Privacy Policy
Last updated: Sep 1, 2026
CivilTech Ltd. ("we," "us," or "our") establishes this Privacy Policy for the handling of personal information and Google user data in the monthly AI reporting service for SEO and website acquisition, "Hakarun" (the "Service").
1. Information We Collect
The Service collects the following information:
- Account information: Google Account ID (sub), email address, and display name.
- Google Search Console data: search queries, pages, impressions, clicks, positions, countries, devices, and related data.
- Google Analytics 4 data: aggregate metrics such as users, sessions, acquisition sources, landing pages, and conversions.
- Authentication information: OAuth refresh tokens, stored in encrypted form.
- Usage information: Service operation logs and report viewing activity.
We obtain this information through Google OAuth 2.0 with your explicit permission and read-only access. We never receive your Google password.
2. Purposes of Use
- Analyzing SEO and website acquisition performance and creating monthly reports.
- Providing reports by email and through the web interface.
- Providing, maintaining, and improving the Service and responding to inquiries.
- Billing for paid plans.
3. Handling of Google User Data (Limited Use)
Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use the data only to provide user-facing reporting and analysis features.
- We do not sell the data or use it for advertising, credit assessment, user profiling, or purposes unrelated to the Service.
- Neither we nor our processors use the data for their own advertising. AI services are used on paid, billing-enabled terms under which prompts and outputs are not used for model improvement.
- Authorized personnel may access data only at your request or with your consent for support, or when required for security, incident investigation, or legal compliance.
- We do not disclose data to third parties without consent unless required by law. Processors handle only the minimum necessary data under our control.
4. Analysis Using AI (LLMs)
When Google Gemini is used to prepare a report, we send only the minimum information needed for analysis, such as aggregate metrics, search terms, and page URLs. We do not send Google Account IDs, names, email addresses, or OAuth tokens to the AI. We use the Gemini API as a paid, Cloud Billing-enabled service under terms that prevent submitted prompts and outputs from being used to train or improve Google's products or AI models, and we do not voluntarily opt in to data sharing. If AI is unavailable, the Service provides a rule-based numerical summary. AI output may contain errors and should not be the sole basis for important decisions.
5. Processors and External Services
We use the following services to operate the Service. Data is processed only within the stated purpose:
- Cloud infrastructure: Google Cloud (storage and processing).
- Email delivery: SAKURA internet Inc..
- AI analysis: Google Gemini (only the minimum information described above).
- Payments for paid plans: Stripe (we do not store card numbers).
We enter into appropriate data-protection agreements with processors, prohibit use for unrelated purposes, and supervise their safeguards. Processing may occur outside Japan.
6. Retention
- Detailed data: 12 to 24 months from collection, depending on the plan.
- Monthly aggregate data: retained long-term.
- Reports: retained during the subscription period.
- After cancellation or a deletion request: deleted within a reasonable period, except where retention is required by law or necessary to investigate misuse.
7. Security Measures
- HTTPS in transit and database encryption.
- Encrypted OAuth refresh tokens with separately managed encryption keys.
- Least-privilege access controls and operation logs.
- Time limits, visible indication, and audit logs for developer impersonation.
- Processor oversight and ongoing vulnerability and incident response.
8. Cookies and Access Logs
We use essential cookies to maintain login state and security. Disabling them may prevent login. We record access times, IP addresses, browser information, and similar data to prevent misuse, investigate failures, and improve the Service. We do not use this information for third-party advertising tracking.
9. Disconnecting, Deletion, and Your Rights
You may disconnect the Service at any time in Service settings or in your Google Account security settings. When disconnected, we revoke the tokens we hold. To request deletion, contact us below. After verifying your identity, we respond to requests for access, correction, suspension of use, and deletion in accordance with applicable law.
10. Security Incidents
If a personal-data incident occurs, we investigate its scope, contain it, and take measures to prevent recurrence. Where required by law, we notify the relevant authorities and affected users.
11. Contact
| Operator | CivilTech Ltd. |
|---|---|
| Address | Japan Hyogo Kakogawa |
| hakarun@civilteck.co.jp |
12. Changes
We may revise this Policy as necessary. We will provide notice through the Service when a material change is made.