Privacy policy
2026-10-04
This policy explains how Northpine Labs LLC ("we") handles personal information in the PR Payment Audit, under Japan's Act on the Protection of Personal Information (APPI) and other applicable laws. A Japanese version is available; if the versions differ, the Japanese version prevails.
1. Who we are
Northpine Labs LLC, a United States company. Contact: [email protected]. Our address and the name of our representative are disclosed without delay on request.
2. What we collect
| Data | Why | When |
|---|---|---|
| Documents you upload (photos, PDFs) — after long ID numbers are blacked out | To read payment deadlines, payment dates and amounts | Free check, audit |
| Values read from them (deadlines, payment dates, amounts, document type, municipality) and your corrections | To build your timeline and report | Audit |
| Your answers (route, period of stay, dates of arrival/marriage, work and insurance history, yes/no answers) | To apply the rules for your route | Free check, audit |
| Email address | To send your order link, report, reminders you asked for, and sign-in links | When you give it |
| Payment information (amount, Stripe IDs) | To process and refund payments. We never receive your card number. | Purchase |
| Technical data (cookie IDs, browser type, pages viewed) | Security, abuse prevention, and to improve the service | All visits |
We never collect My Number (個人番号). Please cover it before uploading. As a safeguard, our server finds 10-to-13-digit numbers (such as My Number and the basic pension number) in every upload and paints them black before anything is stored or sent for reading. If a My Number is still detected afterwards, the stored copy is deleted and you are asked to upload again.
Names and addresses on your documents are not extracted into our database. They remain only inside the redacted page images until those are deleted.
3. Purposes of use
- Providing the free check and the PR Payment Audit: reading documents, computing timelines, answering the self-check questions, the earliest clean date, and the list of missing certificates.
- Sending the emails you asked for (order link, report, reminders) and sign-in links.
- Payments, refunds and accounting.
- Security, preventing abuse, and fixing reading errors you report.
- Improving the service using aggregated analytics that contain no document data (no amounts, dates, names or addresses).
We do not use your documents to train AI models, and we do not sell personal information.
4. Retention
| Data | Kept until |
|---|---|
| Uploaded documents (redacted) | 7 days after your report is built, 30 days after payment if no report is built, or immediately when you press "Delete" |
| Free check (answers, document, result) | 7 days |
| Report | 90 days after it is built |
| Email for a reminder you requested | Until the reminder is sent or cancelled |
| Payment records | As long as tax and accounting law requires |
Database backups never contain uploaded documents (they are stored separately and are not backed up). Backups are kept for 30 days.
5. Transfer to third parties in a foreign country (United States)
Your data is processed in the United States by the following service providers. With your separate consent (checkbox before upload and before payment) we transfer personal information to them for the purposes above:
| Recipient | What | Where |
|---|---|---|
| OVHcloud US (our server, Vint Hill, Virginia) | All data of the service | United States |
| Anthropic PBC (Claude API) | Redacted page images, to read them | United States |
| Stripe, Inc. | Payment data | United States |
| Resend (email delivery) | Email address and email content | United States |
| Cloudflare, Inc. | Network traffic (content delivery and security) | United States and its global network |
| PostHog, Inc. (analytics) | Pseudonymous usage events — no document data | United States |
The personal-information protection system of the United States. The United States has no comprehensive federal privacy law equivalent to the APPI. Personal information is protected by sector-specific federal laws, by the Federal Trade Commission's enforcement against unfair or deceptive practices, and by state laws (for example, comprehensive consumer privacy laws in California and Virginia). Japan's Personal Information Protection Commission publishes details: 外国における個人情報の保護に関する制度等の調査（アメリカ合衆国）.
Measures taken by the recipients. Each provider handles data under a contract (data processing terms) that limits use to providing its service to us and requires security measures. Anthropic's commercial terms state that it does not train its models on inputs and outputs of the API by default. Documents are encrypted at rest on our server.
6. Security measures
- Uploads are encrypted with a separate key per file (AES-256-GCM); deleting the key record makes a file unreadable.
- Encrypted connections (TLS) everywhere; the server accepts web traffic only through Cloudflare.
- Access to order pages requires the browser that created them, a signed-in email address, or the private link from your purchase email.
- Rate limits and spending limits protect against automated abuse.
- Understanding the external environment: data is stored and processed in the United States (see section 5).
7. Analytics and cookies
We use first-party cookies to keep your session and the link between your browser and your free check or order. We use PostHog for analytics with session recording and automatic click capture turned off; events contain only types and counts. You can block analytics in your browser without losing any function.
8. Your rights
You can ask us to disclose, correct, add to, delete, stop using, or stop providing to third parties your personal information, and to disclose records of third-party provision. Most deletions you can do yourself: "Delete my uploads" and "Delete everything about this order" on the order page, or "Delete my data" in your account. For other requests, email [email protected] from the address you used; we reply within 2 weeks. There is no fee.
9. Changes
We will announce material changes on this page with the date before they take effect.