Privacy Policy

1. Definition of Personal Information

In this Privacy Policy, "personal information" means personal information as defined in Article 2, Paragraph 1 of the APPI.

2. Purposes of Use

We use personal information for the following purposes:

• To provide services offered by the Company ("Company Services")
• To provide information about Company Services and respond to inquiries
• To provide information about our products and services
• To respond to conduct that violates terms, policies, or other rules governing Company Services
• To notify Users of changes to terms, policies, and other rules governing Company Services
• To analyze information about use of Company Services and use the results to improve existing services and develop new services
• To manage employment and internal procedures for officers and employees and to screen and communicate with job applicants
• To manage shareholders and perform procedures required by the Companies Act of Japan and other laws for shareholders and holders of share acquisition rights
• To create statistical data related to Company Services in a form that does not identify individuals
• For purposes incidental to any of the purposes above

3. Changes to Purposes of Use

We may change a purpose of use to the extent reasonably related to the original purpose. If we do so, we will notify the individual who is the subject of the personal information ("Data Subject") or publicly announce the change.

4. Use of Personal Information

4.1

Except where permitted by the APPI or other applicable laws, we will not handle personal information beyond the scope necessary to achieve its stated purposes without the Data Subject's consent. This restriction does not apply in the following cases:

• When required by law
• When necessary to protect a person's life, body, or property and obtaining the Data Subject's consent is difficult
• When particularly necessary to improve public health or promote the sound development of children and obtaining the Data Subject's consent is difficult
• When cooperation is necessary for a national or local government agency or its contractor to perform duties prescribed by law and obtaining consent could impede performance of those duties
• When personal data is provided to an academic research institution that needs to handle the data for academic research, including when only part of its purpose is academic research, except where doing so may unjustly infringe individual rights and interests

4.2

We will not use personal information in a manner that may encourage or induce illegal or improper conduct.

5. Proper Acquisition of Personal Information

5.1

We acquire personal information properly and do not acquire it by deception or other improper means.

5.2

We will not acquire special care-required personal information without the Data Subject's prior consent, except in the following cases:

• When any of items 1 through 4 of Section 4.1 applies
• When acquiring the information from an academic research institution is necessary for joint academic research with that institution, including where only part of the acquisition purpose is academic research, except where doing so may unjustly infringe individual rights and interests
• When the information has been made public by the Data Subject, a national or local government agency, an academic research institution, a person listed in Article 57, Paragraph 1 of the APPI, or another person specified by the rules of the Personal Information Protection Commission of Japan
• When acquiring visibly apparent special care-required personal information by observing or photographing the Data Subject
• When receiving the information from a third party and that third party's provision falls within any item of Section 8.1

5.3

When receiving personal information from a third party, we will verify the following matters as prescribed by the rules of the Personal Information Protection Commission, except where that third party's provision falls within an item of Section 4.1 or Section 8.1:

• The third party's name and address and, for a corporation or an unincorporated organization with a representative or administrator, the name of that representative or administrator
• How the third party acquired the personal information

6. Security Management

We provide necessary and appropriate supervision of our employees to ensure that personal information is managed securely against risks such as loss, destruction, alteration, and disclosure. If we outsource all or part of the handling of personal information, we provide necessary and appropriate supervision to ensure secure management by the contractor. Upon a Data Subject's request, we will respond without delay with details of the specific security measures applied to retained personal data.

7. Reporting and Notice of Data Incidents

If personal information handled by us is leaked, lost, damaged, or otherwise affected and the APPI requires a report to the Personal Information Protection Commission or notice to the Data Subject, we will make the required report and provide the required notice.

8. Provision to Third Parties

8.1

Except where an item of Section 4.1 applies, we will not provide personal information to a third party without the Data Subject's prior consent. The following are not treated as provision to a third party:

• Providing personal information in connection with outsourcing all or part of its handling to the extent necessary to achieve a purpose of use
• Providing personal information in connection with a business succession resulting from a merger or other cause
• Joint use permitted under the APPI

8.2

Notwithstanding Section 8.1, except where an item of Section 4.1 applies, before providing personal information to a third party in a foreign country we will obtain the Data Subject's prior consent to such provision. This requirement does not apply to a country designated by the rules of the Personal Information Protection Commission under Article 28 of the APPI or to a recipient that maintains a system meeting standards designated under those rules.

8.3

When obtaining consent under Section 8.2, we will provide the Data Subject with the following information. If the first item cannot be identified, in place of the first and second items we will state that it cannot be identified and explain why, and will provide any alternative information useful to the Data Subject:

• The name of the foreign country
• Information about that country's personal information protection system
• Information about measures taken by the third party to protect personal information, or a statement that the information cannot be provided and the reason why

8.4

When we provide personal information to a third party, we create and retain records in accordance with Article 29 of the APPI.

