Privacy Policy

Personal information for Acecore ID

Acecore ID is an account operated by 株式会社Acecore ("Acecore") and used to verify identity and authenticate access to eligible Acecore services. This section describes how we handle information used for Acecore ID registration, authentication, and security.

Data controller and request channel

The personal information controller for Acecore ID is 株式会社Acecore (representative: 西田凱).

To obtain the Company's address or make a request concerning notification of purpose of use, disclosure, correction, or suspension of use of retained personal data, submit a request through Acecore's contact form and state that it concerns Acecore ID personal information. After verifying the registered email address of the account concerned as necessary, we will respond without undue delay in accordance with applicable law.

We do not charge a fee. Do not submit information beyond what is necessary for identity verification, one-time codes, passkeys, or other secrets through the form.

Information we collect

We handle the following information for registration, authentication, and prevention of misuse.

• Email address, email-verification status, account identifier, version of the terms accepted, registration and update timestamps, and account status.
• Passkey credential data, including credential ID, public key, signature counter, and device or transport metadata. Biometric data itself is processed on your device or authenticator and is not collected by Acecore.
• Authentication and session security data, including access time, source IP address, browser or device information, and security or audit records.
• A one-way HMAC value used to verify a registration one-time code, delivery and attempt counts, expiry, and temporary passkey-enrollment data. We do not store a one-time code in plaintext.

Purposes of use

We use this information to create accounts; verify email addresses and passkeys; maintain authenticated sessions; respond to support, deletion, and other requests; investigate and prevent misuse or incidents; and comply with legal obligations.

We do not sell Acecore ID information or use it to target advertising to account holders.

Service providers and third-party disclosure

Acecore ID uses Cloudflare Workers, D1, Email Sending, Turnstile, rate limiting, and network-protection features as infrastructure for account delivery, email sending, misuse prevention, and secure delivery. Those service components handle information only to the extent necessary to provide those functions.

Except where required by law, with your consent, or necessary to protect life, body, or property, Acecore does not provide account information to third parties.

Retention and deletion

A registration one-time code cannot be used after five minutes, and a temporary passkey-enrollment grant cannot be used after fifteen minutes. These are security expiry periods and do not mean that stored records are physically deleted immediately.

We retain account information and security or audit records for as long as needed to provide the account, protect security, resolve disputes, or meet legal retention duties. After identity verification, we handle deletion requests within a reasonable scope, except for information that must be retained for legal or security reasons.

Security measures

We combine HTTPS transport protection, separated secret management, one-way HMAC processing of one-time codes, access control, expiry management, rate limiting, and bot protection to prevent unauthorized registration, authentication, and access. We will explain our safety measures to the extent that doing so does not impair system security when requested by the individual.

Requests for disclosure, correction, or suspension of use

For requests to disclose, correct, delete, or suspend the use of information held for Acecore ID, please contact us through our contact channel. After confirming that you are the individual or an authorized representative, we will respond in accordance with applicable law.