Privacy Policy
IQBaseline is an initiative of Xaephyr Reliance Group KK ("XRG", "we", "us", "our"), a Japan-based managed IT and technology services company. This policy applies to the IQBaseline website and platform, and is maintained consistently with XRG's group-wide legal and privacy practices.
This Privacy Policy explains how IQBaseline collects, uses, and protects information when you visit this website or use the platform.
1. Information We Collect
We collect information in the following ways:
- Information you provide directly — for example, when you request access, when your organization's admin invites you to IQBaseline, or when you contact us, we collect the details you choose to provide (such as name, company, work email address, and the content of documents you upload to the platform's tools).
- Automatically collected information — standard technical data generated by your browser and our hosting provider, such as IP address, browser type, device type, and timestamps, used for security, performance, and abuse prevention.
- Cookies and similar technologies — see our Cookie Policy for full detail on what we use and why.
2. How We Use Information
- To provide, operate, and secure the IQBaseline platform and the tools within it.
- To process the documents and information you submit to IQBaseline's tools in order to generate the output you request (for example, standardizing a resume, drafting an answer to a vendor security questionnaire, or summarizing a contract).
- To respond to access requests and other inquiries submitted through this site.
- To meet legal, contractual, and regulatory obligations relevant to our services.
- To communicate with existing or prospective clients about the service, where you have not opted out.
We do not sell personal information, and we do not use advertising trackers on this site.
3. Legal Basis for Processing
Where applicable data protection law requires a stated legal basis, we rely on: performance of a contract or steps taken at your request prior to entering one (e.g., provisioning your account after an invite), our legitimate interests in operating and securing this platform, and compliance with legal obligations, including the Act on the Protection of Personal Information (APPI) of Japan.
4. Sharing of Information
We do not sell or rent personal information. We may share limited information with:
- Service providers who support our platform and operations, currently including Render (application hosting and database infrastructure), Resend (transactional email delivery for invites and password resets), Anthropic (the AI model provider used to process documents you submit to IQBaseline's tools and generate the outputs you request), and Google (web font delivery).
- Client engagements — where your organization has a signed agreement with XRG, information relevant to that agreement is handled under its terms, which take precedence over this website-level policy for engagement-specific data.
- Legal and regulatory bodies, where required by applicable law or a valid legal process.
5. International Data Transfers
Some service providers we rely on (including Render, Resend, Anthropic, and Google) operate global infrastructure, which may involve processing data outside Japan. Where this occurs, we expect our providers to maintain appropriate safeguards consistent with their own published data protection commitments.
6. Data Retention
We retain information only for as long as reasonably necessary for the purposes described in this policy, to comply with legal or contractual obligations, or to resolve disputes.
7. Your Rights
Depending on where you are located, you may have rights to access, correct, delete, or restrict the use of your personal information, and to object to certain processing. To exercise any of these rights, contact us using the details in Section 10.
8. Security of Your Information
As a platform built by a managed IT and security services provider, we take the protection of information seriously and apply reasonable administrative, technical, and organizational safeguards, including mandatory two-factor authentication on every account. No method of transmission or storage is completely secure; see our Limitation of Liability & Disclaimers for further detail.
9. Children's Privacy
This website is intended for a business audience and is not directed at children. We do not knowingly collect personal information from children.
10. Contact Us
Questions about this Privacy Policy, or requests relating to your personal information, can be directed to us via our contact form.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last reviewed" date above.