Privacy Policy

1. Who we are

ZeroKai is operated by Kenjin Labs LLC (Kenjin Labs合同会社), corporate number 2130003011137. The registered office is Private Booth 103, 23-7 Umetsu Nishiuramachi, Ukyo-ku, Kyoto 615-0917, Japan. In this policy, “we” and “us” mean that company.

This policy explains how we handle personal information when you use ZeroKai, create an account, or contact us. It is written to meet the Act on the Protection of Personal Information of Japan (個人情報保護法).

2. Information we collect

We collect what we need to run ZeroKai, to protect it, and to answer you.

Account: display name, email address, a one-way hash of your password (we do not store the password), language, organization name, role, and invitations.
Assessment: domain names you submit, records of whether control of a domain was verified, and the findings assembled from public sources. Findings can include host names, certificate data, registration data, and IP addresses. For a domain your organization has verified, they can also include service information already published by Shodan.
Contact form: your name, email address, organization, and message, and any job title, telephone number, domain, organization size, and inquiry type you choose to provide.
Technical: IP address, browser type, date and time, request identifiers, and security logs of actions such as sign-in, password reset, and starting an assessment. Google Analytics receives the page path, approximate location, device type, and the primary button actions described under Cookies. It does not receive a name, email address, password, the text of a contact message, or a domain submitted for assessment. Cloudflare Web Analytics receives the page address without its query string, the referring page, and timings for how fast the page loads and renders. Cloudflare shows us these visits by browser, operating system, device type, and country. Cloudflare receives the IP address with each request, but discards it at the nearest data center and does not store it in its core databases or logs.

Do not send passwords for other systems, API keys, session tokens, payment card numbers, government identification numbers, or personal information about another person. The form does not ask for them, and we do not want them.

3. Purposes of use

We use personal information for the following purposes. We do not use it for advertising, and we do not sell it.

To provide ZeroKai, including running an assessment and showing the result to the right organization.
To create and protect accounts, confirm email addresses, and verify control of a domain.
To send the messages the service requires: email confirmation, password reset, and organization invitations.
To answer product, support, privacy, and security messages.
To detect, prevent, and investigate abuse, fraud, and unauthorized access.
To keep the service reliable, and to understand how it is used in aggregated or de-identified form, including page views and primary button actions measured with Google Analytics, and page views and page-load speed measured with Cloudflare Web Analytics.
To comply with law, and to establish, exercise, or defend a legal claim.

If we need to use personal information for a purpose that is not compatible with this list, we will take the steps the Act requires before we do so. Where the Act requires notice or consent, we will give it.

4. Public sources

An assessment reads information that is already public: DNS, Certificate Transparency logs, domain registration data, network information, and, for a verified domain, Shodan. Registration data can include a registrant’s name or contact details. We show that data because the registry published it. We do not use a registrant’s contact details to market to them, and we do not contact the server being assessed.

Public data can be incomplete, outdated, or wrong. “Not covered” means we did not obtain that information, or the product does not perform that check. It does not mean the item is safe.

We do not sell personal information, and we do not provide it to a third party for that party’s own marketing.

Providers that host the application, database, stored evidence, and email, under our instructions. We supervise that entrustment.
Google LLC, for Google Analytics, under our instructions. It measures page views and primary actions: creating an account, signing in, starting from a domain on the site, sending a contact message, creating an organization, starting an assessment, adding a domain, and verifying control of a domain. We supervise that entrustment. We do not send a name, email address, password, the text of a contact message, or a domain submitted for assessment. We do not use it for advertising.
Cloudflare, Inc., for Cloudflare Web Analytics, under our instructions. It measures page views and how fast pages load and render. We supervise that entrustment. It does not store cookies or other data in your browser. We do not use it for advertising.
Public sources we query to produce an assessment. We send the domain name and, where needed, an IP address. We do not send your password or the text of a contact message. The sources include public DNS resolvers, Certificate Transparency services, domain registries (RDAP and JPRS), RIPEstat, publishers of cloud IP ranges, Shodan when a lookup is enabled, and vulnerability feeds from CISA, JVN (IPA), and NVD. Outbound requests identify ZeroKai and an operator contact address so a source can reach us.
Members of your organization, according to their role. A person who has not verified control of a domain sees a summary only.
A recipient required by law, a recipient needed to protect the rights, safety, or security of Kenjin Labs, our users, or another person, or a successor to the business. A successor is bound by this policy or an equivalent one.

