Privacy Notice

1. Controller and contact

DeepDive, Inc. is the controller of the personal data this notice covers (platform data): accounts, passkeys, sessions, consent records for connected applications, login history, your copies of signatures you made for connected applications, your record of agreeing, declining, and withdrawing in connected applications (Agreements), the procedural records of opening the account, accepting updated terms, and purchase, abuse prevention, and consent and provision of data for purchase of paid features.

Data processed on the instructions of an organisation or of the operator of a connected application — organisation membership and join requests, the organisation's security contacts, additional text fields configured by a connected application, records of operation signing for that application, and the records of the agreement procedures that application shows you — is controlled by that organisation or operator. We handle it on their behalf as an entrusted processor. The privacy notice of that organisation, or of the operator of the connected application, also applies to it. The copies of your signatures and your Agreements record that we keep in your account (section 3) are not part of that data.

Name: DeepDive, Inc. (株式会社DeepDive).

Registered head office: 東京都中央区銀座 1-12-4 N&E BLD. 7階 (Ginza 1-12-4 N&E BLD. 7F, Chuo-ku, Tokyo, Japan).

Representative: Ryuya Akiyama, Representative Director.

Privacy contact, and where to direct complaints: [email protected].

2. Scope

This Privacy Notice applies to passkey registration, authentication sessions, SSO token flows, purchase of paid features, operation-signing and agreement procedures, and related account management operated by the service. It also covers access aggregation on our public sites, clavis.nexus and docs.clavis.nexus (section 3).

It does not cover connected applications you sign in to; those services have their own privacy notices.

3. Data we process

We process account identifiers (account ID and passkey display name), passkey registration metadata, and session records (issue and revocation data).

You may optionally provide a contact email for security and account notices. It is not used for sign-in or to link accounts automatically. Notices are sent only after you confirm the address.

We process transaction metadata needed to complete sign-in to connected applications you approve. If you allow profile sharing, we may process your display name.

If you belong to an organisation or apply to join one, we process membership and join-request records on behalf of that organisation (see section 1).

When you sign an operation for a connected application with your passkey, we keep a copy of that signature in your account so that you can check later what you signed: the application's name and host, the operation name it showed you, the time, the passkey used, and the signed record. Beyond the operation name the application chose to show, we do not receive the content of the operation. The application receives its own record separately.

When you agree, decline, or withdraw in a procedure that a connected application shows you, we keep a record of it in your account (Agreements): the application's name and host, what you did, the time, and the decision record, with your signature for an agreement or its renewal. You can withdraw an agreement there without going through the application.

For security and abuse prevention we process network metadata such as IP addresses and security event logs.

At registration you choose a passkey display name shown in your passkey manager. We do not collect your legal name for this purpose.

When you open an account (and, if we do not have it yet, when you accept updated terms), we ask for your year of birth. We keep only the age band it falls in, such as 18 or over, not the year. To decide which procedure and which text apply, we also keep the country estimated from your connection and the country you choose, if you choose one.

Depending on the configuration set by the operator of a connected application, we may process additional text fields (free text, up to 512 characters) on behalf of that operator (see section 1). Do not enter sensitive information or business content in that field.

We use Cloudflare Turnstile to help prevent automated abuse when you register, add or replace a passkey, or recover an account. Turnstile may process device and browser signals. See section 5.

If you start purchase of a paid feature, we provide Polar Software Inc. with your account identifier, the organisation ID, the feature being purchased, and, after purchase, the usage of that feature (counts and times), so that Polar can take payment as merchant of record and bill for usage. We do so only after you consent (see section 5). Polar collects payment details on its own purchase page. We do not receive card numbers.

On clavis.nexus and docs.clavis.nexus, to learn which pages are useful, we may count the following when we serve a page: the page path, the kind of referring site, the kind of browser or crawler, the country, and any Clavis page identifier attached to the link that brought you there. We do not use or record IP addresses, browser identification strings, cookies, or identifiers stored on your device for this. When you press the button on clavis.nexus that asks an AI service about Clavis, the page requests a small image from clavis.nexus so that we can count those presses; we look only at the number of such requests.

