Privacy Policy

1. Introduction

Off-Nadir Delta ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

Business Operator Information and Personal Information Protection Manager: For details about our business operator and representative (who also serves as the Personal Information Protection Manager), please see our Specified Commercial Transactions Act page.

Contact for Privacy Inquiries: support@offnadir-lab.com

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us:

• Email address (for account creation and authentication)
• Payment information (processed securely through Stripe)
• Profile information (display name, optional)

  ℹ️ About Display Names:

  • Setting a display name is entirely optional
  • Your display name is used in your profile and may be visible in collaborative features
  • Privacy Tip: We recommend using a pseudonym rather than your real name to protect your privacy
  • You can change or remove your display name at any time in your profile settings

2.2 Usage Information

We automatically collect certain information about your use of our service:

• Token usage and consumption patterns
• Map interactions and layer management activities
• Search queries and satellite imagery requests
• Browser type, device information, and IP address
• Access times and referring website addresses

2.3 Cookies and Tracking

We use authentication cookies to maintain your session and provide core functionality. We also use Vercel Speed Insights for performance monitoring and Google Analytics 4 to understand how the service is used (pages viewed, referring source, and in-app events such as starting an analysis). Google Analytics sets its own cookies and receives your IP address and device/browser information; its use of that data is governed by the Google Privacy Policy. You can block these cookies with your browser settings or an ad/tracking blocker without losing access to the service.

Cookie Consent: By creating an account and agreeing to our Terms of Service, you consent to our use of cookies and tracking technologies as described in this policy. Essential cookies required for authentication and core functionality are automatically enabled when you use our service.

2.4 Abuse and Bot Protection

To protect sign-up and login against automated abuse we rely on our own controls rather than a third-party CAPTCHA: failed login attempts are counted and an account is temporarily locked after repeated failures, requests to our APIs are rate limited, and email confirmation is required at sign-up. These controls process your email address, IP address, and request timestamps.

We do not embed a CAPTCHA service on our sign-up or login pages, so no CAPTCHA provider receives your device data through us.

2.5 AI Assistant Conversations

Our service includes an AI assistant (the "Delta Agent"). When you use it, we store your questions (inputs), the AI-generated responses (outputs), and any optional 👍/👎 feedback you give, as your conversation history. See Section 14 for how this data is used, reviewed, processed, and retained.

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide, maintain, and improve our services
• Process your transactions and manage your subscription
• Send you technical notices, updates, and support messages
• Monitor usage patterns to optimize service performance
• Detect, prevent, and address technical issues and fraud
• Comply with legal obligations
• Marketing Communications (Optional): If you opt in during registration or in your account settings, we may send you newsletters containing product updates, usage tips, and feature announcements. You can unsubscribe at any time via the link in each email or through your account settings.

In particular, we may analyze usage data (such as token usage, map interactions, and satellite imagery requests) to understand how the Service is used and to improve and develop features. Where reasonably possible, we aggregate or de-identify such usage data so that it can no longer be reasonably linked to an identified or identifiable individual. Aggregated or de-identified usage data may be used to generate usage statistics and reports, which we may publish or make available on a commercial basis. These statistics and reports do not identify individual users.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in these circumstances:

4.1 Third-Party Service Providers in Foreign Countries

We use third-party service providers located in foreign countries to operate our service:

4.2 Other Disclosures

• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit and at rest
• Database-level security policies (Row Level Security)
• Regular security audits and updates
• Secure authentication mechanisms

6. Data Retention

We retain your personal information as follows:

• Active account data: Retained while your account is active
• After account deletion: Completely removed within 30 days
• Legally required records: Retained for up to 7 years as required by applicable laws

You may request account deletion at any time by contacting support.

7. Your Rights Regarding Personal Data

7.1 Rights You Can Exercise

You have the right to:

• Request notification of the purpose of use
• Access and receive a copy of your personal data
• Correct inaccurate or incomplete data
• Request deletion of your account and data
• Request suspension of use or provision to third parties
• Data portability

7.2 How to Make a Request

8. Third-Party Services

Our service integrates with third-party providers for:

• Authentication and database services
• Payment processing
• Cloud infrastructure and serverless computing
• Satellite imagery data access (Copernicus/ESA)

These third parties have their own privacy policies governing the use of your information. For details about data transfers to foreign service providers, see Section 4.1 above.

9. Satellite Data Access Transparency

We are committed to transparent and license-compliant access to satellite imagery data. Here is how we handle satellite data requests:

9.1 Data Sources

• Copernicus Sentinel Data: Accessed via AWS Earth Search and Microsoft Planetary Computer public STAC APIs
• NASA Black Marble (VNP46A2): Nighttime lights data accessed via NASA Earthdata CMR API
• License: Copernicus Sentinel data is provided under the Copernicus Sentinel Data License (free, full, and open access). NASA data is in the public domain as U.S. government work.

9.2 Technical Implementation

9.3 Your Data Downloads

When you download or export satellite-derived data from our service, we ensure that:

• Downloaded files do not contain any provider access tokens or signed URLs
• Appropriate license and attribution information is included with exports
• Your use of downloaded data is subject to the original data provider licenses

10. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice on our service. Continued use after changes constitutes acceptance.

12. Complaints and Inquiries

12.1 Contact Information

If you have questions or concerns about this Privacy Policy or our handling of personal information, please contact us at:

12.2 External Consultation

We are not a member of any certified personal information protection organization. You may also consult with the Personal Information Protection Commission:

https://www.ppc.go.jp/

13. Anonymous and Pseudonymous Data

We may create aggregated or de-identified usage statistics that are not reasonably capable of identifying you. Such data is not treated as personal information. We do not create or use pseudonymized data.

14. AI Assistant (Delta Agent)

Our AI assistant lets you ask questions in natural language and returns an analysis based on public open-source news signals. This section explains how we handle the conversations you have with it.

14.1 What We Store

• Your questions (the text you send to the assistant)
• The assistant's responses generated for you
• Any optional 👍/👎 rating and short reason you choose to give on an answer

14.2 Why We Use It (Purposes)

We use your conversations only for these specific purposes:

• To provide the assistant and let you view and continue your conversation history
• To improve the quality of the assistant and identify problems, gaps, and recurring issues
• To detect and prevent abuse and keep the service safe and reliable

We do not use your conversations for advertising, and we do not sell them. For users in the EU/UK, our legal basis for the above is our legitimate interests in providing, securing, and improving the service.

14.3 Human Review

To assess quality and troubleshoot problems, authorized personnel may review individual conversations. Access is limited to those who need it, and where we analyse conversations we first remove or mask direct identifiers (such as email addresses) so the review is not tied to your account details.

14.4 Third-Party AI Processing & Model Training

Conversations are processed by a third-party AI infrastructure provider located in the United States under a data processing agreement (see Section 4.1). Your conversations are not used to train that provider's AI models, and we do not use your conversations to train any AI models.

14.5 Retention & Your Controls

• Conversations are retained while your account is active
• You can delete individual conversations at any time from within the assistant
• When you delete your account, your conversations are removed within 30 days (see Section 6)

14.6 Important Notices

• You are interacting with an AI system; we indicate this within the assistant.
• AI responses may be inaccurate or incomplete — verify before relying on them.
• Please do not enter sensitive personal data (e.g., health, precise location about identifiable individuals, government IDs) into the assistant.