Create GO Agency Privacy Policy

Section 1 Scope of This Policy

1 株式会社SLMホールディングス (the “Company”) handles personal information and other information concerning users in accordance with this Policy in the AI document creation service “Create GO Agency” and related websites, applications and support (the “Service”). The Service supports creation, editing and output of presentation and similar materials based on instructions and materials.
2 This Policy applies to users, persons considering use, contact persons at their corporations or organizations, persons making inquiries and individuals whose information is handled by the Service. Information collected and its handling vary according to features, contract plans, organizational settings and users' actions.
3 Where corporate Individual Contracts or data processing agreements contain special provisions, those provisions apply to the processing concerned. However, they do not restrict individuals' statutory rights or the Company's obligations. Regional supplements cover processing subject to the relevant laws; where they conflict with this Policy, those supplements and applicable law take precedence.
4 Established: August 25, 2026　Current version applies from: October 1, 2026　This revision applies from: October 20, 2026

Section 2 Roles of the Company and Users' Organizations

1 The Company is responsible, to the extent it determines purposes and methods of handling information, for account management, contracts and billing, inquiry handling, secure operation and similar matters. It may be entrusted with processing customers', employees' and other persons' personal information sent in materials, under instructions from users' organizations or other customers.
2 Information entrusted for processing is handled according to the customer's lawful instructions, contracts and applicable law. When requests are received from individuals concerned, the Company contacts the customer where necessary and assists in responding. This division of roles does not exempt the Company from statutory obligations directly imposed on it.
3 Where Organization Accounts are offered, corporate or organizational owners and administrators may view and manage users, generation history and generated materials within the organization, within the scope of available features and assigned permissions. Users without these administrative permissions, in principle, view materials they themselves created or registered. Organization templates are also shared within the scope of available features and settings. Organizations shall provide users with necessary explanations regarding handling by administrators.

Section 3 Information Collected

1 The Company collects the following information to the extent necessary for the features or transactions used. Not every item is collected from every user.

（1）Application, account and affiliation information: corporate or individual status, country, company name, contact person's name, name and display name, email address, profile image, authentication identifiers, email verification status, information declared by the user concerning being at least 18 years old and using the Service for business or professional purposes, records of consent to terms and similar documents, number of seats, desired start date, organization, roles and permissions, plan, pricing category, usage allowances, language and display settings, and free-trial history.
（2）Authentication and connection information: Clerk user ID, login and session information, information provided through Google, Microsoft or other authentication, and tokens necessary for external connections authorized by users. Authentication uses Clerk; Create GO Agency does not store plaintext passwords. Connection tokens are handled to the extent necessary for connection processing requested by users and management of permissions.
（3）Input and upload information: title, purpose, intended audience, instructions, agenda, number of slides, storage settings, PPTX, PDF, Word, spreadsheets, images, files specified by users and imported through available connection features, and their contents.
（4）Generation and processing information: outlines, generation instructions, intermediate output, HTML, PNG, PPTX and other deliverables, quality inspection results, AI requests and responses, models used, processing status and errors, generation history and usage amounts. For source management, public URLs, page names, publishers, publication dates, short quotation candidates and reference relationships within materials are also handled.
（5）Contract and payment information: plan, number of seats, billing details, payment method, invoices, amounts, payment and receipt status, transaction history, terms version, consent to paid transition and its date and time, and identifiers of Stripe customers, payment methods, payment settings and contracts. Only Stripe is used for credit card payments. Card numbers and security codes are entered directly on Stripe's payment screen and are not stored in Create GO Agency's database.
（6）AI connection information: API keys registered by users or their organizations, connection destinations, availability and displayed suffixes of keys. Registered API keys are stored encrypted and, in principle, are not displayed again in full on screen.
（7）Support information: names, contact details, affiliation, inquiry contents, attached materials, response history and information necessary to verify identity.
（8）Device and usage information: IP addresses, browser and device information, access dates and times, referrers, operation and feature-use history, audit logs, errors, security events, Cookies, local storage and similar information. Where individuals can be identified by linking this with other information, it is also handled according to applicable law.