When an organisation (Org) is created, we may keep in that organisation's record the identifier of the Clavis page attached to the link that led to the creation screen.

4. Purposes and lawful bases

We process personal data to authenticate users, provide SSO, operate account recovery and revocation, prevent misuse, maintain security logs, and comply with legal obligations.

Under Japan's Act on the Protection of Personal Information (APPI), we specify these purposes of use and handle personal data within them: providing the service you sign up for, checking that a person is old enough to hold an account or to purchase for an organisation, choosing which procedure and text apply, keeping copies of your signatures and your Agreements record so that you can check them, taking payment and billing for paid features, securing the platform and preventing fraud, maintaining the integrity of authentication, complying with legal obligations, and improving our public pages (clavis.nexus and docs.clavis.nexus).

Core account and authentication processing is necessary to provide the service and is not based on consent. Registration checkboxes record your acceptance of the Account Terms and acknowledgement of this notice (see section 10). Provision of data to Polar when you purchase a paid feature is based on your consent (see section 5).

Our operational purposes are providing a trustworthy passkey identity service, protecting users and infrastructure, and maintaining auditability; we use the minimum data necessary and balance these against your rights. The legal bases under the EU and UK GDPR are in section 12.

5. Recipients, processors, and international transfers

We disclose the minimum required data to approved connected applications to complete sign-in you authorise.

We use Cloudflare, Inc. and its affiliates as infrastructure and security processors (including bot protection at registration, when adding or replacing a passkey, and during account recovery).

For paid features (merchant of record for purchase, invoices, and usage metering), we provide Polar Software Inc. (United States; registered office 3500 South DuPont Highway, Dover, DE 19901) with your Clavis account identifier, the organisation ID, the feature being purchased, and, after purchase, the usage of that feature (counts and times). Polar does not handle this data as our entrusted processor; it also uses it for its own purposes (such as payment, tax, and fraud prevention) under its privacy notice (https://polar.sh/legal/privacy-policy).

This is a provision of personal data to a third party located outside Japan. We make it only after the person making the purchase consents before the purchase starts (APPI Article 27(1) and Article 28(1)). Without that consent the purchase does not start and nothing is sent to Polar. Usage after purchase is sent only for the person who consented to that purchase. We record when consent was given, by whom, and the versions of the Customer Terms, the Data Processing Agreement, and this notice that applied, and keep that record for three years from the later of the consent and the last provision to Polar based on it.

Information for that consent (APPI Article 28(2)). Destination country: the United States. Polar's privacy notice states that Polar may transfer personal data to the United States, Canada, or other destinations, so we cannot identify a single country of storage at Polar. The United States personal data protection regime: there is no comprehensive federal law governing the handling of personal information; it is governed by sector-specific federal laws and by state laws (such as California's consumer privacy law). The United States takes part in the APEC Cross-Border Privacy Rules (CBPR) system, an international scheme that certifies how businesses handle personal information; that does not mean Polar holds such a certification. The United States also has laws under which government agencies can collect information held by businesses, for example for national security (such as the Foreign Intelligence Surveillance Act). See also the survey of foreign regimes published by Japan's Personal Information Protection Commission (ppc.go.jp). Measures taken by Polar: Polar's privacy notice states that it maintains physical, technical, organisational, and administrative security measures appropriate to the type of personal data. No adequacy decision covers Polar for this provision, and it is not made under standard contractual clauses.

Our processor Cloudflare, Inc. is a United States corporation. For provision to Cloudflare as a third party located outside Japan, we rely on establishing a system to ensure the continued implementation of equivalent measures as required by the APPI. We do not rely on the recipient being located in a country designated as providing an equivalent standard, nor on obtaining your individual consent. On request we will tell you, without delay, how that system is established, an outline of the measures Cloudflare takes, how often and how we check them, the country in which Cloudflare is located, whether that country has rules that could affect those measures and an outline of them, whether there is any obstacle to those measures and an outline of it, and what we do about such an obstacle. For the country of storage, see section 7.

