com (page styling)
• cdnjs.cloudflare.com (code formatting)
• unpkg.com (icons)

When you sign in to the Service (the SaaS products), we use the cookies needed to keep you signed in. These are strictly necessary to provide the Service and are not used for analytics or advertising.

10. Your rights and how to exercise them

You may make the following requests in respect of your personal data that we hold.

• Access (information about the data we hold and how we handle it).
• Rectification and completion.
• Erasure.
• Suspension of use and restriction of processing.
• Objection to processing, including processing based on our legitimate interests.
• Data portability (a machine-readable copy and, where technically feasible, transmission to another controller).
• Withdrawal of consent, where processing is based on consent.

Contact us at the address in section 13. We will verify your identity and respond. Where the GDPR applies we respond within one month of receiving the request; for complex requests we may extend by up to two further months and will tell you the reason within the original month.

Information we are required by law to keep (billing and tax records, for example) cannot be erased on request until the retention period expires. We will explain the reason if that applies.

If you are not satisfied with how we handle your request, you may lodge a complaint with the data protection supervisory authority in your country, or with the Personal Information Protection Commission of Japan.

11. Use from the EU / EEA

We do not currently offer the Service on a continuing basis to users in the EU / EEA, and we do not carry out sales activity directed at the EU / EEA.

If we begin offering the Service in the EU / EEA, we will designate a representative in the Union under Article 27 GDPR and publish that representative’s name, address and contact details on this page.

This site publishes language versions other than Japanese. These are provided for reference about our products and are not intended as an offer of services within the EU / EEA.

12. Changes to this policy

If we change this policy, we will publish the revised version on this page. For material changes we will also notify you at your registered email address.

13. Contact

For questions about this policy, and to make a request under section 10, contact us here.

Operator

Packet Pilot LLC (Packet Pilot合同会社)

Email

product.support@packet-pilot.net