Section 4 Collection Methods and Highly Confidential Information

1 Information is collected through individuals' input and uploads, registration by organizational administrators, connections with authentication providers or others, automatic collection accompanying Service use, and provision in business discussions, support and similar interactions. When receiving information from third parties, lawful authority and grounds for handling are also checked.
2 Before inputting other persons' personal information or confidential information, users shall assess its necessity and secure necessary explanations to those persons, consent, organizational permission or other lawful grounds. Input shall be limited to what is necessary, for example by removing unnecessary personal names or customer information.
3 Health information, thoughts or beliefs, criminal records and other information requiring special protection shall not be input unless the user has confirmed that the relevant contracts, available features and legal grounds permit such handling. Where the Company collects special care-required personal information under Japanese law or similar information, necessary consent from the individual is obtained in advance, except where permitted by law. Input alone is not treated as establishing that all necessary consent has been obtained.

Section 5 Purposes of Use

1 Collected information is used to the extent necessary for the following purposes. Where regional law requires a legal basis, the regional supplements apply.

（1）Account issuance, identity verification, authentication, checking registration requirements, management of permissions and usage allowances, and prevention of unauthorized use. Registered email addresses, account information, past usage records and similar information are used to the extent necessary to check repeated free-trial use.
（2）Generation, editing, quality checks, conversion, storage and output of materials requested by users, import of specified files, and necessary processing requests to configured AI and search services.
（3）Management of contracts, charges, billing, payments, receipt of funds and transaction history; handling paid transitions, stopping renewals, cancellation and necessary refunds; and necessary accounting and tax processing.
（4）Handling inquiries and failures, implementation assistance and support requested by users.
（5）Security, audits, investigation of failure causes, prevention of unauthorized use and management of usage allowances. Access to the contents of materials is limited to what is necessary and is distinguished from use as training data.
（6）Responding to general suggestions for improvement and inquiries voluntarily submitted by users. This does not involve collecting attached materials, generated output or information extracted from them as training data.
（7）Notices necessary for contracts, billing and security, maintenance information and notification of significant changes. Users' materials and information are not secondarily used for public case studies, advertising or promotional emails.
（8）Compliance with statutory obligations, exercise and defense of rights, investigation of violations of the Terms of Service, and dispute handling. Where purposes change, necessary notification, publication and consent procedures are undertaken according to the contents.

Section 6 Distinguishing AI Processing from Training

1 Instructions, extracted material contents, outlines, intermediate output and similar information necessary for material generation are sent directly to the APIs of the AI model providers that actually perform processing, according to the features used and connection settings. Where Web search is used, search terms and similar information necessary for that processing may be sent to the search provider. Connection destinations and processing conditions are explained in the external services list and similar guidance, according to the plan, feature and settings. Identical model names do not necessarily mean identical processing providers.
2 The Company does not use users' input materials, instructions, generated output or information extracted from them for AI model training or additional training conducted by the Company, creation of training datasets, public case studies, advertising or sale to third parties. Processing necessary for material generation, storage, retrieval, requested support and secure operations is distinguished from secondary use for training.
3 The Company also does not extract structural information, evaluation information or similar information from users' materials or generated output and collect or use it as training data under the description of quality improvement. Pseudonymizing personal or document identifiers alone does not render information non-personal; necessary protection is provided.
4 Requests, responses and input conditions necessary for material generation are stored in business databases for processing, history management, retrieval and similar purposes. Recording secret values such as authentication information and API keys in operational logs is suppressed, but this does not mean that no material text is stored in business databases. Human viewing of material contents follows Section 13.
5 Transmission to external AI services also uses contractual terms and settings that do not permit use for AI model training or additional training. Conditions for external providers' storage during processing, monitoring for abuse, human review, subcontracting and similar matters are explained according to actual destinations and contracts. Not using data for training and not storing it at all are not the same. Necessary checks and contractual management are performed, and processing destinations consistent with the Company's non-training policy are used.

Section 7 Viewing Within Organizations and External Output

1 Generated materials are non-public by default. However, organizational administrator viewing described in Section 2 and access necessary for operations described in Section 13 may occur. Users distributing downloaded files or importing them into Google Slides or other External Services shall manage recipients and publication scope.

