Ethical Hacker User Terms of Service

Note

IMPORTANT / 重要: The Japanese version of these Terms is the original and authoritative version. The English version is provided for convenience only. In the event of any discrepancy between the Japanese and English versions, the Japanese version shall prevail.

本規約の日本語版が正文となります。英語版は参考のために提供されるものであり、日本語版と英語版の間に矛盾がある場合は、日本語版が優先します。

English Version (For Convenience)

Article 1 (Application)

1. These Terms apply to all relationships concerning the use of the BBHunt Japan platform (the “Service”) as an ethical hacker user (as defined in Article 2) provided by BBHunt Japan K.K. (the “Company”).
2. An ethical hacker user shall be deemed to have agreed to these Terms upon commencing use of the Service.
3. Rules and other provisions posted by the Company on the Service from time to time shall constitute part of these Terms.

Article 2 (Definitions)

1. “Service” means the bug bounty platform operated by the Company, which provides a platform for organizations (“Clients”) to request vulnerability assessments of their services and for security researchers to discover and report vulnerabilities.
2. “Ethical Hacker User” (hereinafter referred to as “Hacker”) means a registered user who conducts vulnerability assessments and reports on Client services through the Service, including all ethical hackers, cybersecurity experts, security researchers, and other registered users.
3. “Vulnerability Information” means information regarding vulnerabilities discovered by a Hacker and reported through the Service.
4. “Reward” means compensation paid by a Client to a Hacker for vulnerability reports.
5. “Program” means the vulnerability assessment request details, scope, reward amounts, and other information published by Clients on the Service.

Article 3 (Registration)

1. Any person wishing to use the Service as a Hacker (“Applicant”) may apply for registration by agreeing to these Terms and providing information designated by the Company in the manner prescribed by the Company.
2. Registration as a Hacker requires meeting the following conditions: (1) Being at least 18 years of age (2) Not being a resident of, or accessing the Service from, a country against which Japan has issued export sanctions or other trade restrictions (3) Being able to communicate in Japanese or English (4) Not being an employee of the Company (including former employees). Additionally, when participating in each program, not being an employee of the Client of that program (including former employees) (5) Not being an organized crime group or equivalent (boryokudan) (6) Completing identity verification as set forth in Article 4
3. The Company may refuse registration if the Applicant does not meet the above conditions or falls under any of the following: (1) The Company determines there is a risk of violation of these Terms (2) False, erroneous, or omitted information was provided (3) The Applicant previously had registration cancelled (4) The Company otherwise determines registration is inappropriate

Article 4 (Identity Verification - KYC)

1. Hackers are required to complete the Company’s prescribed Know Your Customer (“KYC”) process to use the Service.
2. The KYC process includes providing the following information: (1) Identity verification documents (passport, driver’s license, or other government-issued identification accepted by the Company) (2) Proof of address (utility bills, bank statements, etc.) (3) Other information designated by the Company
3. The Company may refuse or cancel a Hacker’s registration if the KYC process cannot verify the Hacker’s identity or if false information is provided.
4. Hackers shall promptly notify the Company of any changes to the information provided during the KYC process and provide updated information.
5. The Company will not use personal information collected during the KYC process for purposes other than identity verification.

Article 5 (Payment Accounts)

1. To receive Rewards, Hackers must register a valid PayPal account and complete the Company’s verification.
2. Hackers shall provide accurate payment account information (PayPal account, etc.) and shall not provide false information.
3. Hackers shall promptly notify the Company of any changes to payment account information and provide updated information.
4. The Company may withhold Reward payments to Hackers whose payment account verification has not been completed.
5. The Company may introduce other payment methods in the future in addition to PayPal.

Article 6 (Account Management)

1. Hackers shall manage their account information at their own responsibility and shall not allow third parties to use, lend, transfer, or sell their accounts.
2. Hackers shall be liable for damages arising from inadequate management or third-party use of account information, and the Company shall bear no responsibility.
3. If a Hacker discovers that their account information has been stolen or is being used by a third party, they must immediately notify the Company.

Article 7 (Program Participation)

1. Hackers may participate in programs published on the Service and conduct vulnerability assessments within the scope of such programs.
2. Before participating in a program, Hackers must review and agree to the program’s terms, scope, and reward amounts.
3. Hackers shall not conduct investigations outside the scope of programs.

Article 8 (Reporting Obligations and Quality)

1. Hackers shall report discovered vulnerabilities through the Company’s prescribed reporting form.
2. Reports must meet the following quality standards: (1) Clear reproduction steps for the vulnerability (2) Description of the vulnerability’s impact and severity (3) Textual explanation (not video or images only) (4) One vulnerability per report
3. Hackers shall respond in good faith to questions from the Company or Clients.

Article 9 (Rewards)

1. When a Client receives a Hacker’s report and decides to pay a reward, the Hacker will be notified through the method prescribed by the Company.
2. Upon the Client’s completion of the reward award process and payment of the PayPal invoice, the Company shall pay the Reward to the Hacker via PayPal.
3. Clients pay a Reward Fee to the Company for handling Reward payments to Hackers. The Reward Fee is borne by the Client and is not deducted from the Hacker’s Reward.
4. Upon the Hacker’s receipt of the Reward, the entire reward award transaction shall be deemed completed.
5. Hackers shall specify the PayPal account registered under Article 5 for receiving Rewards.
6. Taxes may be imposed on rewards depending on the Hacker’s location. Hackers are responsible for their own tax filings.