6. Transfers outside Japan

Some of those providers and public sources are outside Japan. Measurement data from Google Analytics is processed by Google LLC in the United States. Measurement data from Cloudflare Web Analytics is processed by Cloudflare, Inc. in the United States, and may be processed at a Cloudflare data center outside Japan. Where the Act treats a transfer as providing personal data to a third party in a foreign country, we take the measures the Act requires. On request, we will tell you the country where we can reasonably identify it, and the information the Act requires about that country’s personal-information protection system.

An assessment query contains the domain or IP address being looked up. It does not contain your name or account email.

7. How long we keep information

We keep personal information only for as long as the purpose requires. We keep it longer only where the law requires it, or where a claim is reasonably in prospect.

Account and organization records: while the account is active, and for a limited time afterward so we can resolve a dispute, complete a security review, and meet a legal duty.
Assessment results: while the organization keeps them, and in backups for a limited time after deletion.
Cached responses from public sources: about 24 hours, then they are removed.
Contact messages: for as long as we need to handle the inquiry and to keep a record of what was said.
Security and audit logs: for as long as we need them to investigate abuse and to show what happened. An audit record the product writes is kept so it cannot be changed or deleted after the fact. We may refuse a deletion request for that record where the Act allows us to.

8. Security measures

We use measures appropriate to a multi-tenant security product.

Isolation of each organization’s data.
Password hashing, and session tokens stored only as hashes.
A check on every request, including a check that detailed results are shown only after domain control is verified.
Encrypted transport for production access, protection against cross-site requests, and rate limits.
An audit log of security-relevant actions, and operational access limited to what is needed to run the service.

No method of storage or transmission is perfectly secure. We do not claim a certification we do not hold.

9. Your requests

You may request disclosure, correction, addition, deletion, cessation of use, or cessation of third-party provision, and you may ask about the purposes of use, as the Act provides.

Use the contact form and choose Privacy request. We may ask you to confirm that you are the person concerned, or a lawful representative, before we act. We may decline a request where the Act allows it, for example where disclosure would harm another person’s life, body, property, or other rights, or would seriously interfere with the proper conduct of our business, including the security of the service. If we decline, we will explain the reason unless the Act allows us not to.

You may also complain to the Personal Information Protection Commission (個人情報保護委員会).

10. Cookies

We use cookies the service needs for sign-in, for safe actions, and for language. We do not use advertising cookies.

We use Google Analytics, provided by Google LLC, to understand how the site is used. It measures page views and primary button actions: creating an account, signing in, starting from a domain on the site, sending a contact message, creating an organization, starting an assessment, adding a domain, and verifying control of a domain. We do not send a name, email address, password, the text of a contact message, or a domain submitted for assessment.

We also use Cloudflare Web Analytics, provided by Cloudflare, Inc., to measure page views and how fast pages load. It sets no cookies and does not use local storage or other storage in your browser. According to Cloudflare, it does not fingerprint visitors by IP address, user agent, or other data. We have set it to exclude visits that connect through Cloudflare data centers in the European Economic Area, the United Kingdom, and Switzerland.

zk_session keeps you signed in. It lasts up to seven days, and page scripts cannot read it.
zk_csrf protects signed-in actions against cross-site requests. It lasts for the same period, and the site can read it so it can send the check.
zk_locale remembers Japanese or English for one year.
zk_staff_session and zk_staff_csrf are used only for Kenjin Labs operator sign-in. They are not set for ordinary visitors.
_ga and _ga_HRGHYCZQN4 are set by Google Analytics and can last up to two years. They measure page views and the primary actions described above. They are not used to serve ads or to identify you for advertising.

You can block cookies in your browser. If you block the sign-in cookies, sign-in will not work. The language cookie is a preference. The service still works if you refuse it, and the language then follows the default, which is Japanese. Blocking the Google Analytics cookies does not affect use of the service.

11. Children

ZeroKai is a service for businesses. It is not directed at children. We do not knowingly register anyone under 18. If you believe we have, contact us and we will delete the account.

12. Changes

We may update this policy. The new version will be posted on this page with a new effective date. If a change would use personal information for a purpose that is not compatible with the purposes above, we will take the steps the Act requires before we do so.

13. How to reach us

Send a privacy request through the contact form on this website. Choose Privacy request.

Kenjin Labs LLC (Kenjin Labs合同会社). Corporate number 2130003011137. Registered office: Private Booth 103, 23-7 Umetsu Nishiuramachi, Ukyo-ku, Kyoto 615-0917, Japan. https://kenjinlabs.com/