Section 8 Disclosure to Third Parties

1 The Company does not disclose personal data to third parties without the individual's consent or another lawful basis. Under Japanese law, however, disclosure may occur where exceptions under the Act on the Protection of Personal Information are met, including disclosure based on law, protection of life, body or property, public health or sound development of children, and cooperation with statutory duties of national or local government authorities.
2 Disclosure to designated sharing recipients, consultation with professionals necessary for business, handling associated with mergers or business transfers, and similar processing are limited to what is necessary and performed subject to legally required conditions. Even where outsourcing or business succession is not classified as third-party disclosure under Japanese law, obligations regarding security, purpose limitation and foreign transfers remain.
3 Sales communications or sales assistance do not justify unrestricted disclosure of users' materials to external parties. Records of third-party disclosure and receipt required by law are created and retained.

Section 9 Subcontractors and External Services

1 The Company may outsource material processing, cloud storage, authentication, payments, communications and email, monitoring, development and maintenance, inquiry handling and similar operations. Necessary and appropriate supervision is undertaken through subcontractor selection, contracts, access restrictions, checks of handling practices and similar measures.
2 Principal providers include AWS (processing, storage and monitoring), Clerk (authentication), the actual AI model providers and search providers, Stripe (card payments), and Google connection APIs and font delivery. Stella Research&Development 株式会社 (“SRD”) handles necessary information for development, maintenance and similar purposes within the scope of contracts and authority. The principal information handled, purposes and conditions published by each provider are explained in the external services list at the end. Necessary information concerning handling abroad is explained and provided according to Section 10. Where users connect their own contracted API keys or external accounts, those contracts also apply.
3 Where significant subcontractors or processing contents change, notices and consent procedures required by law and contract are undertaken. Updating the list alone does not dispense with necessary consent or legal procedures.

Section 10 Handling Outside Japan

1 AWS is used for the Service's cloud infrastructure. Cloud configuration, external AI, authentication, payments, connected services or maintenance access from abroad may result in processing outside Japan. Even if domestic storage is used, this does not mean that all information is handled exclusively within Japan. Information required by applicable law concerning specific countries or regions, recipients, purposes and safeguards is provided through the external services list, guidance for the features used or other appropriate methods.
2 Where disclosure constitutes transfer to a third party in a foreign country under Japan's Act on the Protection of Personal Information, lawful measures appropriate to the actual transfer arrangement are taken. Where based on the individual's consent, information legally required regarding the recipient's country, its personal information protection system and the recipient's safeguards is provided before consent is obtained. Where based on a system meeting statutory standards, that system and continuous implementation of safeguards are checked, and legally specified information is provided on request. Inquiries are accepted at the office in Section 17.
3 Where regional laws apply to transfers from the EEA, United Kingdom, Switzerland or similar regions, grounds for transfer recognized by that region are secured. Consent to this Policy alone does not automatically authorize all transfers abroad.

Section 11 Cookies and Informational Emails

1 Cookies, local storage and similar technologies are used for Clerk authentication and session maintenance, security, language and theme preferences, saving settings or generation status in progress, synchronization between tabs and similar purposes. Stripe's external payment screens and similar services also use technologies necessary for those services.
2 At release, analytics tools for advertising delivery or behavioral targeting are not introduced. Disabling essential technologies in the browser or elsewhere may prevent use of some features. Purposes, retention periods and recipients of external providers' Cookies and similar technologies are also explained where necessary.
3 If non-essential analytics or advertising technologies are introduced in the future, this shall occur after necessary explanations, consent, refusal and withdrawal methods and similar arrangements are put in place. Merely posting this Policy is not treated as consent to any future optional processing. Notices necessary for contracts, billing, security and similar purposes are sent separately from promotions.

