Privacy Policy

1. Operator

2. Scope

This Policy applies to information relating to:

• Users who register or operate an AgreePack account
• Consent Subjects who view or operate a consent page
• People who contact AgreePack
• Visitors to AgreePack websites

Where a User determines the purpose and method of collecting a Consent Subject’s personal information, the User bears primary responsibility and the Operator processes that information only as necessary to provide the service.

3. Information Collected

Account and contract information

• Name, email address, and securely hashed password information
• Business, store, and workspace names
• Membership, role, permissions, registration and update times, and email-verification status

User Content

• PDF and other documents uploaded by Users
• Document titles, descriptions, versions, and management information
• Names, contact details, confirmations, and other information entered by Consent Subjects
• Sensitive information that may appear in documents or fields, such as medical history, health conditions, allergies, or medication status

Consent and operation information

• Relevant document, consent status, and consent time
• Document registration, update, and publication history
• Consent-page viewing and operation history
• Evidence-pack creation and export history
• Account, member, and permission-change history

Technical information

• IP address, User-Agent, browser, device, and operating system
• Access time, referrer, cookies, and session identifiers
• Error, incident, access, and audit logs

Subscription and payment information

• Plan, subscription status, and start, renewal, and cancellation dates
• Billing and payment status
• Customer and payment identifiers issued by Stripe

Payment-card numbers are generally managed by Stripe and are not stored on the Operator’s servers.

Inquiry information

• Name, email address, and inquiry details
• Communication history
• Screens, documents, and other information provided for troubleshooting

4. Collection Methods

• Direct entry by Users or Consent Subjects
• Document uploads by Users
• Automatic logging through service use
• Support and inquiry communications
• Receipt from payment providers and other external services
• Other methods permitted by law

5. Purposes of Use

• Providing, maintaining, and operating the service
• Registration, authentication, email verification, and communication
• Workspace, member, and permission management
• Document storage and display
• Creating consent pages and storing consent information, operation history, and evidence
• Generating evidence packs and other exports
• Managing plans, subscriptions, billing, and payments
• Handling inquiries, complaints, and support
• Investigating incidents, defects, and security issues
• Preventing unauthorized access, abuse, and terms violations
• Analyzing usage and improving the service
• Sending important notices and handling legal obligations or disputes

The Operator does not use User Content to train generative AI models without the User’s explicit consent.

6. Cookies and Analytics

AgreePack uses cookies and similar technologies for login sessions, security, display, and usage measurement.

Public websites use Google Analytics and may collect page-view, device, and referrer information.

Disabling cookies in a browser may prevent some or all service functions from working.

7. External Providers and Processors

Main external providers include:

• SAKURA internet Inc.: servers, networks, and infrastructure
• Cloudflare: DNS, reverse proxy, CDN, WAF, and DDoS mitigation
• Stripe: payments, billing, and subscription management
• Google Analytics: public website usage analysis
• Sentry: error and incident detection and investigation
• UptimeRobot: external monitoring of public endpoints and scheduled tasks, plus the service-status page
• Resend: delivery of authentication, notification, and support emails

Providers are selected and supervised according to the nature and scale of the information processed.

8. Third-Party Disclosure

The Operator does not disclose personal information to third parties without consent except where permitted or required by law, including legal obligations, protection of life or property, public-health or child-welfare needs, cooperation with public authorities, business transfers, and processing arrangements with service providers.

9. Processing Outside Japan

Cloudflare, Stripe, Google Analytics, Sentry, UptimeRobot, Resend, and other providers may process information through entities or servers located outside Japan.

Where this constitutes a transfer to a foreign third party, the Operator takes steps required by applicable law, such as providing information, obtaining consent, or confirming safeguards.

10. Security Measures

Organizational measures

• Managing the scope and authority of personal-information handling
• Maintaining incident-reporting and response procedures
• Reviewing operation and access history
• Continuously reviewing security controls

Personnel measures

• Communicating handling precautions
• Confidentiality and abuse prevention
• Selection and supervision of processors

Physical measures

• Appropriate management of operation devices, credentials, and media
• Preventing unnecessary removal of personal information

Technical measures

• HTTPS encryption
• Login authentication and email verification
• Workspace-based access control
• Separation and additional restrictions for operator functions
• Secure password hashing
• Operation, audit, and access logging
• Disabling unnecessary public APIs and debug functions
• Server and software updates

See the Security Policy for details.

11. Retention and Deletion

Information is retained for as long as necessary for the purposes described in this Policy.

After subscription termination or account deletion, production data is deleted after an operationally necessary period, and backup copies are removed through normal backup rotation.

Contract, billing, inquiry, audit, abuse, or dispute information may be retained as necessary for legal compliance, rights protection, audits, or issue resolution.

12. Access, Correction, and Deletion Requests

Where applicable under Japanese law, individuals may request notice of purpose, access, correction, addition, deletion, suspension, erasure, cessation of third-party disclosure, or disclosure of third-party transfer records.

Identity or authority verification documents may be requested.

Requests concerning data controlled by a User should generally be directed to that User. Direct requests to the Operator are handled after reviewing applicable law and contractual roles.

13. Sensitive Personal Information

Uploaded documents and input fields may contain medical history, health information, disability information, or other sensitive personal information.

Users must obtain required consent and take other legally required steps before uploading such information.

The Operator does not use sensitive information beyond what is necessary to provide the service.

14. Information About Minors

Users handling information about minors must obtain consent from a parent or other legal representative as required by age, capacity, service context, and applicable law.

If the Operator learns that information was submitted without required consent, it may seek confirmation, restrict use, or delete the information.

15. Data Incidents

If leakage, loss, damage, or a suspected incident is identified, the Operator investigates the scope, contains the impact, restores service, and implements recurrence-prevention measures.

Reports to authorities and notices to individuals are made where required by law.

For data processed on behalf of a User, the Operator provides necessary information and reasonable cooperation.

16. Changes and Contact

This Policy may be revised due to legal, service, or processing changes. Material changes are announced by in-service notice, registered email, or another appropriate method.

For inquiries, complaints, or requests regarding personal information, contact the following: