VosCMS Privacy Policy
Effective date: March 2, 2026
Effective date: March 2, 2026
Article 1 (Purposes of Processing)
株式会社ザボスＥＣＯ研究所 (the "Company") processes the minimum necessary personal information in connection with "VosCMS" (the "Software"), an open-source CMS distributed free of charge, for the following purposes. Personal information processed shall not be used for purposes other than those listed below; where purposes change, the Company will take necessary measures including obtaining separate consent.
- Account registration, login, and customer support on the official site (voscms.com).
- Ancillary cloud services such as the Marketplace, license verification, and automatic updates.
- Handling and history management of inquiries and bug reports.
- Fulfillment of obligations under applicable laws (tax, fraud prevention, abuse investigation, etc.).
The mere download, installation, or operation of the Software does not, as a rule, involve any collection of personal information.
Article 2 (Items of Personal Information Processed)
| Purpose | Items |
|---|---|
| voscms.com account / login | Name or nickname, email, hashed password, login timestamps, IP address |
| Developer registration and payout | Additionally: business type, trade name, business number, qualified-invoice number (T-number), address, bank account, PayPal email, tax documents |
| Marketplace purchases | Additionally: payment information via PG (the Company does not retain credit card numbers), purchase history |
| Inquiries | Email, content of inquiry, attached files |
| Access logs / statistics | IP address, browser info, referrer, cookie ID (used only for service-improvement statistics) |
Article 3 (Retention and Use Periods)
The Company retains and uses personal information within the period prescribed by law or consented to by the data subject.
- Account data: until withdrawal (deleted within 30 days after withdrawal; certain identifiers may be retained for up to 90 days to prevent abuse).
- Transaction and payment records: 7 years (Japan Corporation Tax Act, Consumption Tax Act, etc.).
- Access logs: 6 months (for unauthorized-access investigation).
- Inquiry records: 3 years.
Article 4 (Third-Party Disclosure and Outsourcing)
The Company does not, in principle, provide personal information to third parties without prior consent of the data subject, except as required by law or as outsourced below for the necessary scope.
| Recipient | Outsourced task |
|---|---|
| Payment providers (Stripe, PayPal, etc.) | Payment processing (the Company does not directly retain card numbers; processed by the PG in a secure environment) |
| Cloud hosting providers | Server operation and data storage |
| Email delivery services | System email (account verification, notifications) |
In outsourcing agreements, the Company specifies prohibitions on use beyond the agreed purpose, technical/administrative safeguards, restrictions on re-outsourcing, and liability, and supervises the recipients.
Article 5 (Rights of the Data Subject and How to Exercise Them)
The data subject may exercise the following rights against the Company. Members may directly view, correct, and delete information on their voscms.com mypage; other requests may be exercised via the Company's inquiry channel.
- Request to access personal information (Japan APPI Art. 33).
- Request to correct, add to, or delete personal information (APPI Art. 34).
- Request to suspend use or third-party provision (APPI Art. 35).
- Withdrawal of consent (withdrawal does not affect the lawfulness of prior processing).
The Company will respond without undue delay and notify the result of processing in accordance with applicable laws.
Article 6 (Security Measures)
The Company takes the following measures to prevent leakage, alteration, or loss of personal information:
- All communications encrypted via SSL/TLS (the service is provided over HTTPS).
- Passwords are stored as hashes (bcrypt, etc.); plain-text passwords are not retained.
- Sensitive information (bank account, tax numbers, etc.) is stored encrypted.
- Least-privilege access control and periodic access-log review.
- Backups of major systems and disaster-recovery plans.
- Privacy training for employees.
However, the Company assumes no liability for account information disclosed due to the user's own carelessness or general Internet issues.
Article 7 (Cookies and Automated Collection)
The Company uses cookies and similar technologies to provide and improve the service. Cookies are used for usage analytics, maintaining login state, and preserving user preferences.
Users may refuse cookies through browser settings; some features may be restricted in that case.
Article 8 (Privacy Officer)
The Company designates a Privacy Officer responsible for overall personal information processing and for handling complaints and remedies of data subjects.
- Department: 株式会社ザボスＥＣＯ研究所 Privacy Office
- Address: 福岡県福岡市博多区古門戸町１０番５－５０１号
- Phone: (092) 282-4518
Article 9 (Remedies for Infringement of Rights)
For remedies in cases of personal-information infringement, the data subject may consult or apply to:
- Personal Information Protection Commission (PPC) — https://www.ppc.go.jp/
- Consumer Hotline — 188
Where the data subject objects to the Company's response, they may bring an action before the competent court (see below).
Article 10 (Changes to this Policy)
The Company may amend this Policy within the scope permitted by applicable law. Where amended, the changes will be announced on the voscms.com service screen at least 7 days before the effective date; where the changes materially affect users' rights, notice will be given 30 days in advance, and an email will be sent to the registered address.
The governing law of this Policy is the laws of Japan, and the Fukuoka District Court shall have exclusive agreed jurisdiction over any dispute.
(The Japanese version of this Policy is the authoritative original; in the event of any discrepancy with another language version, the Japanese version shall prevail.)
