Ukebaco

1. Scope and provider

This notice applies to Ukebaco (ukeba.co). Ukebaco is provided by 7thcode, a trade name. This notice supplements the general 7thcode Privacy Policy; where they differ, this notice applies. Seller details are on the legal notice page.

Ukebaco has two kinds of users: owners, who create links and receive files, and submitters, who send files through those links. The owner is the party collecting names, email addresses and other details on a submission page, and states the purpose there. Ukebaco processes that information on the owner's behalf.

2. Information Ukebaco accesses

Owners. When you sign in with Google, Ukebaco receives the email address and identifier of your Google account. Access to Google Drive is limited to the drive.file scope: only folders Ukebaco created or you picked, and their contents. It never reads your whole Drive. It creates a Google Sheets ledger and appends rows to it.

Submitters. Ukebaco receives the fields entered on the submission page (company, name and others the owner defined), the name, size and type of the files sent, and, where the owner has enabled them, the result of email verification and the time of consent. File contents go from the browser straight to the owner's Google Drive and are not stored on Ukebaco's servers.

Access logs. Server logs including IP address, browser type and time of access are kept briefly to prevent abuse and investigate errors.

3. Information Ukebaco stores

Ukebaco stores accounts (email address, encrypted refresh token, plan, payment-provider customer ID, display language, personal-information settings), link definitions (name, fields, destination folder ID, hashed PIN, deadline), submission records (entered field values, file names, destination, receipt number, time of consent), email-verification records and monthly usage.

Refresh tokens are encrypted with Cloud KMS; disabling the key makes every stored token unreadable at once. Card details are handled by the payment provider (Stripe) and never held by Ukebaco.

4. Purpose

Information is used only to provide the requested functionality (creating links, receiving and storing files, keeping the ledger, sending receipt emails), to show who created a page and so prevent impersonation, to prevent abuse, to bill paid plans, and to meet legal obligations. End-user information is not sold, disclosed to data brokers or used for targeted advertising.

5. Providers and data location

Ukebaco runs on Google Cloud (Firebase App Hosting, Cloud Firestore, Cloud KMS) with data stored in the Taiwan region (asia-east1). Files and ledgers live in the owner's own Google Drive, under Google's terms and storage locations.

The following providers process limited information as needed to deliver the service:

• Google LLC — hosting, database, key management, the Google Drive and Google Sheets APIs, and sign-in (OAuth)
• Stripe, Inc. — payments for paid plans, invoices and receipts
• Resend — email delivery for verification codes, receipts and plan notices
• Cloudflare, Inc. — DNS and the www.ukeba.co redirect

These providers may process data in locations permitted by their terms and applicable law.

6. External transmission (Google Analytics)

As required by Japan's Telecommunications Business Act rules on external transmission, this section discloses information sent from your device to a third party.

• Recipient: Google LLC (Google Analytics 4)
• Pages: the public pages of ukeba.co (home, FAQ, legal notice, sign-in) and the owner dashboard. Submission pages (ukeba.co/s/…) and their previews do not send anything
• Information sent: the URL and title of the page viewed, the referrer, browser, OS and screen information, approximate region, and identifiers stored in cookies (such as _ga). Names and email addresses are not sent
• Purpose: understanding usage and improving the service
• Google's use: see how Google uses information from sites that use its services
• How to stop it: use the Google Analytics opt-out add-on or disable cookies in your browser. The service works the same either way

Separately, file uploads go directly from the submitter's browser to Google Drive. That transmission is necessary to provide the feature the submitter asked for.

7. Retention and deletion

Submission records are deleted automatically 90 days after receipt (the files and the ledger remain in the owner's Google Drive). Email-verification records are deleted 24 hours after they expire. Accounts and link definitions are kept while the owner keeps using the service.

Owners can revoke Ukebaco's access at any time from Google account permissions, after which Ukebaco can no longer reach Drive. To delete an account, contact support.

8. Individual rights and requests

Depending on your location, you may have rights to access, correct, delete, restrict or object to processing of personal information. Submitters should contact the recipient shown on the submission page first, since the recipient is the party collecting the information. Owners, and anyone asking about Ukebaco's own processing, can write to the address below, naming the link or receipt number concerned. Do not include credentials or file contents in the first message.

9. Security and changes

See the 7thcode Security Policy for private vulnerability reporting. Material changes to this notice will be published at this URL with an updated effective date. A change that introduces a new external transmission, data category or processor will be reviewed before release and communicated where required.