8.5

When we receive personal information from a third party, we perform necessary verification and create and retain records in accordance with Article 30 of the APPI.

9. Disclosure of Personal Information and Related Records

9.1

When a Data Subject requests disclosure of personal information under the APPI, we will verify that the request is made by the Data Subject and disclose the information without delay, or notify the Data Subject if the information does not exist. This does not apply where we have no disclosure obligation under the APPI or another law. We charge a fee of JPY 1,320 for each request to disclose personal information.

9.2

The preceding paragraph applies correspondingly to records identifying the Data Subject that were created under Section 8.4 for provision to a third party or under Section 8.5 for receipt from a third party, except for the provision concerning fees.

10. Correction of Personal Information

If a Data Subject requests correction, addition, or deletion of personal information ("Correction") under the APPI on the ground that the information is untrue, we will verify that the request is made by the Data Subject, promptly conduct the investigation necessary to achieve the purpose of use, make the Correction based on the result, and notify the Data Subject. If we decide not to make the Correction, we will notify the Data Subject of that decision. This does not apply where we have no obligation to make a Correction under the APPI or another law.

11. Suspension of Use and Related Measures

If a Data Subject makes a request under the APPI and the request is found to have merit, we will verify that it is made by the Data Subject and, without delay, suspend use or delete the applicable personal information ("Suspension of Use"), stop its provision to third parties ("Suspension of Provision"), and notify the Data Subject, as applicable. This applies when: (1) the information is handled beyond a publicly stated purpose of use, is used in a manner that may encourage or induce illegal or improper conduct, or was acquired by deception or other improper means; (2) the information is provided to a third party without the Data Subject's consent; or (3) we no longer need to use the information, an incident described in the main clause of Article 26, Paragraph 1 of the APPI has occurred, or handling the information may harm the Data Subject's rights or legitimate interests. This does not apply where we have no obligation to suspend use or provision under the APPI or another law.

12. Provision of Personally Referable Information to Third Parties

12.1

If a third party is expected to acquire personally referable information, as defined in Article 2, Paragraph 7 of the APPI and limited to information constituting a personally referable information database or equivalent under Article 16, Paragraph 7, as personal data, then except where an item of Section 4.1 applies, we will not provide that information without first confirming the following matters in the manner prescribed by the rules of the Personal Information Protection Commission:

• The Data Subject has consented to the third party receiving the personally referable information from us and acquiring it as personal data that identifies the Data Subject.
• For provision to a third party in a foreign country, when seeking the consent described above, the Data Subject has first been provided with information about that country's personal information protection system, measures taken by the third party to protect personal information, and other information useful to the Data Subject, as prescribed by the rules of the Personal Information Protection Commission.

12.2

When we provide personally referable information to a third party under the preceding paragraph, we create and retain records in accordance with Article 31 of the APPI.

12.3

When we receive personally referable information from a third party as personal data, we perform the verification required by the APPI and create and retain records of that verification.

13. Cookies and Similar Technologies

Company Services may use cookies and similar technologies. These technologies help us understand how Company Services are used and improve them. Users who wish to disable cookies may do so through their browser settings. Disabling cookies may make some features of Company Services unavailable.

14. Handling of Information in AGI Wings

In addition to the preceding provisions, this section applies to AGI Worker, our platform service that automatically executes code created by Users ("Handlers").

14.1 Handler Execution

We execute Handlers created by Users in execution environments isolated from other Users. To provide and improve this feature, we collect and store:

• The date and time of Handler execution, execution results, and error information
• The Handler code as it existed at the time of execution

14.2 Storage of External Service Connection Information

If a User creates a connection to an external service ("Connection"), we collect and store credentials issued by that service.

• Credentials are stored in encrypted form and are designed so that our employees cannot view them in plaintext using ordinary operational access privileges alone.
• When a User deletes a Connection, we promptly delete the applicable credentials.

14.3 Scheduled Execution and External API Calls

• Users may schedule Handlers for automatic execution.
• A Handler may issue requests to an external service's API depending on its processing logic.
• When a Handler runs, credentials associated with a Connection created in advance by the User are used automatically to the extent necessary. The external service will treat resulting operations as operations performed using the User's own credentials.

14.4 Retention of Execution History

We retain up to the 100 most recent execution records for each Handler and automatically delete older records beyond that limit. Execution history includes the Handler code at the time of execution, execution results, and error information.

14.5 Data Handling upon Cancellation or Account Closure

• If a User cancels a paid plan, we stop automatic Handler execution.
• If a User closes their account for Company Services, we delete all Handlers, Connections, execution history, and other AGI Wings data associated with that User within 30 days after account closure.

15. Contact

Please direct requests for disclosure, opinions, questions, complaints, and other inquiries about our handling of personal information to the following contact:

16. Continuous Improvement

We periodically review how we handle personal information, endeavor to make continuous improvements, and may amend this Privacy Policy as necessary.