Privacy Policy

1. Who is responsible

Apia Business Affairs Co., Ltd., 1F, 4-8-17 Chuo, Aoba-ku, Sendai-shi, Miyagi 980-0021, Japan, is the operator of the Service and the entity responsible for the handling of personal information described in this policy (the "Company").

This policy is drawn up in accordance with the Act on the Protection of Personal Information of Japan (APPI). Where the General Data Protection Regulation (EU) 2016/679 or the UK GDPR applies to you, the Company acts as controller in respect of the processing described here.

2. Information we collect

• Account information — e-mail address, password credential, display name, the language you use, and your plan and credit balance.
• Billing information — plan, transaction history and the identifier issued by our payment provider. Full card numbers are handled by the payment provider and are never received or stored by the Company.
• User Input — the text, keywords, documents, images and settings you submit in order to run a search or an analysis.
• Usage information — feature usage, credit consumption, timestamps, and technical event logs required to operate and secure the Service. This includes execution records of each search or analysis (date and time, processing status, error type and credits consumed), which contain none of the content of your input or its results.
• Device and connection information — IP address, browser type and similar technical data recorded by our infrastructure for security and abuse prevention.

3. Purposes of use

The Company uses personal information only for the following purposes:

• To provide, operate and maintain the Service, including running the searches and analyses you request.
• To manage accounts, plans, credits, billing and payment.
• To provide support and to respond to enquiries.
• To detect, prevent and investigate fraud, abuse, and security incidents.
• To improve reliability and quality of the Service, using aggregated or de-identified information wherever the purpose can be achieved without personal information.
• To send service notices, and — only where you have opted in, or where permitted by law — information about the Service.
• To comply with legal obligations and to establish, exercise or defend legal claims.

4. Legal bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, processing is based on: performance of the contract with you (provision of the Service, billing and support); our legitimate interests (security, abuse prevention, service improvement), balanced against your rights; compliance with a legal obligation; and your consent, where consent is requested.

Where processing relies on consent, you may withdraw it at any time; withdrawal does not affect processing carried out before withdrawal.

5. User Input, files and images

User Input is processed for the sole purpose of producing the result you requested. The Company does not use User Input, or the results derived from it, to train or improve AI or machine-learning models.

User Input and the results of searches and analyses are not stored permanently. They are held for the duration of the request and discarded once the result has been returned, except for the time-limited records described in section 8 (for example, records kept to run searches for you, which are deleted after thirty (30) days, and search-improvement records not linked to any account, which are deleted after three (3) months). Images and documents that you upload for analysis are processed transiently and are not written to a permanent image or document store.

Items that you choose to save yourself — for example saved reports or keywords you register — are stored in your account so that you can retrieve them, and are visible only to you. Database access control is enforced at row level, so no other user can read your records.

The Company does not sell User Input.

6. Service providers

The Company engages third-party providers to operate the Service, and discloses to them only the information necessary for the task entrusted to them.

AI language-processing providers are engaged under terms that do not permit the information they process to be used to train their models. Information retrieval providers receive only search keywords, never the text you enter or the documents you upload; their handling of those keywords is governed by their own terms.

Information that you choose to send to an external service you connect to the Service — for example a note-taking application, an AI assistant or an AI agent (see section 24 of the Terms of Service) — is transferred at your instruction and is not entrusted to a service provider of the Company. Its handling is governed by that external service's own terms of use and privacy policy.

The categories of provider are:

• Cloud infrastructure, database and hosting providers.
• Payment processing providers.
• AI language-processing and translation providers, used to analyse and translate source material.
• Information retrieval providers, used to locate publicly available sources.
• Communication providers, used to deliver transactional e-mail.

7. International transfers

The Service is operated globally and the providers described above may process information in countries other than your own, including the United States and countries within the European Economic Area.

Where personal information is transferred out of the EEA, the UK, or Japan, the Company relies on an adequacy decision where one is available, and otherwise on Standard Contractual Clauses or an equivalent lawful transfer mechanism, together with the contractual and technical safeguards described in this policy.

8. Retention

Accounts are deleted automatically, after prior notice by email, in the cases set out in section 5 of the Terms of Service: where an account holds no valid credits or API credits and has no active subscription, it is deleted fourteen (14) days after the notice once there has been no activity (sign-in or API request) for ninety (90) days. You may also delete your account yourself, either at the end of a paid period or immediately.

