Privacy Policy

1. Operator

HEDELL GROUP LTD.
Address: 222 Broadway, New York, NY 10038, United States
Website: https://hedellgroup.com/
Email: info@hedellgroup.com

In this Policy, “the Company” refers to HEDELL GROUP LTD., and “the Service” refers to the social networking service Track Record operated by the Company.

2. Information We Collect

2.1 Information you provide directly

• Name (Japanese characters and romanized)
• Email address
• Date of birth
• Phone number
• Password (hashed)
• Affiliated organization (optional)
• Content you post or record on the Service (text, images, etc.)
• Testimonials you write about other users
• Search anchor URLs (public SNS, personal sites, etc.)

2.2 Information collected automatically

• IP address
• Browser, OS, and device type
• Access timestamps and activity logs
• Cookies and similar technologies
• Session tokens

2.3 Information from third parties

• Authentication and partial profile information when you use OAuth (Meta / Facebook, etc.)
• Public information from sources you designate (your SNS, company sites, etc.) used as input for OSINTO

3. Purposes of Use

We use the collected information for the following purposes:

• Providing, operating, and improving the Service
• Identity verification and account management
• Notifying users (email and in-service notifications)
• Responding to inquiries about the Service
• Generating OSINTO public profile summaries
• Preventing fraud and ensuring security
• Creating statistics and analyzing usage trends
• Responding to legal or governmental requests

4. Disclosure to Third Parties

We do not disclose your personal information to third parties except in the following cases:

• With your consent
• Where required by law (court orders, formal requests from investigative authorities, etc.)
• Where necessary to protect a person's life, body, or property, and consent cannot be reasonably obtained
• Where reasonably necessary to share with service providers (infrastructure, AI providers, etc.) for the operation of the Service

5. Service Providers

We use the following providers to process personal data, with their respective locations:

6. Cross-Border Data Transfer (Important)

The Service's databases and hosting are located in the United States. Personal data collected from users outside the United States is stored and processed in the U.S. (primarily Northern Virginia) as part of the Service's operation.

The legal regime in the United States may provide a different level of privacy protection from that of your country of residence. In particular, the U.S. Cloud Act and other laws may allow U.S. authorities to request the disclosure of data.

By consenting to cross-border data transfer at registration, you acknowledge the above and use the Service on that basis. If you wish to withdraw consent, please delete your account.

7. Cookies and Tracking

We use cookies and similar technologies to maintain sessions and improve user experience.

• Essential cookies: used to maintain authentication sessions.
• Analytics cookies: we may use Vercel Analytics or similar for usage analysis.

You may disable cookies through your browser settings; in that case some functions of the Service may not work.

8. Your Rights

You have the following rights regarding your personal information:

• Right of access (confirm what we hold about you)
• Right to correction, addition, or deletion
• Right to stop use or stop transfer to third parties
• Right to data portability (export in machine-readable formats such as CSV)
• EU residents: rights under the GDPR (right to be forgotten, data portability, objection to automated decision-making, etc.)
• California residents: rights under CCPA / CPRA (right to opt out of sale, right to deletion, etc.)

To exercise these rights, please contact our dedicated data protection address info@hedellgroup.com (or info@hedellgroup.com). After verifying your identity, we will respond within 30 days as a rule (GDPR-covered subjects: within 30 days, extendable to 60 days for complex requests).

* EU/UK residents may file a complaint with their local Data Protection Authority if dissatisfied with our response. * California residents may exercise CCPA rights themselves or through an authorized agent. We will not discriminate against you for exercising your rights.

9. Public Profile

If you turn on “Public profile” within the Service, your name, affiliation, AI-generated profile, and some of your public activity become viewable by anyone on the internet.

The content of restricted projects is never reflected in your public profile.

10. Retention

• Active account information: retained while the account exists
• Personal information after deletion: removed within 30 days of account deletion (with up to 90 days for complete removal from backups)
• Information we are required by law to retain, or that is necessary for dispute resolution, may be retained for the necessary period.

11. Security

We take reasonable safeguards to prevent leakage, loss, or damage of personal information.

• Passwords are hashed before storage
• Communication is encrypted with HTTPS
• Database access control, including Row Level Security
• Periodic security reviews

However, complete security cannot be guaranteed over the internet or in electronic storage.

12. Minors

The Service does not permit use by anyone under 13 (compliant with COPPA). Users under 18 should use the Service with parental consent. If we become aware that a user is under 13, we will delete that account immediately.

13. Changes to this Policy

We may revise this Policy as needed. Material changes will be announced within the Service or by email.

14. Contact

For questions about this Policy or our handling of personal information, please contact:

HEDELL GROUP LTD.
222 Broadway, New York, NY 10038
Website: https://hedellgroup.com/
Email: info@hedellgroup.com