Privacy Policy

• Operator: Atsushi Sakurai (桜井惇), an individual
• Contact: lablate.app@gmail.com

The Service collects the following information from users.

• Credentials: email address, display name, and basic profile information obtained from the authentication provider (Google, Microsoft, and the like).
• Access logs: IP address, user agent, referring URL, and access timestamp — the ordinary logs collected automatically by our hosting provider, Vercel.
• Anonymous usage statistics: page views, country (inferred from IP), and feature-usage events (connecting a folder, creating a page, importing a dataset, exporting a PDF). These are collected by Vercel Web Analytics without cookies and in a form that cannot identify an individual. They never include the contents of research data, folder names, or file names.

Collected information is used only for the following purposes.

• Authenticating users and maintaining signed-in state.
• Statistical analysis for providing, operating, and improving the Service, carried out after processing the data into statistics that cannot identify an individual.
• Notifying users of important matters such as specification changes, incidents, and amendments to the terms.
• Responding to misuse and maintaining safe operation of the Service.
• Responding to enquiries from users.

The Service entrusts the storage and processing of users' personal information to the providers below, limited to what is necessary to operate the Service. Both are corporations located outside Japan (in the United States) and therefore constitute “third parties in a foreign country” under the Japanese Act on the Protection of Personal Information.

• Supabase, Inc. (country: United States; data centre location: Tokyo region)
  Entrusted with: storage of credentials such as email address and display name

  The data centre is located in Japan (Tokyo region), but because the operating entity is a United States corporation, this is treated as provision to a third party in a foreign country.

• Vercel Inc. (country: United States)
  Entrusted with: delivery of the Service's application and collection of access logs

Although both processors are located outside Japan (in the United States), they apply appropriate safeguards to the handling of personal data, and the Service has entered into agreements with them covering the secure handling of personal data (their respective standard data processing terms). For an overview of the personal data protection regime in the United States, please refer to the website of Japan's Personal Information Protection Commission.

Reference: Personal Information Protection Commission, “Provision to third parties in foreign countries” (Japanese)

Personal information is not provided to any third party other than those above, except where required by law or where the user has consented.

The Service uses cookies and similar technologies for the following purposes.

• Maintaining authentication state (keeping you signed in).
• Statistical analysis of how the Service is used, carried out after processing the data into statistics that cannot identify an individual.

Cookies can be disabled in your browser settings, but doing so may make some features of the Service unavailable.

• Credentials: for as long as the account is active, and for a reasonable period after deletion.
• Access logs: the hosting provider's standard retention period (generally days to a few weeks).
• Research data: not retained by the Service at all. It is stored only in the user's own storage.

You have the following rights in respect of your personal information. Please make any request to the contact address below.

• Request disclosure of your personal information.
• Request correction, addition, or deletion of your personal information.
• Request that use of your personal information be suspended.
• Delete your account (credentials are deleted at the same time).

The Service takes the following measures to prevent leakage, loss, or damage to the personal information it collects.

• Encryption of communications over HTTPS.
• Encrypted storage of credentials (using the standard features of Supabase Auth).
• A design in which research data is never stored on the operator's servers.

Users under the age of 16 should use the Service with the consent of a parent or guardian.

The Service may amend this Policy as necessary. Significant changes will be posted on this page and, where appropriate, notified to users.

Please direct any enquiries about this Policy to:

• Email: lablate.app@gmail.com
• Expect a reply within 3–4 business days.