Section 12 Retention Periods and Deletion

1 Generated deliverables and input or reference materials are stored for periods necessary for material generation, provision to users, retrieval from history and requested support. Retention periods are determined by contract plans, users' storage settings, availability periods in the Service and deletion requests. The items concerned, starting points and availability deadlines are explained when used. Users shall obtain necessary materials before the indicated deadline. After the retention deadline, viewing and retrieval of document files are stopped, and expired document files become subject to periodic deletion processing. After deadlines expire or purposes are achieved and retention is no longer necessary, deletion without undue delay is managed, except to the extent necessary for statutory retention obligations, dispute handling or similar purposes.
2 Material files are managed separately from generation jobs, input conditions and history, operational logs, account information, billing, payment receipt and audit records, and backups. Account information is retained for periods necessary for contract management; generation history and similar information for processing, retrieval and failure response; logs and similar information for security and investigation of unauthorized use; and billing records and similar information according to applicable statutory retention periods and periods necessary to resolve outstanding transactions and claims. Information whose purpose has been achieved and that is no longer necessary under law or for exercising or defending rights is subject to deletion. Expiration of the retention period for material files alone does not mean that all these items are deleted simultaneously.
3 Stopping the next renewal and the timing of contract termination resulting from cancellation of a paid plan follow Article 13 of the Terms of Service. Cancellation of a paid plan alone does not delete the account or stored materials. To delete an account or materials, use an available deletion function or make a request under Section 14. For account deletion, after identity verification and necessary procedures, statutory retention obligations, unsettled transactions, dispute handling and other legitimate retention grounds are checked, and deletion without undue delay of unnecessary account information and related materials is managed. Specific items subject to deletion, procedures and response status are explained according to the request. This does not mean that all information, including information in External Services and backups, is deleted simultaneously at contract termination. Statutory requests for erasure, cessation of use and similar measures are handled according to Section 14.
4 Necessary billing, payment receipt, audit and similar records are retained after leaving the Service for necessary periods with restricted purposes and access. If records necessary to check repeated free-trial use are retained, they are limited to the minimum necessary information and periods, taking account of individuals' rights and interests and the need to prevent unauthorized use. Replacing identifiers alone does not remove information from personal information protection. Backups are deleted according to retention cycles necessary for recovery, and necessary measures are taken on restoration to prevent deleted information from returning to ordinary use. External providers' retention and deletion are managed according to contracts and law.

Section 13 Security and Incident Response

1 Organizational, personnel, physical and technical safeguards appropriate to the nature and risks of information are implemented. Technical measures include access control through permissions and tenants, protection of communications and stored data, encrypted storage of API keys, suppression of secret values such as authentication information in operational logs, monitoring, usage restrictions and backups. Measures are continuously reviewed, including subcontractor management.
2 Access to material contents is limited to personnel and scope necessary for requested processing, support, investigation of failures or unauthorized use, legal responses and similar matters. System administrators may have authority to access generation information across multiple organizations for operational purposes, but viewing permissions are not uniformly granted to all personnel, including sales and accounting staff. Necessary access management and records are maintained, and safeguards are explained to the extent this does not compromise security.
3 In the event of a leak or similar incident, investigation, containment and prevention of recurrence are undertaken, and reports to supervisory authorities and notifications to individuals are made according to applicable law.

Section 14 Individuals' Requests and Choices

1 Under applicable law, individuals may request notification of purposes of use, disclosure of retained personal data or third-party disclosure records, correction, addition, deletion, cessation of use, erasure, cessation of third-party disclosure and similar measures. Regional laws may also recognize data portability, restriction of processing, objections and other rights. Please contact the office in Section 17.
2 Identity or lawful representative status is verified to the extent necessary. Excessive verification is not required for refusals or other requests for which identity verification is not legally required, and verification information is handled solely for that purpose.
3 Responses follow statutory periods and procedures. Where all or part of a request cannot be fulfilled, reasons and available complaint or appeal methods are explained to the extent legally possible. Fees are handled only where permitted by law and after necessary guidance is provided.
4 Consent may be withdrawn for processing based on consent. The lawfulness of processing before withdrawal is not affected, but subsequent handling is changed according to law. If necessary information is not provided or is deleted, features requiring it may not be available. Disadvantageous treatment prohibited by law shall not occur because rights are exercised.

Section 15 Information Concerning Minors

1 The Service is intended for business or professional users aged 18 or older. Account registrations by persons under 18 are not accepted. However, materials sent by users may contain children's information, so legally required protection of minors' information is not omitted.
2 If children's information is found to have been collected without necessary requirements being met, checks are performed followed by cessation of processing, deletion, contact with guardians or similar measures. Guardians may contact the office in Section 17.

Section 16 Changes to This Policy

1 This Policy may be revised in response to changes in law, features or information handling. Significant changes, their contents and application start date are announced at the necessary time through the Service, email or similar means.
2 Where separate consent is necessary for new purposes, third-party disclosure or similar processing, it is obtained before processing occurs. Merely posting a revised version or continued use of the Service is not treated as a substitute for all necessary consent.