Where configured for security operations, limited audit records may be sent to a notification address operated by or for DeepDive, Inc.

The current list is the Subprocessor list.

6. Retention

Temporary sign-in data: OIDC authorisation codes up to 10 minutes; temporary data used for operation signing, about 7 to 15 minutes.

Sessions: portal access 15 minutes and refresh 4 hours; connected-application access 15 minutes and refresh 30 days.

Consent records for connected applications: stored for 90 days and extended each time they are used. The product does not impose a maximum lifetime. Effective validity follows your session version; revocation and account deletion stop further use.

Login history entries: the most recent 100 entries (older entries are pruned).

Copies of your signatures for connected applications: the most recent 1,000 (older copies are pruned), until account deletion. You can save any copy as a file before then.

Your record of agreeing, declining, and withdrawing in connected applications (Agreements): the most recent 1,000 (older entries are pruned), until account deletion. You can save any entry as a file before then. The organisation that runs the application keeps its own record, which follows its instructions to us.

Procedural records of opening the account, of accepting updated terms, and of purchase: kept while the account exists and for 730 days after it is deleted.

Rate-limiting counters: normally 60 seconds or less; daily buckets up to 24 hours.

Optional contact email: until you remove it or delete the account. Address-confirmation tokens last one hour.

Organisation membership: until you leave or the account is deleted. Join-request records may remain after the organisation has decided.

Passkey credentials and account records: until account deletion or security-driven replacement, plus any period required by law.

Legal acceptance record (Terms and Privacy Notice versions accepted at registration): stored with the account until deletion.

Audit events (security and operational records): 90 days; records older than that are deleted daily.

Server operation logs (records of requests to our servers and of how they were handled): 30 days.

Consent records given before purchase of a paid feature: kept for three years from the later of the consent and the last provision to Polar based on it. They remain after account deletion as the record of provision to a third party.

Access aggregation on our public sites: individual counts for three months; daily totals, which contain no identifier of a person, without a set limit.

The page identifier kept with an organisation's record: for as long as that record.

7. Security measures

We take the following measures to protect personal data.

Organisational and personnel measures: limiting who handles personal data, recording handling activity, and defined procedures for reporting and responding to incidents.

Technical measures: encryption in transit (TLS), a design in which authenticator secrets remain on your device and the platform only verifies them, session expiry and revocation, key management and rotation procedures, and access logging.

Physical measures: personal data is handled on cloud provider facilities; we operate no physical facilities of our own.

Understanding of the external environment. Personal data is handled on the facilities of our cloud provider (Cloudflare, Inc., United States) in two categories.

Persistent data (accounts, passkey public information — the registration data that leaves your device — organisation membership, login history, copies of your signatures, your Agreements record, procedural records, audit events, optional contact email): held in the European Union region designated by the provider. The provider defines that region only as "the European Union" and does not identify the member state in which data is stored.

Short-lived and intermediate data (authentication procedures, including sessions, sign-in transactions, and temporary data used for operation signing; consent records for connected applications; rate limiting; and address-confirmation tokens): replicated across the provider's network without regional restriction.

We are therefore unable to identify the country of storage for either category. For persistent data, the provider guarantees the location at the regional level only and does not specify or fix it at country level. For short-lived and intermediate data, no region is set on that storage.

In place of a country name we can provide, for persistent data, the range of candidate countries (EU member states in which the provider operates facilities for that jurisdiction) as a current status stating the date we confirmed it, because the provider does not publish that list; and for short-lived and intermediate data, the list of the provider's published network locations ([email protected]).

We have reviewed the personal data protection regimes of the United States, where the provider is established, and of the European Union, where persistent data is held, and have implemented the measures above on that basis. Because the country holding short-lived and intermediate data cannot be identified, the measures above do not depend on any one country's regime.

