Privacy policy

Effective date: 1 December 2026

This policy explains how Alpha-War G.K. ("Alpha-War", "we", "us") handles personal information when you visit idcc.center or use the IDCC training platform (together, the "Service"). It is written to meet Japan's Act on the Protection of Personal Information (APPI), the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA). If the Japanese and English versions differ, the Japanese version governs.

Summary

• We collect what we need to run your account, your training and your billing. We do not sell or share personal information for advertising, and we do not use advertising or analytics trackers.
• Your data is stored with Amazon Web Services in the Tokyo region. Payments are handled by Square; we never see or store your full card number.
• You can see, correct, download or delete your data, and you can object to some uses. Contact privacy@idcc.center.

1. Who is responsible

The controller (APPI: 個人情報取扱事業者) is Alpha-War G.K. (Ａｌｐｈａ－Ｗａｒ合同会社), 4-20-10 Shodo, Sakae-ku, Yokohama, Kanagawa 247-0022, Japan, represented by its representative partner Keiko Knox. Privacy contact: privacy@idcc.center.

We do not currently offer the Service to people in the EU or UK, so we have not appointed a representative there. If that changes, we will appoint one and update this policy. We have not appointed a data protection officer because we are not required to.

When a company buys team seats, the company decides which employees to enroll and can see their progress (section 5). For that team-administration data, the company is also responsible for its own employees' information under its own policies.

2. What we collect, why, and on what legal basis

To measure and improve the Service, we also turn data into anonymized statistics (for example, average quiz scores or how many learners finish a track) that no longer identify anyone.

Giving us your email and completing MFA set-up are necessary to open an account; without them we cannot provide the Service. Everything else is optional or generated by your use of the Service.

We do not collect special categories of data (GDPR Art. 9) or APPI "special care-required" information (要配慮個人情報), and we ask you not to send them to us.

3. Automated decisions

Quizzes and exams are scored automatically against fixed answer keys, and passing scores award belts and certifications. During exams, AI proctoring software watches the webcam, microphone and screen and flags possible rule breaks. A flag never decides anything by itself: a member of our staff reviews it before any result is withheld. We do not use your data for profiling or for any decision with legal or similarly significant effects other than this scoring. You may ask a person at Alpha-War to review any score; write to privacy@idcc.center. Our daily vulnerability brief is summarized with an AI model using only public vulnerability data. The AI consultation answers the questions you send it; it makes no decisions about you. Please don't send it other people's personal information or any secrets.

4. Cookies and similar technologies

• Sign-in tokens are kept in your browser's session storage and erased when you close the tab.
• Language preference is kept in your browser's local storage.
• Our sign-in page (Amazon Cognito) and Square's payment form set strictly necessary cookies for security and fraud prevention.

We do not use analytics, advertising or cross-site tracking cookies, so there is nothing to opt out of. If we ever add them, we will ask for consent first where the law requires it.

5. Who we share data with

We do not sell personal information and do not "share" it for cross-context behavioral advertising, as the CCPA defines those terms, and have not done so in the past 12 months. We disclose it only to:

• Service providers and processors that work for us under contract and may use it only to provide their service:
  • Amazon Web Services (Amazon Web Services Japan G.K. / Amazon Web Services, Inc.): hosting, database, sign-in (Cognito), email (SES), and AI summarization and consultations (Bedrock, running Anthropic's Claude model), in the Tokyo region (ap-northeast-1) or, for AI processing, Japanese regions. Categories: all categories in section 2 except card details.
  • Square (Square, Inc. / Block, Inc. and its Japanese affiliate): payments, subscriptions and invoices. Categories: email, customer ID, billing records, card details.
• Public threat-intelligence sources. The alerts and Command Post show data we download from abuse.ch Feodo Tracker, JPCERT/CC, CISA, NVD, JVN iPedia and FIRST EPSS. We send these sources no personal information.
• Your company's team administrator, if you joined through a team plan: your email, join date, course progress, belts and certification results.
• Authorities or other parties when the law requires it, to protect rights and safety, or as part of a merger or sale of the business, subject to this policy.

6. International transfers

We store data in Japan. The European Commission and the UK have recognized Japan as providing adequate protection for personal data transferred under the APPI framework.

Square and AWS are headquartered in the United States and may process some data there. The United States has no single national privacy law; protection comes from sector and state laws (such as the CCPA) and the companies' contracts. Where data leaves Japan, we rely on contracts that require protection equivalent to the APPI and, for GDPR data, on the EU-U.S. Data Privacy Framework where the recipient is certified or on the European Commission's Standard Contractual Clauses. You can ask us for details of these safeguards.

7. How we protect data

• Every account must use multi-factor authentication.
• Data is encrypted in transit (TLS) and at rest, and each part of the system has only the access it needs.
• Card data never reaches our servers. Payment webhooks are signature-checked.
• Lab environments are isolated, have no access to our other systems, and are deleted when they stop.
• Only authorized staff can access personal data, and they are bound by confidentiality.
• We review our exposure to the laws of the countries where our providers process data (APPI 外的環境の把握).

If a breach is likely to harm you, we will notify you and the relevant authorities as the law requires.

8. Your rights

Everyone, wherever you live, can ask us to:

• tell you what personal information we hold about you and give you a copy, including in a portable, machine-readable format;
• correct it;
• delete it, or stop or restrict using it;
• stop sending you the daily brief or other email (also possible in your account settings);
• explain how we disclose it to third parties, including the records of such disclosures (APPI).

EU and UK residents also have the right to object to processing based on legitimate interests, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority. You can also complain in Japan to the Personal Information Protection Commission.

California residents have the right to know (the categories and specific pieces of personal information we collected, the sources, the purposes and the recipients), to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. We collect one kind of sensitive personal information as the CCPA defines it: account sign-in credentials. We use them only to sign you in and keep your account secure, so the right to limit does not change how we use them. We will not discriminate against you for exercising any right. We honor Global Privacy Control (GPC) browser signals as an opt-out of sale and sharing, without requiring you to sign in. We do not offer financial incentives for personal information.

How to make a request. Email privacy@idcc.center from the address on your account. (You can also turn the daily brief on or off yourself in your account settings.) We verify your identity by confirming control of that email address and, for deletion or sensitive requests, your MFA sign-in. You may use an authorized agent; we will ask for your signed permission and may ask you to verify your identity directly. We respond within one month under the GDPR (extendable by two months for complex requests), within 45 days under the CCPA (extendable once by 45 days), and without delay under the APPI. Requests are free; we may refuse or charge a reasonable fee only for clearly unfounded or excessive requests where the law allows.

9. Children

The Service is for professionals and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

10. Changes to this policy

We review this policy at least once a year. If we make a material change, we will post it here with a new date and tell account holders by email before it takes effect.

11. Contact and complaints

Alpha-War G.K., 4-20-10 Shodo, Sakae-ku, Yokohama, Kanagawa 247-0022, Japan · privacy@idcc.center. We will answer complaints about how we handle personal information promptly and in good faith.