Privacy policy: Auth¶
Effective date: October 14, 2026
This privacy policy explains how Gokaizen collects, uses, stores and protects personal data in
Auth, the Gokaizen sign-in service powered by Zitadel at auth.internal.gokaizen.cloud, in accordance with the
Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the
issuances of the National Privacy Commission.
Auth provides your Gokaizen account and lets you sign in to Gokaizen applications. Each application you sign in to has its own privacy policy for the data it processes.
Who is responsible¶
| Personal information controller | Gokaizen |
| Data Protection Officer | internal@gokaizen.ai |
| Privacy questions and requests | internal@gokaizen.ai |
What personal data we collect¶
| Category | Data | Source |
|---|---|---|
| Account | Username, first and last name, display name, email address, preferred language; optionally phone number, nickname and profile picture | You, or an administrator who creates your account |
| Credentials | Your password, stored only as a salted one-way hash that cannot be read back; passkey public keys; authenticator-app secrets, stored encrypted | You |
| Verification | Whether your email address and phone number are verified; short-lived one-time verification codes | Generated by Auth |
| Sign-in and security | Date and time of sign-ins and sign-in attempts, their outcome, IP address, browser and device information, authentication methods used, active sessions | Generated when you use the service |
| Organization and roles | The organization you belong to and your roles in Gokaizen applications | Administrators |
| Messages | Records of service emails sent to you, such as verification and password reset emails | Generated by Auth |
We do not collect sensitive personal information in Auth. We do not sell personal data, use it for advertising or build marketing profiles. The sign-in pages contain no analytics or tracking technology.
Why we use it, and on what basis¶
| Purpose | Data | Lawful basis (RA 10173, Sec. 12) |
|---|---|---|
| Creating and managing your account | Account, organization and roles | Fulfillment of a contract with you, including your employment or engagement |
| Signing you in and providing single sign-on to Gokaizen applications | Account, credentials, sessions | Fulfillment of a contract |
| Protecting accounts and the service: detecting suspicious sign-ins, locking accounts after repeated failed attempts, multi-factor authentication | Credentials, sign-in and security data | Legitimate interest in the security of our systems and of your account |
| Sending service messages, such as verification codes, password resets and security notices | Email address, phone number | Fulfillment of a contract |
| Telling an application who you are when you sign in to it | Name, email address, username, user ID and roles, limited to what the application requests | Fulfillment of a contract |
| Complying with legal obligations and lawful requests | Any of the above, as required | Compliance with a legal obligation |
Who receives your data¶
- Gokaizen applications you sign in to receive the identity information they request, typically your name, email address, user ID and roles.
- Service providers that host and operate our infrastructure process data on our behalf, only on our instructions and under data processing agreements that require them to protect it.
- Government authorities, only when required by law or a lawful order.
Email is sent through Gokaizen's own mail service. Text messages are not used at the moment; if they are introduced, this policy will be updated before they are enabled.
Our infrastructure may be located outside the Philippines. Wherever personal data is processed, we remain responsible for it and ensure it is protected to the standard required by the Data Privacy Act, through contractual and technical safeguards.
How long we keep it¶
| Data | Retention |
|---|---|
| Account and credentials | For as long as your account exists. Deleted when the account is deleted. |
| Sessions | Until you sign out or they expire. You are asked for your password again after at most 10 days, and sign-ins to applications end after at most 90 days. |
| Sign-in and security records | For as long as needed to protect accounts and investigate security incidents, and to meet legal obligations. |
| Server logs (IP address, requested address, time, sign-in names) | 3 months, then deleted, including their copies in backup storage. |
| Backups | Nightly backups are kept for 14 days on the server. Encrypted copies are kept in secure off-site storage so that data can be restored after an incident. They are used only for disaster recovery. If a backup is ever restored, account deletions made since that backup are applied again. |
How we protect it¶
We apply organizational, physical and technical security measures, including:
- encryption of all connections (HTTPS/TLS);
- storing passwords only as salted hashes, and encrypting other secrets at rest;
- multi-factor authentication (authenticator apps and passkeys), available to all users and strongly recommended;
- locking accounts after repeated failed sign-in attempts;
- infrastructure that is not directly reachable from the internet, with access limited to authorized personnel;
- encrypted backups stored off-site.
In the event of a personal data breach, we will notify the National Privacy Commission and the affected persons as required by law.
Your rights¶
Under the Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to:
- Be informed whether and how your personal data is processed.
- Access your personal data and obtain a copy of it.
- Correct inaccurate or incomplete personal data.
- Object to processing, including processing based on legitimate interest.
- Erasure or blocking of personal data that is incomplete, outdated, false, unlawfully obtained, or no longer needed, subject to records we are required by law to keep.
- Data portability: receive your personal data in a commonly used electronic format.
- Damages for inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
- File a complaint with the National Privacy Commission (privacy.gov.ph).
To exercise any of these rights, contact our Data Protection Officer at the address above. We may ask you to verify your identity first. We will respond within thirty (30) days of receiving your request.
You can also view and update most of your account details yourself after signing in at auth.internal.gokaizen.cloud.
Age¶
Auth is a business service intended for persons aged 18 and over.
Changes to this policy¶
We may update this policy. The effective date at the top shows the current version. We will inform you of significant changes by email before they take effect. Previous versions are available on request.