Gatepath Privacy Policy

Article 1 (Scope)

This Policy applies to the handling of information in “Gatepath” (the “Service”) provided by the Company and on the Company's website relating to the Service.

The Service is an enterprise knowledge search service. The handling of documents, messages and other content that a customer connects to the Service (“Customer Data”) is governed by Article 10 of the Terms of Service. This Policy primarily covers personal information obtained by the Company and information about the browsing of this website.

Article 2 (Information We Collect)

We collect the following information.

• Account information: name, email address, organisation name and other information provided at signup and login.
• Identifiers from connected services: user identifiers and group memberships in External Services connected to the Service (Slack, Confluence, Jira, GitHub, SharePoint, Microsoft Teams, OneDrive, Google Drive, Discord and others), which are necessary to determine who may see each search result.
• Customer Data: documents and messages selected for synchronisation. These may contain personal information.
• Billing information: information required for invoicing. Credit card numbers are handled by our payment provider and are not retained by the Company.
• Website usage information: how the landing page is used (pages viewed, buttons clicked). Collected subject to Article 4.
• Enquiries: the content of your enquiry and your contact details.

Article 3 (Purposes of Use)

We use the information collected for the following purposes.

• Providing, maintaining, protecting and improving the Service
• Determining who may view each search result, so that the permissions of the source service are preserved
• Identity verification, account management and authentication
• Billing and payment
• Responding to enquiries and sending important notices
• Understanding and improving how the landing page is used
• Preventing misuse and maintaining security

In accordance with Article 10 of the Terms of Service, we may use information that has been appropriately aggregated or anonymised so that no customer can be identified, in order to improve the quality of the Service and to prepare statistics.

Article 4 (Cookies, Analytics and Embedded Content)

Analytics (Google Analytics 4)

We use Google Analytics 4, provided by Google LLC, to understand how our landing page is used. As a result, records of the pages viewed and actions taken are transmitted to Google LLC.

We use Google Consent Mode v2. For visitors from the European Economic Area and the United Kingdom, no cookie-based measurement takes place until consent is given. Before consent, only cookieless aggregation is performed. For visitors from other regions, cookie-based measurement is performed.

The cookies used for measurement are named _ga and names beginning with _ga_, and are used to compile statistics about pages viewed. We do not use them for advertising.

You can refuse or delete cookies in your browser settings. You can also stop measurement using the Google Analytics opt-out add-on.

Embedded video (YouTube)

Our landing page embeds an introductory video from YouTube (Google LLC). The video is loaded only when you press the play button. If you play it, information about your viewing is transmitted to Google LLC and cookies or similar technologies may be used.

Cookies necessary for the Service

We use cookies to keep you signed in and to prevent forged requests (CSRF protection). These are necessary for the Service to function and are used regardless of your analytics consent.

Article 5 (Disclosure to Third Parties and Processors)

We do not disclose personal information to third parties without your prior consent, except:

• where required by law;
• where necessary to protect the life, body or property of a person and it is difficult to obtain consent; or
• where cooperation with a state organ performing statutory duties is necessary.

We may engage external providers to perform part of our operations within the scope necessary to achieve the purposes of use, and supervise them appropriately under contract. Our principal providers are:

• Amazon Web Services, Inc. (server infrastructure)
• Google LLC (analytics, video delivery)
• Stripe, Inc. (payment processing)

Article 6 (External Transmission)

In accordance with Article 27-12 of the Telecommunications Business Act of Japan, we disclose the following about transmission of terminal information from this website to external parties.

Article 7 (Storage Location and International Transfers)

In the SaaS edition, Customer Data and account information under our management are stored in Japan (the Amazon Web Services Tokyo region).

If you deploy the Service inside your own AWS account, Customer Data remains in your environment and is not transferred to us.

As described in Articles 4 and 6, browsing information may be transmitted outside Japan, including to the United States, in connection with analytics and video delivery. The handling of personal information by those providers is governed by their own privacy policies.

Article 8 (Security Measures)

As set out in Article 10 of the Terms of Service, we implement access control, encryption in transit and other reasonable security measures. The Service is designed to reflect the access permissions of the source External Service in search results, and results are not shown where permissions cannot be confirmed.

Article 9 (Retention)

After termination of the agreement, we delete Customer Data under our management within a reasonable period, except where retention is required by law, for security investigation or for backup operations (Article 10 of the Terms of Service).

The retention period for information collected through analytics is governed by the Google Analytics configuration.

Article 10 (Your Rights)

You, including residents of the European Economic Area and the United Kingdom, may request access to, correction of, addition to, deletion of, suspension of use of, suspension of third-party provision of, and portability of the personal information we hold about you. You may withdraw your consent to analytics at any time.

Please send such requests to the contact in Article 12. We will respond in accordance with applicable law after verifying your identity.

Article 11 (Changes to this Policy)

We may change this Policy in response to changes in law or in the Service. Where a change is material, we will announce it by posting on this website or by other appropriate means.

Article 12 (Contact)

For enquiries about this Policy or about the handling of personal information, please contact:
Enoxa Inc., Gatepath Desk
Email: info@enoxa.jp

This Policy is governed by and construed in accordance with the laws of Japan (Article 23 of the Terms of Service).