This Privacy Policy explains how Umitake ("we", "us") handles the personal information of customers using our services.
Umitake is a Texas, USA company. All processing by us and by our subprocessors takes place in the United States (see §4).
1. Information We Collect
We may collect the following:
- Account information: email address and name (at registration)
- Payment information: card details are processed by Stripe. No card data is stored on our servers
- Usage information: subscription status, download history
- License information: license key, your kintone domain, plugin ID, and the account holder's name and email address
- License verification logs: the time and result of each check. A record is written on every verification, whether valid or not
- Enquiry contents: information submitted through our contact form
- Technical information: IP address, browser type, and access time (recorded in logs). On our plugin delivery CDN, the Referer / Origin recorded is your kintone subdomain
License keys are additionally stored in the user metadata of our authentication provider (Clerk).
2. How We Use Information
- Providing, operating, and improving the service
- Managing subscriptions
- Issuing licenses, verifying validity, and processing renewals
- Responding to enquiries
- Notifying you of material service changes
- Preventing misuse and maintaining security
3. Third Parties and Subprocessors
We use the following third-party services. Information is processed in accordance with each service's own privacy policy.
3.1 Site and account operations
| Provider | Purpose | Data sent | Location |
|---|---|---|---|
| Clerk | Authentication, account management, license key storage | Name, email address, license key | United States |
| Stripe | Payment processing, subscription management | Payment details | United States |
| Vercel | Hosting for the site and the license API, request logs | IP address, request contents | United States |
| Neon | License database | License records, account holder's name and email address | United States (Virginia) |
| Cloudflare | DNS, CDN, TLS termination | IP address, User-Agent, request contents | Global (edge) |
| Resend | Replying to enquiries, system notifications | Email address, enquiry contents | United States |
3.2 Arising from product use
| Provider / host | Purpose | Data sent | Location | Products |
|---|---|---|---|---|
| cdn.umitake.com (Cloudflare Pages) | Delivering the plugin itself | IP address, User-Agent, kintone subdomain | Global (edge) | All |
| license.umitake.com (Vercel / Neon) | License verification | kintone domain, license key, plugin ID | United States | All |
| convert-us.umitake.com (Fly.io) | PDF conversion | The contents of the merged document (not stored) | United States (Virginia) | Document Generator |
| Microsoft (Graph API) | Fetching and sending email | Email bodies, subjects, attachments (not stored) | Your Microsoft tenant | Outlook Connector |
| Fly.io | Server runtime | Where the above processing runs | United States (Virginia) | Document Generator, Outlook Connector |
| Upstash (Redis) | Throughput control | Per-tenant counters only | United States | Outlook Connector |
| Sentry | Error monitoring | Exception types, error codes, masked email addresses | United States | Outlook Connector |
| The AI provider you contract with | OCR processing | Documents submitted for OCR, master data. We are not the contracting party | Per your agreement with that provider | AI OCR |
| cdnjs.cloudflare.com | Loading a PDF processing library | IP address, User-Agent | Global (edge) | AI OCR |
For each product, the detail of what goes where and how long it is kept is set out in the per-product documents under Data Handling. Those documents form part of this policy.
We do not sell or rent your personal information to third parties except as required by law.
4. Cross-Border Transfer of Personal Data
Umitake is a Texas, USA company, and all processing by us and by the subprocessors listed in §3 takes place in the United States. Personal data of customers in Japan is transferred outside Japan.
- Destination country: the United States. Traffic to Cloudflare additionally passes through edge locations worldwide. Per-provider locations are listed in the §3 tables.
- The data protection regime of the destination country: the United States has no comprehensive personal data protection statute equivalent to Japan's Act on the Protection of Personal Information; protection is provided through state laws and sector-specific legislation.
- Measures taken by the recipients: each subprocessor implements measures under its own privacy policy and data processing agreement. For details, request them at [email protected] and we will provide them individually.
Note that kintone itself is a service you contract for directly with Cybozu, Inc. and is outside our control. Where data stored inside kintone resides is governed by your agreement with Cybozu.
5. Per-Product Data Handling
How much data we handle varies greatly by product. We publish a detailed, implementation-based document for each:
- Shared infrastructure (CDN and license verification) — all products
- Umitake Document Generator for Kintone
- Umitake AI OCR for Kintone
- Umitake BI Tool for Kintone
These documents form part of this policy. If you need a security questionnaire completed, they are written to be used directly as review material.
6. Data Retention
| Data | Retention |
|---|---|
| Account information | While the account is active |
| License records (account holder's name, email address, domain, license key) | Indefinite (see below) |
| License verification logs | Indefinite (see below) |
| Outlook Connector server-side data | Deleted automatically 30 days after the license becomes invalid (implemented, runs daily) |
| Business data for other products | Not stored on our servers |
| Hosting and CDN request logs | Each provider's own default |
We have not implemented any mechanism that automatically deletes license records or verification logs. Cancellation only sets a flag marking the license inactive; the account holder's name, email address, and license key are not deleted. We state this as fact; implementing retention is on our roadmap.
To request deletion, contact [email protected] and we will handle it individually.
Data we are legally required to retain may be kept for the mandated period.
7. Your Rights
You have the right to:
- Access the personal information we hold about you
- Have inaccurate information corrected
- Have your personal information deleted (subject to legal limitations)
- Object to processing
- Request information about transfers to third parties overseas (see §4)
To exercise any of these, contact [email protected].
8. Security
We apply industry-standard measures to protect your personal information from unauthorised access, loss, and alteration. However, no transmission over the internet can be guaranteed completely secure.
Product-specific safeguards, such as token encryption methods, are described in the documents under Data Handling.
9. Cookies and Local Storage
Our services use cookies and local storage to maintain authentication state. You can disable cookies in your browser settings, though some functionality may be limited.
Our plugins additionally use your browser's local storage for:
| Purpose | Retention | Contents |
|---|---|---|
| Caching the license verdict | 24 hours | The verdict only; no business data |
| BI Tool data cache | 30 minutes by default (4MB cap) | Actual kintone record data |
On shared or kiosk workstations, logging out does not clear these — clearing browser data does.
10. Changes to This Policy
This Privacy Policy may be updated as our services change. We will notify you of material changes within the service or by email.
11. Contact Us
For privacy questions or requests:
Umitake Email: [email protected]
Related: Data Handling · Terms of Service