Section 17 Contact Office

1 Please contact the following office regarding information handling, exercise of individuals' rights or complaints.
2 Company name: 株式会社SLMホールディングス（エスエルエムホールディングス）
3 Established: November 1, 2024
4 Representative: Representative Director 板倉翔一
5 Address: 〒221-0056 神奈川県横浜市神奈川区金港町5-14 クアドリフォリオ8F
6 Email address: contact@create-go-agency.com

Regional Supplements

The following supplements apply where the respective regional laws apply to users, transactions or information processing. Please read them together with the common main text.

Regional Supplement 1 Information Concerning Individuals in the EEA

1 This supplement applies to processing subject to the EU General Data Protection Regulation (GDPR). The Company's contact office when processing as a controller is in Section 17. Rights concerning information handled as a customer's processor are supported according to the division of roles in Section 2.
2 Material generation, account management and similar processing for users who are contracting parties are performed to the extent necessary to fulfill the contract. Information concerning organizational representatives, secure operation, prevention of unauthorized use and similar matters may be processed based on legitimate interests after assessing effects on individuals. Compliance with obligations under EU or Member State law is based on legal obligations. Retention of records under Japanese law is not, by that fact alone, treated as a legal obligation under GDPR; lawful grounds such as legitimate interests are secured with regard to necessity and effects on individuals. Processing requiring separate consent is based on consent for each purpose, and additional legal requirements apply to special categories of personal data.
3 Subject to statutory requirements, individuals may request access, rectification, erasure, restriction of processing, data portability, objections to processing based on legitimate interests and withdrawal of consent. Objections to direct marketing may be made at any time, and processing for that purpose shall stop. Responses are, in principle, provided within 1 month; where a lawful extension is necessary, reasons and its duration are explained.
4 Where solely automated decisions producing legal or similarly significant effects are made, their contents, basis and safeguards are explained, and legally recognized rights to human involvement, challenge and similar protections are ensured. Automatic generation of text or layouts for materials alone does not mean that such decisions are made.
5 Transfers outside the EEA use lawful grounds such as adequacy decisions or standard contractual clauses accompanied by necessary assessments. Actual destinations and measures are explained, and safeguards may be requested from the contact office. Individuals may complain to supervisory authorities responsible for their habitual residence, workplace or place of an alleged infringement.

Regional Supplement 2 Information Concerning Individuals in the United Kingdom

1 Processing subject to United Kingdom data protection laws follows the UK GDPR and other applicable laws. Purposes and types of information remain within this Policy, and grounds applicable to each processing activity, including contractual necessity, obligations under UK law, lawfully assessed legitimate interests and consent, are used.
2 Under applicable law, individuals may request access, rectification, erasure, restriction of processing, data portability, objections, withdrawal of consent and similar rights. Necessary explanations and safeguards are provided for significant automated decisions. Requests are answered within statutory periods, and reasons for lawful extensions or similar measures are explained.
3 Transfers outside the United Kingdom follow grounds such as adequacy mechanisms recognized in the UK and appropriate contractual protections, with actual measures explained. Individuals may complain to the United Kingdom supervisory authority, the ICO.

Regional Supplement 3 Information Concerning Individuals in Switzerland

1 Processing subject to Switzerland's Federal Act on Data Protection follows that Act. It is not assumed to be the same system as the EU or United Kingdom.
2 Subject to the Act's requirements, individuals may request information about personal data handling, access, rectification, cessation of processing, erasure and similar measures, and may request delivery or transfer of data where applicable conditions are met. Notification of automated individual decisions, reconsideration by a person and similar matters are also handled according to that Act.
3 Disclosure abroad follows Swiss legal standards of protection, appropriate safeguards or statutory exceptions, with necessary countries, regions and measures explained. Individuals may report to Switzerland's supervisory authority, the FDPIC, and seek judicial remedies under applicable law.

