株式会社bricks (the "Company") regards protecting the information entrusted to us by client companies and the tracking information of end users as an important responsibility in providing Lignal, our LINE conversion tracking service (the "Service"), and has established the following security policy.
1. Basic policy
- The Company positions information security as a foundation of its business and, under the responsibility of its representative, maintains the confidentiality, integrity, and availability of the information entrusted to it.
- The Company complies with applicable laws and regulations, including the Act on the Protection of Personal Information, as well as guidelines and contractual obligations.
- The Company regularly reviews the measures based on this policy and continues to improve them in response to changes in technology and threats.
2. Scope
This policy applies to the information assets involved in providing the Service (client companies' account and settings information, end users' tracking information, and the Service's systems and operating environment), and to the Company's officers, employees, and contractors.
3. Organization
- The Company appoints a person responsible for information security, who manages the implementation of the measures based on this policy.
- The Company provides training on information handling to its officers and employees and imposes confidentiality obligations on them.
- When the Company outsources the handling of information, it concludes a confidentiality agreement and requires the contractor to manage the information appropriately.
4. Specific measures
Protecting communications
Communications between the Service and your browser, client companies' websites, and integrated services are encrypted with TLS (SSL).
Protecting stored data
- The Service's data is stored in cloud databases with managed access permissions and is encrypted at rest.
- The main databases that store tracking data are located in a region in Japan.
- Credentials used for integrations with ad platforms and other services (such as access tokens) are encrypted by the application in addition to database encryption.
Access control
- Each client company's data is separated by workspace, and database features prevent access from other workspaces.
- Within a workspace, the operations available are limited according to the Owner, Admin, and Member roles, and users cannot change anyone to a role higher than their own.
- Access to data by the Company's operations staff is limited to what is necessary to provide, maintain, and troubleshoot the Service, and the reason is recorded for any process that bypasses normal permissions.
Protecting accounts
- Login uses email address verification (one-time password) or Google account authentication, and passwords, if set, must be at least 8 characters.
- Login, resending verification codes, and password resets are rate-limited, and measures are taken to prevent automated unauthorized access.
Minimizing the information we handle
- The Company sends integrated services only the event data needed for tracking, based on each client company's settings. The items sent are specified in Chapter 6 of the Privacy Policy.
- When an integrated service requires matching information such as email addresses, it is hashed (SHA-256) before being sent.
Retention and deletion
- User information is retained while the workspace exists, to the extent necessary to provide the Service.
- When a workspace is deleted or a valid deletion request is received, the relevant information, including in regular databases, caches, and backups, is deleted within 30 days of that event.
- Details are specified in Chapters 7 and 9 of the Privacy Policy.
Backups
Backups are used only to recover from failures, not for regular operations. If a recovery restores information past its deletion deadline, that information is deleted again.
Monitoring and detection
The Company continuously monitors its systems for errors and anomalies, and when tracking stops or an unexpected change is detected, the staff in charge are notified and check it.
Secure development and operations
- Changes to the Service go through review and automated testing before being released to production.
- Credentials and encryption keys are not included in program code and are managed with a dedicated system.
- The Company checks vulnerability information for the software components it uses and applies updates.
5. Responding to security incidents
When the Company becomes aware of an incident such as information leakage, tampering, loss, or unauthorized access, or the possibility of one, it takes the following actions.
- Confirming the facts and the scope of impact, and preventing further damage
- Promptly contacting affected client companies (at their registered email addresses)
- Reporting to the relevant authorities as required by law
- Analyzing the cause and implementing measures to prevent recurrence
6. Reporting vulnerabilities
If you find a security issue with the Service, please contact us at the address below. We ask that you refrain from disclosing what you reported until a fix is complete. When investigating, please do not access other customers' data, take actions that stop the Service or degrade its performance, or test systems other than the Service.
7. Review of this policy
The Company revises this policy as necessary. Important changes will be announced on this page.
8. Contact
- Company name
- 株式会社bricks
- Address
- 東京都新宿区新宿2-11-7 第33宮庭ビル412
- contact@bricks-inc.co.jp
Established: July 1, 2026
株式会社bricks, Representative Director 櫂谷弦輝