Privacy Policy
Established November 11, 2026
This English version is provided for reference. The Japanese Privacy Policy is the governing version; in case of any difference, the Japanese text prevails. Read the Japanese original (プライバシーポリシー)
This policy explains how KazLinks Inc. (株式会社カーズリンクス; "we") handles personal data in the vulnerability scanning service Security Ready (the "Service"). The Service is for businesses only.
1. What we collect
- Contacts at customer companies: name, company name, email address, login name, password (stored hashed; we cannot see it) and where to send alerts (email addresses, or webhook URLs such as Slack).
- Authorization records: the sites and servers to be scanned, your declaration that you are authorized to have them scanned, and the date and time, email address and IP address of that declaration, plus the version of the Terms you agreed to. We keep these to show that each scan was authorized.
- Scan results: weaknesses found, the names and versions of software running on your servers, and the results of configuration checks. The internal scan program and the WordPress plugin send only software names, versions, counts and file locations — never file contents or passwords.
- 30-second quick check: the domain you enter and the result (viewable at a shareable URL), and a hash of your IP address to prevent abuse (it cannot be turned back into the IP address).
- Contact form: the name, email address and message you submit.
- Website visits: server logs, and usage data from Google Analytics 4 and Microsoft Clarity (clicks and scrolling; text you type is not recorded).
2. Why we use it, and on what basis
- To provide the Service (scans, results, reports and alerts), to identify you and let you log in, to check and record scan authorization, to bill you, to answer enquiries, to send important notices about the Service, to prevent abuse, and to improve the website and the Service.
- Legal bases under the GDPR: performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests in security and improvement (Art. 6(1)(f)) and, where required, consent (Art. 6(1)(a)).
3. Service providers and transfers
- We use these providers only as needed to run the Service: Supabase (database and login, Tokyo), Vercel (application hosting, Tokyo), SAKURA internet Inc. (the servers that run scans, Japan), Amazon Web Services SES (email delivery, Tokyo), Stripe (card payments — card details are handled by Stripe and never stored by us), Google (Google Analytics) and Microsoft (Clarity).
- Some providers, such as Stripe, Google and Microsoft, process data outside Japan, including in the United States. If you are outside Japan, your data is transferred to Japan. Japan benefits from an EU adequacy decision; other transfers rely on standard contractual clauses or equivalent safeguards offered by the provider.
- We do not give your personal data to third parties without your consent, except where the law requires it.
4. How long we keep it
- Account data and scan results are kept while your contract is active and deleted within about 90 days after you cancel.
- Authorization records are kept for three years after the last scan, to show that scans were authorized.
- Quick check results are kept so that their shareable URLs keep working. Contact us if you want one removed.
5. Your rights
- You can ask us to give you access to, correct, delete, stop using or export your data. Contact us using the details below; we will confirm your identity first.
- If you are in the EU/EEA or the UK, you can also complain to your local data protection authority.
6. Security
- Data is encrypted in transit and at rest. The database separates what each company can see. Only a small number of operator staff can access the data.
7. Cookies
- We use login cookies, a cookie that remembers your language (sr_lang), a cookie that remembers which partner referred you, and Google Analytics and Microsoft Clarity cookies. You can block analytics cookies in your browser; the Service works without them.
8. Changes and contact
- We will post changes to this policy on this page, and tell customer contacts by email about significant changes.
- Contact: KazLinks Inc., via the contact form on our home page.