Privacy notice

What we collect

• Your email address
• The device you chose (iPhone, Mac, both or web)
• The language of the page (Japanese or English)
• When you signed up
• Your referral code (8 random characters, used in your share link actomata.ai/?r=…) and how many people joined through it (and how many of them later used an invite)
• A normalised form of your email address (lower case, without any "+tag", and for Gmail without dots), used only so one person cannot sign up under several aliases to move up
• A one-way hash of a random token that identifies the browser you signed up in. The token itself is only in that browser's cookie (see "Cookies" below)
• If you joined through someone's link, a link to that person's sign-up (they never see your email address)
• Your invite status (waiting, invited or joined). Your place in line is worked out from referrals and sign-up time when you ask; it is not stored. It is shown only to the browser you signed up in: if someone else types your address into the form, they are told only that it is already on the list
• If we invite you: the batch name, when the invite was made, when it expires and when it was used. We keep only a one-way hash of the invite code, never the code itself
• A one-way hash of your browser's user-agent string, never the string itself, used only to spot abusive sign-ups.

Your IP address is used briefly to limit repeated sign-ups and is not saved to the waitlist. Our hosting provider (Vercel) does keep IP addresses in short-lived access logs, for security and to keep the site running.

What it is used for

Only to tell you when actomata launches, to invite you to the beta, and (referral counts) to decide the order of invites. Nothing else.

Cookies

When you sign up, we store one cookie in that browser (named acto_wl, valid for a year). It holds only a random token, never your email address. Scripts cannot read it (HttpOnly) and it is only sent to actomata.ai's sign-up endpoint. It lets us show your place and share link only to your own browser when you sign up again with the same address.

When you open the beta with an invite link, we store a second cookie in that browser (named acto_invite, valid for 90 days). It holds your sign-up number, an expiry time and a signature that stops it being forged, and never your email address. Scripts cannot read it (HttpOnly) and it is only sent to actomata.ai. It is used only to check that you may enter the beta, never for ads or tracking. You can delete it in your browser settings at any time.

If you arrive through a friend's link, its code is kept in this tab only (sessionStorage) until you sign up or close the tab.

Sharing

We never sell, rent or use it for advertising, and we do not give it to anyone else without your consent unless the law requires it.

We use these services to store and serve it; they process it on our behalf: Supabase (database) and Vercel (website hosting and the sign-up form).

Where it is kept

Sign-ups are processed and stored on servers in Japan (Tokyo): the database in Supabase's Tokyo region and the sign-up form in Vercel's Tokyo region. The pages themselves are served from the location nearest to you, and the access logs above may be created there.

Supabase, Inc. and Vercel Inc. are both companies based in the United States. They handle the data under contracts that require security measures equivalent to those of Japan's Act on the Protection of Personal Information (access control, encryption and oversight of their own subcontractors). Ask us at the address below if you would like details of the US privacy rules or of the measures they take.

TODO (before launch: confirm both data processing agreements are in place and both services are set to the Tokyo region)

For visitor counts we use Vercel Web Analytics, which uses no cookies and does not identify you.

How long we keep it

Within 6 months of the public launch we delete the sign-ups of people who did not become users (including their referral and invite records). If you ask us to delete yours earlier, we do it straight away.

TODO (the "6 months after the public launch" period is a placeholder, to be confirmed before launch)

Seeing, correcting or deleting it

Email the address below from the address you signed up with. We will show, correct or delete what we hold, or stop using it.

Who we are and how to reach us

actomata.ai TODO (legal name and address to be added before launch)

privacy@actomata.ai TODO (placeholder address)

Changes

If this notice changes, we will update this page and its date.

5 November 2026