プライバシーポリシー

This Privacy Policy (this "Policy") sets out how Romanark Inc. (2-3, Minami 5-jo Nishi 15-chome, Chuo-ku, Sapporo, Hokkaido 064-0805, Japan; the "Company") handles user information in "Arkor" — including the web application, the API served at api.arkor.ai, inference endpoints served at *.arkor.app, the CLI/SDK, and related services (collectively, the "Service").

The Company collects the following information:

• Account information: email address, name, and authentication identifiers obtained through our authentication provider (Auth0);
• Service usage data: organization/project settings, training-job configurations and logs, trained models/adapters, and deployment settings;
• Inference data: requests (inputs such as prompts) and responses (generated outputs), stored according to each inference endpoint's storage settings (including retention settings);
• Analytics information: as described in Section 4; and
• Error and incident information: as described in Section 6.

The Company uses collected information to:

• provide, maintain, protect, and improve the Service;
• verify identity, authenticate, and manage accounts;
• respond to inquiries;
• analyze usage and improve quality;
• detect and prevent unauthorized use; and
• deliver important notices such as amendments to the Terms of Service.

To understand how the Service is used, the Company performs analytics using PostHog (collecting event information such as pages viewed and clicks). Whether data is collected, and how it is stored, depends on region — determined from the IP-based country code header added by Vercel — and on login state, as follows:

• Visitors not logged in — in the UK, EU, or EEA: no collection (and no identifiers are stored);
• Visitors not logged in — in Japan or the US: collected using localStorage and cookies;
• Visitors not logged in — in other regions: collected using localStorage only;
• Visitors not logged in — when the region cannot be determined: no collection;
• Logged-in users: collected using localStorage and cookies in all regions, on the basis of agreement to the Terms of Service.

For logged-in users, in addition to the event information above, account-identifying information (email address, name, the authentication provider's user identifier, and the internal identifier (ID) and name of the user's organization) is sent to PostHog as properties used to understand usage on a per-user and per-organization basis.

The result of this region/login determination is stored in a cookie named "arkor_analytics_gate". This cookie holds the analytics operating mode and, while logged in, a short value derived from your account identifier by a one-way hash (it cannot be reversed to the original identifier), used to detect a switch to a different account in the same browser so the analytics identifier can be reset appropriately. While logged in, a cookie holding the same hash value ("arkor_identified_gate_version"), shared across our subdomains, is also used for that reset determination. These cookies are necessary for providing the Service and are not used to track browsing behavior; the latter is deleted on logout, opt-out, or transition to a non-collecting state. Analytics identifiers are reset on logout.

Separately, the Company uses Vercel Web Analytics and Speed Insights, provided by our hosting platform. These use no cookies or localStorage and collect aggregated, non-identifying usage and performance information; they are outside the regional handling above and the opt-out in Section 5.

Even when subject to PostHog analytics, users can stop collection (opt out) at any time by the means below. This opt-out applies to PostHog analytics (the cookie-less aggregated measurement described at the end of Section 4 is out of its scope):

• using the opt-out control panel at the bottom of this page; or
• deleting the Service's cookies and site data (localStorage) from your browser settings. Note that this is a one-time reset of the analytics identifier — it also erases the opt-out preference itself, so collection may resume on later visits according to your region and login state. To keep collection stopped, use the opt-out control panel at the bottom of this page.

The opt-out preference is saved per browser and applies only to the browser in which it was set. It is stored in a cookie that holds only the preference itself — used solely to retain the setting, never for tracking — and is shared across our subdomains, so an opt-out made on any of our pages applies to our other subdomains as well.

To keep the Service running reliably, the Company performs error monitoring using Sentry. Errors occurring in the application, and technical information about the circumstances in which they occurred, are sent to Sentry.

In addition, CSP (Content Security Policy) violation reports and NEL (Network Error Logging) reports generated automatically by your browser — technical information about network failures and security-policy violations — are also sent to Sentry.

In providing the Service, the Company uses, or entrusts information handling to, the following external services: Vercel (hosting), Amazon Web Services (training/inference infrastructure), Auth0 (authentication), Neon (database), Upstash (data processing), PostHog (analytics), Sentry (error monitoring), OpenRouter (inference for demo features), and Runpod (GPU infrastructure).

The Company also uses, or may in the future use, Microsoft Azure, Google Cloud, Cloudflare, SAKURA internet, Mintlify, and Modal.

Some of these providers are located outside Japan, and information may be processed and stored on servers outside Japan. The Company takes the measures required by the Act on the Protection of Personal Information of Japan and other applicable laws.

The Company does not provide personal information to third parties except as required by law, where necessary to protect a person's life, body, or property, or with the individual's consent (excluding provision to the processors in Section 7).

The Company retains information for the period necessary for the purposes of use, or as required by law. Retention of inference data follows each inference endpoint's storage setting (disabled, a set number of days, or unlimited). Accounts and related data are deleted within a reasonable period following project or account deletion.

The Company takes necessary and appropriate measures — including encrypted communication, access controls, and hashed storage of credentials — to prevent leakage, loss, or damage of the information it handles and to otherwise manage it securely.

In accordance with the Act on the Protection of Personal Information of Japan, users may request disclosure, correction, addition, deletion, or suspension of use of their personal information held by the Company. Please direct requests to the contact in Section 13. After verifying identity, the Company will respond without undue delay in accordance with applicable law.

The Company may amend this Policy in response to changes in law or in the Service. Material changes will be announced by posting within the Service or by other appropriate means.

For inquiries about this Policy or the handling of personal information, please contact Romanark Inc. at 2-3, Minami 5-jo Nishi 15-chome, Chuo-ku, Sapporo, Hokkaido 064-0805, Japan.

The Japanese version of this Policy is the authoritative text. Even where an English translation is provided for reference, the Japanese version prevails in the event of any discrepancy between the two.