DioTrans
Log in

LEGAL / JP / EN

Privacy
Policy

What DioTrans collects, uses, and retains, and where data is uploaded.

!
English translation (reference).This is a translation of the Japanese Privacy Policy. In the event of any discrepancy, the Japanese version is authoritative.
!
Pre-publication review version.Processing regions, retention periods, subprocessors, and operator information are finalized. This document will be published after expert review.

Document version: 2026-02-14 / Last updated: 2026-08-30

1. Operator

The personal information handling business operator is noktone LLC (Japanese name: 合同会社noktone). The address is Kyoei Building 2F, 44 Suzaku Hozo-cho, Shimogyo-ku, Kyoto 600-8846, Japan (Kyoto Suzaku Studio AK-410), and the representative is Kentaro Nishiyama. For inquiries about personal information, contactsupport@diotrans.app. Hours are 9:00–17:00 (JST).

2. Information we collect

  • Name, email address, OIDC subject ID, organization information
  • Transfer subject, message, file names, sizes, MIME types, recipient information, and expiry
  • Transfer and download audit logs, IP address, User-Agent
  • Stripe customer ID, subscription ID, plan information. Card numbers are not retained
  • Connection information for S3/R2, OIDC, and SMTP configured by the User. Secrets are stored encrypted
  • Records of consent to the Terms of Service and Privacy Policy

3. Files themselves

Files are encrypted in the browser, and encrypted data is sent to the selected upload destination. Files are uploaded to the User’s AWS S3, Cloudflare R2, or DioTrans-provided storage.

In standard mode, the encryption key is protected and stored on our side, which means we may be able to decrypt the files. In passphrase mode, the passphrase is never sent to us.

4. Purposes of use

We use information to provide the Service, manage accounts, send file transfer notifications, verify recipients, process payments, maintain security, prevent abuse, conduct audits, respond to inquiries, and improve the Service.

5. Subprocessors and international transfers

We use Cloudflare, AWS, Stripe, and external OIDC, SMTP, and S3/R2 configured by Users. Data items, regions, and retention periods for each service are published in the Data processing and locations page and the subprocessors list.

Current main storage regions: authentication and email processing are in AWS ap-northeast-1 (Tokyo); the database and DioTrans-provided storage are within Cloudflare’s Asia Pacific (APAC) region. APAC means storage in Cloudflare data centers within the Asia Pacific region (a regional designation not limited to a single country). Stripe processes data according to Stripe’s terms and policies.

6. Retention and deletion

  • Files themselves: after the transfer expiry (default 7 days, configurable by the sender), encrypted data is deleted from the upload destination (S3/R2).
  • Transfer metadata and audit logs: retained during the contract period (administrators can view them for auditing). After the contract ends, personal information (email address, IP, User-Agent) is anonymized and deleted within 2 years.
  • Log-in history: deleted when the account is deleted.
  • Account deletion: executed after a 24-hour grace period (or the end of the billing period) following the request. S3/R2 files, transfer data, contacts, consent records, and identity provider users are deleted, and audit logs are anonymized.
  • Backups: D1 Time Travel keeps recovery points for the last 30 days on Cloudflare’s side.
  • Abuse reports: retained for investigation and response, anonymized after the contract ends, and deleted within 2 years.

7. Your rights

How to request disclosure, correction, deletion, suspension of use, and similar is described in Privacy requests.

8. Cookies

We use cookies necessary to provide the service, such as session, CSRF, and consent status. If we introduce advertising or analytics cookies, we will update the Cookie policy.