Privacy Policy & Personal Data Protection
Open Knowledge Inc. protects personal information and confidential client records in strict compliance with Japan's Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, as amended), EU GDPR principles, and our Cookieless Zero-Tracking Web Architecture.
1. Three Core Privacy Commitments in Plain Language
Zero Third-Party Tracking Cookies
ok.st does not install advertising pixels, cross-site behavioral trackers, or third-party analytics cookies. Interactive diagnostic tools run 100% locally inside your browser.
Strict AI Data Isolation
Inquiries, security audit reports, and client documents are never used to train public generative AI models and are never sold or disclosed to third-party data brokers.
Physical & Row-Level Isolation
Records and 3-second 1-tap sign-in accounts (Passkey / Google / LINE / Magic Link) are isolated per user via PostgreSQL 19 FORCE ROW LEVEL SECURITY on private-vLAN db01.ok.st under Registered Information Security Specialist (No. 007617) oversight.
2. Purposes of Use, Non-Disclosure to Third Parties & Data Retention
2.1 Specified Purposes of Use (APPI Article 17)
- Responding to inquiries, technical consultations, and requests for quotation submitted via email or contact channels.
- Delivering contracted cybersecurity audits, METI SCS readiness support, cloud engineering, educational services, and event operational support.
- Issuing statutory accounting documents, contracts, and security attestation certificates.
2.2 Prohibition of Unauthorized Third-Party Provision (APPI Article 27)
Open Knowledge Inc. shall not provide personal data to any third party without obtaining the prior consent of the individual, except where explicitly required by Japanese statute (such as judicial warrants or protection of human life).
3. Statutory Security Control Measures (APPI Article 23) & Data Subject Rights
| APPI Article 23 Control Category | Implementation at Open Knowledge Inc. |
|---|---|
| Organizational & Human Controls | Direct supervision by Registered Information Security Specialist, statutory confidentiality obligations, and role-based access governance. |
| Physical & Technical Controls | FIDO2 hardware passkeys, Google Workspace Business Plus Context-Aware Access, private-vLAN database isolation (db01.ok.st), and TLS 1.3 encryption. |
| Disclosure, Correction & Deletion (APPI Articles 33–35) | Individuals may request disclosure, correction, addition, deletion, or suspension of use of their retained personal data by contacting e@ok.st. |
4. Technical Proof of Zero-Cookie & Zero-Tracker Execution
Anyone can verify that https://ok.st/ sets zero HTTP Set-Cookie headers and loads zero third-party tracking domains by inspecting the HTTP response headers directly:
{`# Verify zero Set-Cookie headers on ok.st
curl -sI https://ok.st/en/ | grep -i "set-cookie" || echo "VERIFIED: 0 Set-Cookie headers emitted"
# Verify Reading Comfort preferences use strictly local browser storage (never transmitted over network)
# Key: localStorage.getItem('ok-reading-comfort-v1') -> stays 100% inside client UA`}