Article 10 (Prohibited Activities)

Hackers shall not engage in the following activities when using the Service:

1. Investigations outside program scope
2. Brute force or credential guessing to gain access
3. Social engineering
4. Denial of service (DoS) attacks
5. Submitting reports using only automated scanners or tools
6. Attacks on Client employees, customers, or partners
7. Extracting, downloading, or exfiltrating personal information or confidential data
8. Viewing, deleting, modifying, or publishing data using discovered vulnerabilities
9. Disclosing vulnerabilities without prior written consent from the Company or Client
10. Unauthorized access to others’ personal information
11. Infringement of the Company’s or other users’ intellectual property rights
12. Criminal acts or acts contrary to public order and morality
13. Sending computer viruses or other harmful programs
14. Interfering with the Company’s operation of the Service
15. Other activities the Company deems inappropriate

Article 11 (Safe Harbor)

1. The Company shall request each Client publishing programs on the Service to agree not to take legal action against Hackers who conduct vulnerability assessments and reports in good faith in accordance with these Terms and individual program terms.
2. Hackers who conduct vulnerability assessments and reports in good faith in accordance with these Terms and individual program terms may receive safe harbor protection from the Client of that program. However, the scope and content of such protection shall be determined by each Client.
3. The Company does not guarantee the provision of safe harbor protection by Clients. The Company shall bear no liability in cases where a Client does not provide safe harbor protection or where third parties other than the Client take legal action.
4. This safe harbor provision does not apply if the Hacker’s activities do not comply with these Terms or individual program terms.
5. Hackers shall not make any claims against the Company for damages arising from safe harbor protection under this Article. The Company shall bear no liability to Hackers or third parties for damages arising from the provision or non-provision of safe harbor protection.

Article 12 (Confidentiality)

1. Hackers shall treat all information obtained through the Service as confidential information of the Company and Clients.
2. Hackers may use confidential information only for the following purposes: (1) Reporting vulnerabilities to the Company or Clients (2) Providing additional information requested by the Company or Clients in connection with reports
3. Hackers shall not use, disclose, or distribute confidential information without prior written consent from the Company or Clients.
4. Upon request from the Company or Clients, Hackers shall permanently delete all confidential information.

Article 13 (Intellectual Property)

1. Hackers represent and warrant that their vulnerability reports are original and that they have the right to submit them.
2. By submitting reports, Hackers grant the Company and Clients the right to use such reports for any purpose.
3. All intellectual property rights related to the Service belong to the Company or legitimate rights holders.

Article 14 (Personal Information)

1. The Company shall appropriately handle Hackers’ personal information in accordance with the Act on the Protection of Personal Information (APPI).
2. The handling of Hackers’ personal information shall be as set forth in the Company’s Privacy Policy.

Article 15 (Disclaimer)

1. The Company shall bear no liability for damages arising from interruption, suspension, termination, unavailability, or changes to the Service.
2. The Company shall bear no liability for disputes between Clients and Hackers regarding reward payments.
3. The Company shall bear no liability for damages arising from actions taken by Hackers based on information obtained through the Service.

Article 16 (Account Suspension and Cancellation)

1. The Company may suspend or cancel a Hacker’s account without prior notice if the Hacker falls under any of the following: (1) Violation of these Terms (2) Discovery of false information in registration or KYC process (3) The Company determines the Hacker is or may be an organized crime group (4) No use of the Service for more than one year and no response to Company communications (5) The Company otherwise determines continued registration is inappropriate
2. If registration is cancelled pursuant to the preceding paragraph, any unpaid reward obligations shall be extinguished.

Article 17 (Exclusion of Anti-Social Forces)

1. Hackers represent and warrant that they and their key management personnel are not anti-social forces at the time of commencing use of the Service and guarantee they will not become such during the period of use.
2. Hackers guarantee that they will not engage in violent demands, unreasonable demands beyond legal responsibility, threatening behavior or violence in connection with the use of the Service.

Article 18 (Amendment of Terms)

1. The Company may amend these Terms.
2. When amending these Terms, the Company will notify Hackers of such changes. If a Hacker uses the Service after notification or does not complete cancellation procedures within the period prescribed by the Company, the Hacker shall be deemed to have agreed to the amendments.

Article 19 (Governing Law and Jurisdiction)

1. These Terms shall be governed by Japanese law.
2. Any disputes arising from or in connection with these Terms shall be subject to the exclusive jurisdiction of the Osaka District Court or Osaka Summary Court as the court of first instance.

Article 20 (Consultation)

Any matters not provided for in these Terms or any doubts arising regarding the interpretation of these Terms shall be resolved through consultation between the Hacker and the Company in good faith.

Article 21 (Language)

The Japanese version of these Terms is the authoritative version. In the event of any discrepancy between the Japanese and English versions, the Japanese version shall prevail.