Client Terms of Service

Note

IMPORTANT / 重要: The Japanese version of these Terms is the original and authoritative version. The English version is provided for convenience only. In the event of any discrepancy between the Japanese and English versions, the Japanese version shall prevail.

本規約の日本語版が正文となります。英語版は参考のために提供されるものであり、日本語版と英語版の間に矛盾がある場合は、日本語版が優先します。

English Version (For Convenience)

Article 1 (Application)

1. These Terms apply to all relationships concerning the use of the BBHunt Japan platform (the “Service”) as a Client (as defined in Article 2) provided by BBHunt Japan K.K. (the “Company”).
2. A Client shall be deemed to have agreed to these Terms upon commencing use of the Service.
3. Rules and other provisions posted by the Company on the Service from time to time shall constitute part of these Terms.

Article 2 (Definitions)

1. “Service” means the bug bounty platform operated by the Company, which provides a platform for organizations to request vulnerability assessments of their services and receive vulnerability reports from security researchers.
2. “Client” means a registered user (corporation or organization) that registers on the Service and requests vulnerability assessments of their services.
3. “Ethical Hacker User” (hereinafter referred to as “Hacker”) means a registered user who conducts vulnerability assessments and reports on Client services through the Service, including all ethical hackers, cybersecurity experts, security researchers, and other registered users.
4. “Vulnerability Information” means information regarding vulnerabilities discovered by Hackers and reported through the Service.
5. “Reward” means compensation paid by a Client to a Hacker for vulnerability reports.
6. “Reward Fee” means the fee paid by Clients to the Company for handling Reward payments to Hackers. The Reward Fee rate is as specified on the Company’s website and is generally 20% of the Reward amount plus consumption tax.
7. “Program” means the vulnerability assessment request details, scope, reward amounts, and other information published by Clients on the Service.
8. “Usage Fee” means the fee paid by Clients to the Company for use of the Service.

Article 3 (Registration)

1. Any person wishing to use the Service as a Client (“Applicant”) may apply for registration by agreeing to these Terms and providing information designated by the Company in the manner prescribed by the Company.
2. Registration applications must be made by the corporation or organization itself that will use the Service; registration by proxy is generally not permitted.
3. Applicants must provide true, accurate, and current information to the Company when applying for registration.
4. The Company may refuse registration if the Applicant falls under any of the following: (1) The Company determines there is a risk of violation of these Terms (2) False, erroneous, or omitted information was provided (3) The Applicant previously had registration cancelled (4) The Company determines the Applicant is or may be an organized crime group (5) The Company otherwise determines registration is inappropriate

Article 4 (Account Management)

1. Clients shall manage their account information at their own responsibility and shall not allow third parties to use, lend, transfer, or sell their accounts.
2. Clients may set the following roles and invite team members: (1) Owner: Full administrative access, cannot be removed (2) Admin: Full access to program settings and reports (3) Triager: Can process and respond to reports, cannot change program settings (4) Viewer: Read-only access to reports and program information
3. Clients shall be liable for damages arising from inadequate management or third-party use of account information, and the Company shall bear no responsibility.

Article 5 (Program Creation and Publication)

1. Clients may create and publish programs on the Service through the method prescribed by the Company.
2. Programs shall include the following information: (1) Description of the service to be assessed (2) In-scope targets (3) Out-of-scope targets (4) Reward amounts or criteria for determining rewards (5) Program terms and rules (6) Other information designated by the Company
3. Clients may publish programs in the following modes: (1) Public programs: Available to all Hackers (2) Restricted programs: Available to specific Hackers only (3) Invite-only programs: Available only to Hackers invited by the Client
4. Clients may update program contents at any time and shall notify Hackers of such updates.

Article 6 (Report Receipt and Evaluation)

1. Clients shall receive and evaluate vulnerability reports submitted by Hackers.
2. Upon receiving a report, Clients shall take one of the following actions within a reasonable period: (1) Decide to pay a reward (2) Reject the report (with reasons) (3) Request additional information from the Hacker
3. Clients shall respond with respect toward Hackers.

Article 7 (Reward Payment)

1. When a Client decides to pay a reward for a Hacker’s report, the Client shall initiate the reward award process on the Service.
2. Upon completion of the reward award process by the Client, a PayPal invoice containing the Reward amount and the Reward Fee will be automatically sent to the Client.
3. The Client shall pay the PayPal invoice.
4. Upon the Client’s payment of the PayPal invoice, the Company shall pay the Reward to the Hacker via PayPal, and the Company shall retain the Reward Fee.
5. Upon the Hacker’s receipt of the Reward, the entire reward award transaction shall be deemed completed.
6. Clients may not request refund of Rewards and Reward Fees for any reason.

