Privacy Policy

FRAME00 Inc. (“we”) provides Lemma (the “Service”) and its website. This policy describes the data we receive, store, and process, given the cryptographic design of the Service.

1. Data Minimization

   The Service receives only the minimum metadata required for API operation. Original documents (plaintext) never reach our servers. Documents are normalized cryptographically inside the user's environment, and only commitments and hashes are transmitted to us.

2. Data We Receive

   Per our OpenAPI v2 specification, we receive only the following:

   • Schema ID (schema)
   • Document hash (docHash)
   • IPFS content identifier (cid)
   • Issuer identifier (issuerId) — an arbitrary string (DID, address, etc.) hashed via keccak256 to bytes32
   • Subject identifier (subjectId) — same hashing approach
   • Commitments — a Merkle root, leaves, and randomness based on Poseidon, Poseidon2, Rescue-Prime, or SHA-256
   • Revocation root and scheme
   • Issuer signature (optional)
   • Zero-knowledge proof and public inputs

   These structures make it cryptographically infeasible to reconstruct the original document. We do not hold plaintext documents and cannot read, analyze, or copy them.

3. Encryption and Storage

   • Transit: all communication is encrypted via HTTPS (TLS 1.2+).
   • Storage: we store only the metadata above. We do not retain original document content.
   • Hosting: the Service runs on Cloudflare Workers. Cloudflare's security policies apply.

4. Third-Party Disclosure (On-Chain Writes)

   When users explicitly set onchain: true on a proof submission, we record the verification result to the verification contract on the chain (EVM-compatible) configured by the targeted circuit (CircuitMeta.verifier). Chain ID and contract address come from the circuit's metadata.

   When onchain is not set (default), verification results are stored only within our internal systems.

5. Selective Disclosure

   Users may combine ZK proofs with selective disclosure (bbs+ or opaque format). We receive only the disclosed attributes; undisclosed attributes are not processed.

6. Personal Information Collected Through Website Forms

   Through forms on the Service's website (email inquiries, contact requests, newsletter sign-ups, and similar), we collect:

   • Information you enter, such as your email address, name, company, role, title, and company size
   • The content of your inquiry
   • Where you came from (referring page and campaign identifiers)

   Answers to the self-check are aggregated through Google Analytics in a form that does not identify you or your organization, and are used to analyze cases and improve the checklist.

   Purposes: replying to your inquiry; information about Lemma and our other products and services; updates such as new case analyses for newsletter subscribers; and aggregate, non-identifying analysis to improve the website and Service.

   Processors and storage: Consultations from the self-check are received through a CLUBS form operated by us, and responses are stored in Japan (Tokyo). Submissions are processed on servers in the United States (Vercel Inc.). Internal notifications of new submissions use Slack (Slack Technologies, LLC, United States) and include only the form title and the sender's name. Other forms are provided by Tally (Tally BV, Belgium) and responses are stored in the EU. Website analytics use Google Analytics (Google LLC, United States).

   Unsubscribing: You can stop our emails at any time using the link in each email or by contacting us below.

7. Security Measures

   We take necessary and appropriate measures to prevent leakage, loss, or damage of personal information, including limiting access to the staff who need it, selecting and supervising processors, and encrypting data in transit and at rest.

8. Retention

   • Metadata: retained for the period necessary to provide the Service.
   • Logs: retained for operational needs (up to 90 days), then deleted.
   • Personal information from website forms: retained as long as needed to reply and to send the information described above; deleted promptly on request.

9. User Rights

   Users may exercise the following rights regarding their metadata and personal information held by us:

   • Right to access
   • Right to correction and deletion
   • Right to restrict processing

   To exercise these rights, contact us at the address below.

10. Third-Party Sharing

    We do not share data with third parties without user consent, except as required by law. By design, it is technically impossible for us to share the original document content.

11. Changes to This Policy

    This policy may be updated to reflect changes in the technical specification or applicable law. Material changes will be announced on the Service's website and notified to users.

12. Contact

    For questions about this policy or to exercise any of the rights above:

    FRAME00, Inc. (フレームダブルオー株式会社)
    3-5-7 Ebisu-minami, Shibuya-ku, Tokyo 150-0022, Japan
    Representative Director: Mayumi Hara
    Email: contact@frame00.com