By the provider's design, some internal identifiers may be recorded outside that region for billing and troubleshooting.

The disclosure required for retained personal data comprises section 1 (our name, address and representative, and where to direct complaints), section 4 (purposes of use), section 9 (how to make a disclosure request), and this section (security measures).

8. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.

Trust scores and rate limits used for abuse prevention involve automated technical measures but do not determine your legal rights in that sense.

9. Your rights

For your Clavis account, you may request disclosure (including disclosure of the records we keep of provision to third parties), correction (including addition or deletion of the relevant record), and cessation of use, erasure, or cessation of third-party provision, as provided by Japan's Act on the Protection of Personal Information (APPI).

A copy of your data and a file export are not on the account screen. Request them at [email protected]. That is not an undertaking that the GDPR right to data portability applies by default.

If EU or UK data protection law applies to you, you may also request restriction, objection, and data portability to the extent that law requires. Customer personal data of people in the EU or the UK is handled under the Data Processing Agreement, including its international transfer module.

How to make a request, how we verify identity, fees, timing, and what deletion removes are set out in Data rights.

You may lodge a complaint with the Personal Information Protection Commission (PPC) at ppc.go.jp or with another competent supervisory authority.

10. Registration acknowledgements

When you create an account, you must accept the current Account Terms and confirm that you have read this Privacy Notice. We store the document version identifiers and a timestamp of that acknowledgement with your account. We also keep a procedural record of which document versions applied, the age band, and a summary of the jurisdiction estimate used for that step (section 3). That record is not a guarantee of legality.

Updating this notice or the Terms does not retroactively change your stored acknowledgement; material changes will be communicated as described in those documents.

11. Governing law

This notice and any non-contractual obligations arising out of or in connection with it are governed by the laws of Japan.

The courts of Japan have jurisdiction over disputes relating to this notice, subject to mandatory rights under applicable data protection law.

12. People in the EU or the UK

This section applies where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing, for example because we offer the account service to people in the EU or the UK. It adds to the sections above.

Legal bases. Performance of our contract with you (Article 6(1)(b)): the account, passkeys, sessions, sign-in to connected applications, copies of your signatures, your Agreements record, the optional contact email, and asking your year of birth to check that you can hold an account. Our legitimate interests (Article 6(1)(f)): securing the service and preventing abuse (including Turnstile, rate limits, login history, audit events, and server operation logs), keeping the procedural records that show which text applied to an account, a purchase, or an agreement, counting access to our public pages, showing those pages in their typeface (Adobe Fonts, Cookie Notice section 3), and remembering your language choice. Your consent (Article 6(1)(a)), and for the transfer to the United States your explicit consent (Article 49(1)(a)): provision to Polar when you purchase a paid feature.

Our legitimate interests are keeping accounts, connected applications, and our infrastructure safe from misuse; being able to show later which version of a text applied; learning which public pages are useful; and presenting our pages consistently. We use the minimum data needed, do not use it for advertising, and weigh these interests against your rights.

You can object to processing based on our legitimate interests. You can withdraw your consent to provision to Polar at any time by writing to [email protected]. We then stop providing your data to Polar, and the paid feature that depends on that provision ends. Withdrawal does not affect provision made before it.

To open an account you must create a passkey and give your year of birth; without them we cannot open the account. To purchase a paid feature, provision to Polar is required.

Transfers. We are established in Japan. The European Commission and the United Kingdom have decided that Japan ensures an adequate level of protection for personal data transferred to businesses subject to the APPI. Our infrastructure processor Cloudflare, Inc. (United States) is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement also includes standard contractual clauses. Polar Software Inc. (United States) is not certified under that framework, and we do not make that provision under standard contractual clauses; it rests on your explicit consent, given after the information in section 5.

You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection under Articles 15 to 21. How to make a request is in Data rights. You can also complain to the supervisory authority of the EU Member State where you live or work or where you consider an infringement occurred, or, in the UK, to the Information Commission (formerly the Information Commissioner's Office).