Article 8 (Usage Fees and Payment Methods)

1. Clients shall bear the usage fees as specified on the Company’s website.
2. Usage fees may be paid via PayPal, bank transfer, or other payment methods that the Company may introduce in the future.
3. Usage fees are calculated on a monthly basis (closing at the end of each month), and Clients shall pay the current month’s usage fee by the end of the following month through the method designated by the Company.
4. No pro-rata refund shall be made even if the Client terminates use of the Service mid-month.
5. If a Client delays payment of usage fees, the Client shall pay late payment interest at a rate of 14.6% per annum.

Article 9 (Team Member Management)

1. Clients may invite team members for program operations.
2. Team member invitations shall be made through the method prescribed by the Company.
3. Clients shall be fully responsible for the actions of their team members.

Article 10 (Hacker Invitation and Access Management)

1. Clients may directly invite Hackers to restricted or invite-only programs.
2. Clients may review, approve, or reject access requests from Hackers.
3. Clients shall be solely responsible for selecting and approving Hacker participation.

Article 11 (Confidentiality)

1. Clients shall treat all information obtained about Hackers through the Service as confidential information.
2. Clients may use confidential information only for the purpose of evaluating and remediating vulnerabilities.
3. Clients shall not disclose or distribute confidential information to third parties without prior written consent from the Company.

Article 12 (Safe Harbor)

1. Clients agree not to take legal action against Hackers who conduct vulnerability assessments and reports in good faith in accordance with the Company’s terms of use and individual program terms for each program published on the Service.
2. Clients shall clearly define the scope and conditions of safe harbor protection in each program’s terms.
3. The Company shall bear no liability in cases where a Client does not provide safe harbor protection or where third parties other than the Client take legal action against Hackers.
4. The Company does not guarantee the provision of safe harbor protection by Clients.
5. Clients shall not make any claims against the Company for damages arising from safe harbor protection.

Article 13 (Handling of Vulnerability Information)

1. Clients acknowledge that the Company makes no warranties regarding the accuracy or appropriateness of Vulnerability Information provided by Hackers.
2. Clients shall take remedial measures at their own responsibility based on Vulnerability Information.
3. The Company shall bear no liability for the content of Vulnerability Information or damages arising from such information.

Article 14 (Prohibited Activities)

Clients shall not engage in the following activities when using the Service:

1. Infringing the intellectual property rights of the Company or other users
2. Criminal acts or acts contrary to public order and morality
3. Interfering with the Company’s operation of the Service
4. Unreasonable reduction or refusal of rewards to Hackers
5. Threatening, harassing, or making unreasonable demands of Hackers
6. Improper use of Vulnerability Information
7. Other activities the Company deems inappropriate

Article 15 (Disclaimer)

1. The Company shall bear no liability for damages arising from interruption, suspension, termination, unavailability, or changes to the Service.
2. The Company shall bear no liability for damages caused to Clients by Hacker actions.
3. The Company shall bear no liability for damages arising from Vulnerability Information or actions taken by Clients based on such information.
4. The Company shall bear no liability for damages incurred by Clients in connection with the Service. Even if the Company is liable for damages under the Consumer Contract Act or other reasons, the Company’s liability shall be limited to the total usage fees actually received from the Client in the past 3 months prior to the occurrence of the damage or 1,000 yen, whichever is greater.

Article 15 (Account Suspension and Cancellation)

1. The Company may suspend or cancel a Client’s account without prior notice or demand if the Client falls under any of the following: (1) Violation of these Terms (2) Discovery of false information in registration (3) Delay in payment of usage fees (4) The Company determines the Client is or may be an organized crime group (5) Suspension of payment, insolvency, or filing of bankruptcy proceedings (6) No use of the Service for more than one year and no response to Company communications (7) The Company otherwise determines continued registration is inappropriate
2. The Company may cancel a Client’s registration by providing 30 days’ prior notice.

Article 16 (Exclusion of Anti-Social Forces)

1. Clients represent and warrant that they and their directors, executive officers, and key management personnel are not anti-social forces at the time of commencing use of the Service and guarantee they will not become such during the period of use.
2. Clients guarantee that they will not engage in violent demands, unreasonable demands beyond legal responsibility, threatening behavior or violence in connection with the use of the Service.

Article 17 (Amendment of Terms)

1. The Company may amend these Terms.
2. When amending these Terms, the Company will notify Clients of such changes. If a Client uses the Service after notification or does not complete cancellation procedures within the period prescribed by the Company, the Client shall be deemed to have agreed to the amendments.

Article 18 (Governing Law and Jurisdiction)

1. These Terms shall be governed by Japanese law.
2. Any disputes arising from or in connection with these Terms shall be subject to the exclusive jurisdiction of the Osaka District Court or Osaka Summary Court as the court of first instance.

Article 19 (Consultation)

Any matters not provided for in these Terms or any doubts arising regarding the interpretation of these Terms shall be resolved through consultation between the Client and the Company in good faith.

Article 20 (Language)

The Japanese version of these Terms is the authoritative version. In the event of any discrepancy between the Japanese and English versions, the Japanese version shall prevail.