Privacy Policy

The information we handle falls into two kinds of a different nature.

• Information about you, our customer — the email address on your account, sign-in history, project settings and the like. We are the business handling this personal information in our own right.
• The telemetry data you entrust to us — these can contain information about the people who use your services. For these we act on your behalf, as the party you have entrusted with them (an entrusted party under Article 27(5)(i) of Japan's Act on the Protection of Personal Information), and we do not decide on any purpose of our own for them.

In addition, the CDN placed in front of the servers that receive telemetry data keeps access logs. These are covered in section 4.

We also keep the source maps you upload (and the caches we build from them). Source maps can contain your source code. We use them only to map the locations in your telemetry data back to your original source code for display, and to group identical errors together. Their retention period is set out in section 4.

We use information about you to let you sign in, to contact you, to bill you, and to prevent abuse. To ask for disclosure, correction, suspension of use or similar of this information, write to kromise@jugoya.ai. We will confirm that the request comes from you and then respond without undue delay.

Business handling personal information: JUGOYA.AI (representative: 中平 善文). Our address will be disclosed without delay on request. Contact: kromise@jugoya.ai

What it contains is decided by your application and your SDK settings. We do not filter the content on our side. It typically includes:

• the exception type and message, the stack trace, and where the error occurred;
• information the SDK attaches automatically (browser, operating system, the requested URL and so on);
• any user identifier or email address you have configured the SDK to send;
• a record of the actions leading up to the error (breadcrumbs);
• performance measurements (how long operations and page loads took, and so on);
• the start and end of sessions, and whether an error occurred during them;
• logs your application sends, and check-ins from scheduled-job monitoring;
• if you enable them in the SDK, attachments and session replays.

An error message itself can contain a string that identifies a user. For example: “User ○○@example.com not found”. What gets sent is designed on your side, so we recommend configuring the SDK not to send information you do not need.

A session replay can contain text shown on screen and what was typed. Which parts are masked is decided by the SDK settings, and those settings are on your side.

We use the records you entrust to us only for the following purposes:

• showing you the content of your telemetry data, and letting you search and aggregate them;
• sending the notifications you have configured;
• incident response, abuse detection and usage metering.

We do not use the records for any other purpose, including compiling statistics. Nor do we use them to improve our own products or services, or as training data for machine learning.

The records are stored and processed in the AWS Tokyo region (ap-northeast-1). Because a CDN (Amazon CloudFront) receives what you send, the connection is decrypted at the edge location nearest the sender and the request is then forwarded to Tokyo. Retention periods are as follows; once a period has passed, the data is deleted automatically.

• Telemetry data — 30 days
• Access logs — 30 days
• Operation logs of the ingest endpoint — 14 days
• Source maps (uploaded files and caches created from them) — 90 days after their last use (or after upload if never used)

The CDN (Amazon CloudFront) placed in front of the servers that receive telemetry records (the public demo included) keeps an access log of each request. An access log contains the IP address of the connecting client, the user agent and the requested URL. Access logs are stored in the Tokyo region. We use them only to keep the service secure and to prevent abuse, delete them automatically once 30 days have passed, and do not use them for any other purpose.

We use the facilities of the following providers to run kromise (the list is also published on the Sub-processors and Security Measures page). The scope of handling set by our contract with each is as follows. On our side, too, we restrict who can access stored content.

• Amazon Web Services — storage and processing of telemetry data, in the Tokyo region. Its contract provides that AWS does not access or use stored content except where necessary to maintain or provide the service, or where required by law.
• Supabase (SUPABASE PTE. LTD., Singapore) — account information and the index used to list and search telemetry data. Its infrastructure is in the Tokyo region. We use it under a data processing agreement (DPA) that provides for processing on our instructions.
• Vercel (Vercel Inc., United States) — delivery of this website and the dashboard. The telemetry data you entrust to us never passes through Vercel.
• Cloudflare (Cloudflare, Inc., United States) — bot protection at account registration (Turnstile). Used from the point at which sign-in is offered.

Because Supabase is a business located outside Japan, Article 28 of the Act on the Protection of Personal Information applies to the handling of the personal data in the index. We take the cross-border measures for this onward entrustment. Specifically, we take contractual measures under Article 16(1) of the Enforcement Rules of that Act and, under Article 18 of those Rules, check at least once a year how Supabase is carrying them out and what Singapore’s regime is. On request from an individual, we provide the items set out in Article 18(3) without delay.

You do not need to take any Article 28 steps of your own in order to entrust telemetry data to kromise. In addition, as set out above, we take the Article 28(3) measures for the onward entrustment and provide the material you need to supervise us as your entrusted party (Article 25 of the Act).

On foreign regimes. For the personal information protection regimes of Singapore (relevant to the index) and the United States (relevant to website delivery), we reviewed the country reports published by the Personal Information Protection Commission (Singapore, United States) before putting our security measures in place.

For your own account information, when you register we will show you the destination country, its regime and the measures the recipient takes, and ask for your consent.

We will announce any addition or change of these providers on the Sub-processors page at least 14 days before the change, and notify your registered email address (in a security emergency, afterwards and without undue delay). For any other security measure, write to kromise@jugoya.ai and we will answer without undue delay.

We do not provide the records you entrust to us to any third party, except where disclosure is required by law. In that case we will tell you, to the extent the law allows.

You may ask at any time for your projects’ data to be exported or deleted. Write to kromise@jugoya.ai.

If a person who uses your service makes a request directly to us, we will tell them that we handle the data on your behalf and pass the request on to you. We do not judge or answer such requests ourselves.

If we find that records you entrusted to us have been leaked, lost or damaged, we will tell you the facts known so far, so that you can meet your own reporting duties under the law.

Our first report reaches you within 72 hours of our becoming aware of the incident. Receiving notice from one of our sub-processors counts as our becoming aware. After that, we will tell you each time a new fact comes to light. How we contact you is set out on the Support & SLA page.

When we change this document, we will set out the new content and the date on which the change takes effect, announce it on this page at least 14 days before that date, and also notify your registered email address.

This English text is provided for convenience. The Japanese version is the authoritative one, and if the two differ, the Japanese version prevails.