DPA (Data Processing Agreement) & Subprocessors
Last updated: 2026-07-02
For corporate customers, this page provides standing information on executing a data processing agreement (DPA), the list of subprocessors, and our notification policy for changes. For the overall data flow and safeguards, see the Security page.
What the DPA is
In this Service, you (the customer) are the controller of personal data such as daily reports, and we handle the data on your instructions. The DPA puts the terms of this handling into a contract, for corporate customers whose internal rules or audits require a written agreement.
Our DPA mainly covers the following.
- Purpose and scope of processing (limited to what is necessary to provide the Service)
- Confidentiality and supervision of personnel
- Security measures (encryption, access control, the up-to-24-hour temporary-retention design)
- Use of subprocessors and notification of changes
- Deletion and return of data (on termination or request)
- Notification in case of an incident
- Reasonable cooperation with audits and inquiries
Requesting a DPA
If you wish to execute a DPA, please contact us at the address below. We will send you our template for review and execution. Execution on your own form can also be discussed.
Contact：株式会社狼煙 (Norolu)（kakehashi@norolu.jp）
Subprocessors
The following are the processors to which this Service entrusts the handling of personal data (the same single source as the Security page). The governing law is Japanese law.
| Subprocessor | Purpose | Location / region | Data handled |
|---|---|---|---|
| Google LLC | Report storage (Sheets) and Google sign-in (OAuth) | United States and others (stored in your Google Drive) | Report text; sign-in email address |
| Anthropic, PBC | Generative-AI processing (AI assist, weekly review, alignment report) | United States | Report text sent when AI features are used (optional) |
| Vercel Inc. | Hosting and delivery (Functions); analytics | Tokyo region (Japan) | Transient processing data; aggregate, non-identifying analytics |
| Upstash, Inc. | Temporary retention of source data via KV (≤24h) | Tokyo region (Japan) | Transient draft data |
| Polar Software Inc. | Sales and payment (Merchant of Record) | Outside Japan (payment provider) | Payment data (processed by Polar; not retained by us) |
Notification policy for subprocessor changes
When we add or change a subprocessor, we will update this page in advance. Customers with an executed DPA will, as a rule, also be notified by email at least 30 days in advance.
Related pages
The Japanese version of this page prevails; in case of any discrepancy with a translation, the Japanese version governs.