Privacy Policy

Note: This English text is provided for reference. The Japanese version prevails in case of any discrepancy. This translation is pending legal review.

Arstruct Inc. ("we" or "us") is committed to the appropriate handling of Users' personal information and to taking appropriate measures for its security management in connection with the use of our service "Code Rakuda" (the "Service"), and strives to protect your privacy.

Article 1 (Definition of Personal Information)

"Personal Information" means information about a living individual, such as name, address, date of birth, telephone number, email address, IP address, credit card number, or other descriptions, that can identify a specific individual (including information that can be readily cross-referenced with other information to identify a specific individual).

Article 2 (Purpose of Use)

We collect and use personal information for the following purposes:

Sending confirmation emails upon registration, withdrawal, or change of details
Confirming, investigating, and responding to inquiries
Sending information about technical support and new services
Shipping products and promotional items
Compiling statistical information for use in the development and improvement of the Service
Providing and managing the Service
Billing, payment, and confirmation thereof
Investigating and analyzing usage
Improving the Service and researching and developing new services
Resolving operational issues
Preventing unauthorized use and ensuring security
Responding to inquiries
Notifying the User of newly disclosed known vulnerabilities, using the product names and versions detected in diagnoses
Purposes incidental or related to the above

Article 3 (Restrictions on Use)

We will not handle personal information beyond the scope necessary to achieve the purpose of use without obtaining the User's prior consent, except in the following cases:

Where required by law
Where necessary to protect a person's life, body, or property, and it is difficult to obtain the consent of the person
Where particularly necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain the consent of the person
Where it is necessary to cooperate with a national government organ, a local government, or an entity entrusted by either in executing affairs prescribed by law, and obtaining the person's consent would impede the execution of those affairs

Article 4 (Method of Acquisition)

We acquire personal information appropriately. We will not acquire personal information by deception or other improper means.

Article 5 (Notice Regarding Acquisition)

When we acquire personal information, we will publish the purpose of use in advance, except where doing so could harm the life, body, property, or other rights or interests of the User or a third party.

Article 6 (Change of Purpose of Use)

We will change the purpose of use of personal information only to the extent that the changed purpose is reasonably considered to be substantially related to the purpose of use before the change. If we change the purpose of use, we will notify the User of the changed purpose or publish it on our website.

Article 7 (Outsourcing of Management)

When we outsource all or part of the handling of personal information to a third party, we will enter into a confidentiality agreement with the outsourced party, provide only the minimum information necessary, and exercise appropriate supervision to ensure the outsourced party maintains proper security management of the personal information.

Article 8 (Restrictions on Provision to Third Parties)

We will not provide personal information to a third party without obtaining the User's prior consent, except in the following cases:

Where required by law
Where necessary to protect a person's life, body, or property, and it is difficult to obtain the consent of the person
Where particularly necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain the consent of the person
Where it is necessary to cooperate with a national government organ, a local government, or an entity entrusted by either in executing affairs prescribed by law, and obtaining the person's consent would impede the execution of those affairs

Article 9 (Disclosure of Personal Information)

When a User requests disclosure of their personal information, we will disclose it to the User without delay. However, we may not disclose all or part of it if disclosure would fall under any of the following, and if we decide not to disclose it, we will notify the User of that fact without delay:

Where disclosure could harm the life, body, property, or other rights or interests of the User or a third party
Where disclosure could significantly impede the proper conduct of our business
Where disclosure would otherwise violate any law or regulation

Article 10 (Correction of Personal Information)

If a User requests correction, addition, or deletion of their personal information on the grounds that it is not accurate, we will, except where a special procedure is prescribed by other laws and regulations, conduct the necessary investigation without delay to the extent necessary to achieve the purpose of use, correct the content of the personal information based on the results, and notify the User accordingly.

Article 11 (Disclaimer)

We are not liable in the following cases:

Where the User has disclosed their own personal information to a third party using a function of our Service or other means
Where a User's personal information has become, or could become, identifiable from information the User has entered

Article 12 (Cookies and Access Analysis)

The Service currently does not use third-party measurement tools such as access analysis tags (e.g., Google Analytics), advertising tags, or heat maps. We may use browser storage (cookies or local storage, etc.) for authentication purposes to maintain login state. If we introduce access analysis or other tools in the future, we will add the information collected, the purpose of use, and the opt-out method to this Policy and provide notice.

Article 13 (Retention of Detected Product Information and Vulnerability Notifications)

When we run a diagnosis, we retain the product names we detect (such as PHP, WordPress core, plugins and themes, and Composer and npm packages), their versions, the evidence for the detection, the identifiers of the vulnerabilities that applied at the time, the diagnosed URL or repository name, and the date and time of the diagnosis, linked to the account that requested the diagnosis and to the diagnosis case.
We use this information to check, without accessing the diagnosed target again, whether newly disclosed vulnerabilities apply to the products already diagnosed. Only diagnoses made within the past 180 days are checked.
When we find a newly applicable vulnerability, we may notify the email address of the account that requested the diagnosis. We send these notices to users of both the free and the paid diagnosis. High-priority notices are sent promptly (up to three per account per day); others are combined into one email per day.
You can stop receiving these notices at any time by using the unsubscribe link at the end of each email. Unsubscribing stops both vulnerability notices and other informational emails from us, including follow-up emails after a diagnosis.
We retain the information in paragraph 1 until you delete the diagnosis case, just as we retain the diagnosis results. We do not automatically delete it after a period of time. When you delete a diagnosis case, we delete the information in paragraph 1 and do not send any notice that has not yet been sent.

Article 14 (Contact)

For requests regarding disclosure, correction, deletion, or suspension of use of personal information, and for any other opinions, questions, or complaints regarding the handling of personal information, please contact us via the contact form.