プライバシーポリシー / Privacy Policy

South Gate Inc. (株式会社South Gate; the "Company") establishes this Privacy Policy (the "Policy") as follows regarding the handling of users' personal information in Structa (the "Service"), a knowledge management service provided by the Company.

The Service collects the following information:

• Account information — If you sign in with a Google account, we obtain your email address, name, and profile image URL through OAuth authentication provided by Google (openid / email / profile scopes). If you sign in with a Microsoft account (a Microsoft Entra ID account of an organization the Company has approved), we obtain your email address, name, an identifier of your organization, and your user identifier through OpenID Connect (openid / profile / email scopes).
• Google Drive (optional) — Only if you choose to set up a backup to Google Drive, we obtain a permission that allows the Service to operate only on files it has created (drive.file scope). The Service only writes copies of your knowledge (create and update) into the folder you specify, and cannot read any of your other files. If you do not set this up, the Service does not access your Drive at all.
• External service integrations (optional) — Only if you or your organization set up an integration with Notion, Slack, Discord, Microsoft Teams, a ticketing tool, or similar services, we obtain the content imported from that service (such as pages and messages) and the credentials required for the integration. Imports are limited to the scope specified in the integration settings.
• Posted and imported content — The text and file contents registered or imported as knowledge (including content saved through an AI assistant) are stored in our database.
• Connection keys — We store the connection keys (API keys) the Company issues to connect the Service with AI assistants (such as Claude and ChatGPT) or external tools, together with records of their use.
• Payment information — Payments for paid plans are processed by Paddle, our Merchant of Record. The Company does not obtain or store credit card numbers. We receive information about your subscription and billing status from Paddle (such as your Paddle customer ID, plan, and billing status).
• Access logs and usage records — We may record IP addresses, operation logs, and records of feature use (such as processing times) for the purposes of improving the Service, responding to failures, and security.

The information we collect is used only for the following purposes:

• User authentication and account management
• Providing the functions of the Service, such as storing, searching, and displaying knowledge
• Organizing knowledge, including AI-based summarization, translation, and classification, and generating numerical representations (embeddings) for search
• Sharing knowledge within your organization, and sharing or publishing it to the extent you specify
• Managing subscriptions and billing for paid plans
• Improving service quality, responding to failures, and security measures
• Aggregating and analyzing usage (in a form that does not identify individuals)
• Sending important notices regarding the Service

The Service authenticates users using Google OAuth 2.0. Information obtained from Google APIs (email address, name, and profile image) is used only for signing in to the Service and identifying users, and is never used for marketing purposes or provided to third parties.

The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information obtained from Microsoft Entra ID (email address, name, and the identifiers of your organization and of you) is used only to verify your identity and to determine whether your organization is permitted to use the Service.

The Company will not provide users' personal information to third parties except in the following cases:

• With the user's consent
• When disclosure is required by law
• When all or part of our operations is outsourced as set out in Section 6

Content that you yourself share or publish (for example, by sharing it with members of your organization, issuing a share link, or setting it to public) is shown to the users within the scope specified by that action.

The Company may outsource all or part of the handling of personal information to external providers to the extent necessary to achieve the purposes of use. The main outsourced operations are the operation of cloud servers and databases, AI-based processing (summarization, translation, and generation of data for search), payment processing, and sending emails. When outsourcing, the Company selects providers that handle personal information appropriately and exercises necessary and appropriate supervision through contracts and other means.

Our providers include providers located outside Japan, such as in the United States and the United Kingdom. Outsourcing to these providers is carried out after establishing the system required under Japan's Act on the Protection of Personal Information (equivalent measures through contracts and other means). We will inform you of the providers and the details of these measures upon request.

For AI-based processing, we use business APIs whose terms provide that the content sent is not used to train AI models. Content sent may be retained by each provider for a limited period (in principle, up to 30 days) for abuse monitoring.

If you connect an AI assistant such as Claude or ChatGPT to the Service, the handling of content passed to that AI assistant is governed by the agreement between you (or your organization) and the provider of that AI assistant. Those providers are not processors of the Company.

User data is stored encrypted in Supabase (a PostgreSQL-based cloud database, Tokyo region). The Company takes appropriate technical and organizational measures to protect data from unauthorized access, leakage, and loss.

Users may request disclosure, correction, or deletion of their personal information held by the Company. To make a request, please contact us by email at the address below. We will respond within a reasonable period (in principle, within 30 days).

The Service uses cookies for sign-in processing, session management, and retaining language settings. On the payment screens for paid plans, cookies of our payment provider (Paddle) may be used. You can disable cookies in your browser settings, but some functions may not work properly.

This Policy may be revised as necessary. When we make important changes, we will notify you in advance through the Service. If you continue to use the Service after the revision, you shall be deemed to have agreed to the revised Policy.

For inquiries regarding this Policy, please contact:
South Gate Inc. (株式会社South Gate)
Email: support@structa.me
Service URL: https://structa.me