This Privacy Policy explains how Hoqo, operated by Ryoya Kubo, a sole proprietor based in Japan ("Hoqo", "we", "us"), collects and uses personal information when you visit our website, request a free check, or work with us.
1. Information we collect
- Information you give us: your name, work email, company website, details about your AI agent, the languages it supports, and anything else you write in our forms or emails.
- Information shared during an engagement: test accounts, system details, conversation logs and similar data needed to test your AI agent. This is also covered by your Order and any NDA.
- Website usage data: pages visited, referring site, device and browser type, and approximate country, collected without cookies by Cloudflare Web Analytics.
Please do not send us passwords, API keys or customer data through our website forms. We agree on a safe way to share test access once the scope is confirmed.
2. How we use it
- To reply to your request and agree on the scope of testing.
- To perform the services, prepare reports and run retests.
- To send invoices and meet our legal and tax obligations.
- To keep our website working and understand how it is used.
We do not sell your personal information.
3. Personal information about your customers
Testing an AI agent can bring us into contact with personal information about your customers, such as names or email addresses that appear in test conversations. We protect it in the same way as your own information, and more strictly:
- We ask for test accounts and test data wherever possible, so real customer data is not needed.
- We use any customer personal information we see only to confirm and report a finding, and never for any other purpose.
- We remove it before sending anything to an AI provider, and mask it in reports, for example
j••••@•••••.com. - We delete it within 30 days after the engagement ends, and we never keep it in the attack techniques or anonymized results we retain.
4. Legal bases
Where the EU or UK GDPR applies, we process personal information to take steps at your request before entering into a contract and to perform that contract, for our legitimate interests in running and improving our business, and to comply with legal obligations.
5. Who we share it with
- Service providers that help us operate: email and workspace, website hosting and forms, email delivery, payments (Stripe; Hoqo does not receive or store your card details), and the AI model providers we use for testing. The AI providers are named on our Security & data handling page.
- Native-speaking partners, bound by a confidentiality agreement, when an engagement needs testing in a language they cover. They receive only what they need for that work.
- Authorities, when required by law.
Our service providers may use personal information only to provide their services to us. We share only what each of them needs, and we do not allow them to use it for their own purposes, including training AI models.
6. International transfers
Hoqo is based in Japan, and our service providers may process information in other countries. When we transfer personal information across borders, we take the steps required by Japan's Act on the Protection of Personal Information and, where applicable, the GDPR, such as standard contractual clauses.
7. How long we keep it
- Requests that do not lead to an engagement: up to 12 months.
- Data you share during an engagement, such as test accounts, logs and screenshots: deleted within 30 days after the engagement ends (after the final retest for Scan plans, or after cancellation for Guard plans), unless we agree otherwise.
- Attack techniques we develop, and results with anything that identifies you, your systems or your users removed: kept to improve our testing.
- Invoices and accounting records: as long as Japanese tax law requires.
8. Security
We use reasonable technical and organizational measures to protect personal information, such as full-disk encryption, two-factor authentication on all accounts, an encrypted password manager, and limiting access to the people who need it.
9. Your rights
Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict how we use it, to receive a copy of it, and to withdraw consent. To make a request, email hello@hoqo.ai. You can also complain to your local data protection authority or, in Japan, to the Personal Information Protection Commission.
10. Cookies
We do not use cookies for advertising or tracking. We measure visits with Cloudflare Web Analytics, which does not use cookies or collect personal identifiers. To protect our forms from spam, we use Cloudflare Turnstile.
11. Children
Our services are for businesses and are not directed at children.
12. Changes to this policy
We may update this policy from time to time. The effective date at the top shows when it last changed.
13. Contact
Ryoya Kubo (Hoqo)
1-8-23 Akasaka, Chuo-ku, Fukuoka 810-0042, Japan
hello@hoqo.ai
END OF PRIVACY POLICY