Regional Supplement 4 United States State Privacy Laws

1 This supplement applies where California or other state laws apply to the Company and the processing concerned. Recognized rights and conditions differ according to residence and legal applicability requirements.
2 Where California law applies, individuals may request knowledge of the categories and specific pieces of information collected, used and disclosed, correction, deletion, opt-out of information sales or sharing for behavioral advertising across multiple services, and limitation of use and disclosure of sensitive information beyond statutory scope. Discrimination prohibited by law because rights are exercised does not occur.
3 Information categories include identifiers, account and contract information, commercial information, Internet and similar usage, and information in input images or materials. Authentication information such as API keys and contents of input materials may be sensitive information. Sources, purposes, recipients and retention criteria are described in Sections 3 through 12, and necessary guidance is also provided at collection.
4 Where handling constitutes sales, sharing for advertising or similar activities, its contents and statutory opt-out methods are explained, and legally valid opt-out signals are respected. Requests are not conditioned on account creation or identity verification that law does not permit.
5 Requests are accepted at the office in Section 17, including requests from lawful representatives subject to verification appropriate to their nature. Where other state laws recognize them, refusals concerning targeted advertising or specified profiling and appeals against decisions on requests are also handled. Statutory deadlines, reasons for refusal and remedies are explained under applicable state law.

Regional Supplement 5 Other Regions

1 Where laws of other countries or regions apply, mandatory personal information protection rights and the Company's obligations are not restricted because this Policy does not individually describe them. Where necessary explanations or procedures are added, the users concerned are informed.

External Services List

This list explains the purposes of External Services, principal information handled and conditions published by each provider. Actual processing varies according to features used, connection destinations, contracts and settings. A provider's location is not necessarily the same as the countries where information is stored or processed.

Specific processing conditions for each recipient are explained according to the features and destinations used. Where information must be provided before consent or similar procedures for transfers abroad, necessary information and choices are provided before the transfer according to Section 10. The links below alone do not replace necessary individual information provision.

AWS

Used to run the Service, operate databases, store materials and generated output, and perform monitoring; registration information, input materials, generated output, logs and similar information are handled. Processing follows the user agreement, service conditions and data processing addendum.

User agreement https://aws.amazon.com/agreement/

Information on the data processing addendum https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/aws-data-processing-addendum-dpa.html

Clerk

Authentication and session management provided by Clerk, Inc. are used, handling names, email addresses, authentication identifiers, login and session information and similar data. Customer data processing conditions follow contracts with the company and its data processing addendum. Deletion of authentication information is managed by distinguishing the Service's leaving the Service processing from retention necessary under that company's contracts and law.

Data processing addendum https://clerk.com/legal/dpa

Privacy information https://clerk.com/legal/privacy

AI Model Providers

Instructions, extracted material contents, outlines, intermediate output and similar information are sent directly to the APIs of the AI model providers that actually generate materials, according to the models used and connection settings. Contractual terms and settings consistent with the non-training policy in Section 6 are used, and conditions regarding storage, monitoring for abuse, processing countries and similar matters are checked and managed. Even when non-storage settings are used, the processing they cover is distinguished.

The AI model providers actually used and their privacy policies and data processing terms are indicated according to the features and connection destinations used.

Web Search

When search features are used, search terms and similar information necessary to research reference information are sent to search providers. Search providers and storage conditions may differ from those for AI inference.

The actual search providers and their data handling conditions are indicated according to the search features used.

Stripe (Card Payments)

Only Stripe is used for the Service's credit card payments. Names, billing details, contract and transaction contents, amounts, payment identifiers and similar information are handled for card registration, billing, payments and prevention of unauthorized use. Depending on processing contents, Stripe handles information as a processor or independent controller and may transfer information to the United States or other countries.

Stripe retains information for periods necessary to provide its services, fulfill contractual rights and obligations, prevent unauthorized use, comply with law and similar purposes. All information retained by Stripe is not deleted simultaneously with leaving the Service from Create GO Agency. Please see the following Privacy Policy and Data Processing Agreement for detailed conditions.

Service agreement https://stripe.com/jp/legal/ssa

Data processing agreement https://stripe.com/jp/legal/dpa

Privacy information https://stripe.com/jp/privacy

Google Authentication, Connections and Fonts

Where Google authentication or connections are used, authorized authentication information, specified files and information necessary for connections are processed. Where Google Fonts is loaded externally, ordinary Web access information is sent for font delivery.

Privacy information https://policies.google.com/privacy?hl=ja

Google API user data policy https://developers.google.com/terms/api-services-user-data-policy

SRD

SRD handles necessary information for development, maintenance, failure response and similar purposes within the scope of outsourcing contracts and assigned permissions. The Company undertakes necessary management concerning confidentiality, purpose limitations, access scope, storage and deletion.