Account information is retained for as long as the account exists and is deleted when the account is deleted. Payment records are then kept only in an anonymised form (payment IDs, a random identifier that is not linked to you, amounts, currency, dates and country codes): in our own systems for two (2) years, and, for the seven (7) years required by tax legislation, with our payment processor and in our accounting records.

Transient uploads are not retained after the request completes. Technical logs of the Service's scheduled processing are retained for fourteen (14) days, and logs of its data-collection and video-processing jobs for ninety (90) days; none of these contain personal information. Records of actions taken by our administrators are retained for one (1) year for security and accountability, and are then deleted automatically.

Execution records of searches and analyses, which contain none of the content of your input or its results, are retained for 30 days for fault investigation, incident response and the accurate management of credits, and are then deleted automatically.

The credit history of an account (credits used, refunded, purchased or expired, with the reason and date) is retained for one (1) year for enquiries, fraud prevention and the accurate management of credits, and is deleted together with the account.

Search-improvement records — individual search keywords, the number of results, the country searched and the date, held without any link to an account, IP address or other personal information — are retained for three (3) months to improve dictionaries and search quality, and are then deleted automatically.

Records kept to run searches for you (for example, academic search history, research results and keyword-extraction records) are deleted automatically after thirty (30) days, and are deleted together with the account.

Consent records. Each time you agree to a safety or disclaimer notice before using certain tools (for example, clinical analysis, the medicines and medical data search, allergy history, patent search and contract checks), we record your account identifier, the tool, the version of the notice and the date; these records are kept for thirty (30) days and are then deleted automatically. The record of your first agreement to the terms of the veterinary tools is kept while your account exists; when the account is deleted, it is anonymised so that it is no longer linked to you (only a random identifier, the version of the notice and the date remain) and is kept for two (2) years as evidence that the notice was accepted, and is then deleted.

Enquiries to our support desk and their messages are kept for one (1) year after the enquiry is closed and are deleted together with the account; attached images are deleted when the enquiry is closed or after seven (7) days.

If you tell us why you are closing your account, your answer is stored without your account, email address or any other identifier, and is deleted after one (1) year.

Email addresses to which delivery failed, or from which a message was reported as spam, are kept to protect the delivery of our email, and are deleted when the account is deleted. Records of the status of a subscription received from our payment processor are anonymised when the account is deleted, in the same way as payment records, and are deleted after two (2) years.

9. Security

The Company applies technical and organisational measures appropriate to the risk, including encryption in transit, authenticated access to all functions that read or write user data, row-level access control in the database, least-privilege credentials, and server-side isolation of all keys and secrets.

No system can be guaranteed absolutely secure. If a breach affecting your personal information occurs, the Company will notify you and the competent supervisory authority where required by applicable law.

10. Your rights

Under the APPI you may request disclosure, correction, addition, deletion, cessation of use, or cessation of third-party provision of your retained personal data, and disclosure of records of third-party provision.

Where the GDPR or UK GDPR applies, you also have the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests, and the right to lodge a complaint with your supervisory authority.

Requests are made using the contact details in section 13. The Company will verify your identity before responding, and will respond within the period required by applicable law.

11. Cookies and similar technologies

The Service uses cookies and equivalent browser storage that are strictly necessary to operate it — in particular to keep you signed in, to remember your language, and to protect against abuse.

The Service does not use advertising cookies and does not sell or share personal information for cross-context behavioural advertising.

12. Children

The Service is intended for professional and business use and is not directed at children. The Company does not knowingly collect personal information from a child below the age at which consent is valid in their country of residence. If such information has been collected, it will be deleted on notice.

13. Contact and complaints

Enquiries relating to this policy, and requests under section 10, may be addressed to Apia Business Affairs Co., Ltd., 1F, 4-8-17 Chuo, Aoba-ku, Sendai-shi, Miyagi 980-0021, Japan. Contact details are published on the Company page and in the Legal Notice.

You may also contact the Personal Information Protection Commission of Japan, or your local supervisory authority, if you consider that your rights have not been respected.

14. Changes to this policy

This policy may be updated to reflect changes to the Service or to the law. The effective date shown at the top of this page indicates the current version, and material changes will be notified to registered users.