ENSOR Privacy Policy

REHATCH Inc. (hereinafter the "Company") establishes this Privacy Policy (hereinafter this "Policy") as follows regarding the handling of personal information and data obtained from external services in "ENSOR," a SaaS service using generative AI and AI agent technology provided by the Company (hereinafter the "Service"). Unless otherwise provided in this Policy, terms used in this Policy follow the "ENSOR Terms of Service."

Article 1 (User Information Collected and Methods of Collection)

1. The user information collected by the Company is as follows.
   1. Identity information: company name, name, email address, and telephone number
   2. Service usage information: login information, information entered by the user when creating the Account, and service usage history
   3. External integration information: identification and account information obtained through OAuth authentication with external services that the user has authorized to integrate (e.g., Google, Facebook, Salesforce, LinkedIn, and others)
   4. External service registration information: customer data, sales data, access analytics data, and other business-related data managed by the user in integrated external services
2. Methods of collection
   1. Input by the user
   2. Tracking features within the Service
   3. Automatic acquisition through external service integration

Article 2 (Purposes of Use)

The Company uses the user information it obtains for the following purposes.

1. Providing, maintaining, and improving the Service
2. User support and responding to inquiries
3. Personalizing features within the Service
4. Data analysis and preparation of statistical reports
5. Planning marketing initiatives

The Company's use of user information obtained via Google APIs (including raw data and derived data generated from it) complies with the Google API Services User Data Policy, including the Limited Use requirements. Such information is not used to develop, train, or improve generalized machine learning or AI models, and is not transferred or sold to third parties.

Information obtained via the APIs of external services that the user has authorized to connect (including LinkedIn) is used for operations on that service that the user has requested (for example, posting to a company page, submitting advertisements, retrieving post content, displaying performance within the scope the user requested, and drafting the next post), and is handled in compliance with each service's API terms and data storage requirements. Such information is not used to develop, train, or improve generalized machine learning or AI models, and is not transferred or sold to third parties. When the user disconnects that service, information obtained through that connection is deleted in accordance with that service's terms.

Article 3 (Handling of Cookies and Similar Technologies)

1. The Service uses cookies and similar technologies to analyze how users use the Service.
2. Users can disable cookies through their browser settings, but some features may be restricted.

Article 4 (Provision to Third Parties and Exceptions)

1. The Company does not provide users' personal information to third parties without the user's consent, except in the following cases.
   1. When the Company entrusts it to a cloud provider to the extent necessary to provide the Service
      • Recipients: Google Cloud Japan G.K. (Roppongi Hills Mori Tower, 6-10-1 Roppongi, Minato-ku, Tokyo) and Google LLC (California, United States)
      • Entrusted work: data storage and processing with Google Cloud BigQuery, server operation and management, and backup storage
   2. When disclosure is required by law
   3. When it is necessary to protect a person's life or body and it is difficult to obtain consent
   4. When the business operator changes due to a merger, business transfer, or the like
2. Even in the cases above, the Company takes appropriate contractual and security control measures.

Article 5 (Security Control Measures)

To prevent leakage, loss, or damage of user information and data obtained from external services, the Company takes the following organizational, personnel, and technical security control measures.

1. Encryption in transit: encrypted communication using TLS 1.2 or later
2. Encryption at rest: encryption at rest using the standard encryption methods of Google Cloud Platform, such as AES-256
3. Access control: least-privilege access through IAM policies and the like
4. Audit logs: collection and periodic review of access logs
5. Physical protection: compliance with the data center security standards of Google Cloud Platform

The Company will respond in good faith to inquiries from users about its security control measures. For details of the security control measures taken by the Company, please contact the inquiry desk in Article 9.

Article 6 (Disclosure, Correction, and Deletion of Personal Information and Retention Period)

1. Users may request disclosure, correction, or deletion of their own personal information through the procedures prescribed by the Company. For the procedures, please contact the inquiry desk in Article 9.
2. Upon receiving a request, the Company will verify the user's identity and respond within a reasonable period.
3. Retention period: users' personal information is retained for three months after deletion of the Account or completion of the deletion procedure, and is then erased.

Article 7 (Consent)

By pressing the sign-up button, the user is deemed to have agreed to the contents of this Policy.

Article 8 (Changes to this Privacy Policy)

The Company may revise this Policy at any time. The revised Policy takes effect when it is posted on the Company's website, so please check it periodically.

Article 9 (Inquiry Desk)

Please contact the following desk with any questions, requests, or complaints regarding this Policy.

▶︎ Inquiry form: https://re-hatch.jp/contact/