Privacy Policy

1. Information we collect

We collect the following information in order to provide the Service.

The Service uses the following cookies. All of them are first-party cookies issued by our own domain, and none are used for advertising or third-party tracking.

In addition, your theme settings and AI feature settings (including API keys) are stored in your browser’s localStorage. These are not transmitted to our servers.

We do not use third-party advertising trackers.

We do not use web analytics tools.

2. Purposes of use

We use the information we collect for the following purposes.

• Providing and maintaining the Service and authenticating users
• Identity confirmation, email address verification and password resets
• Billing, invoicing and managing subscription status for Paid Plans
• Providing sharing and collaboration features and sending invitation emails
• Sending important notices about the Service (changes to terms, incidents, maintenance and the like)
• Preventing and responding to fraud, unauthorised access and other breaches of the Terms
• Investigating and recovering from incidents, and improving service quality
• Complying with legal obligations

We do not use user content as training data for generative AI models, nor for advertising or promotional purposes without your consent.

3. Disclosure to third parties and subprocessors

We do not provide personal information to third parties without your prior consent, except where required by law or necessary to protect life, body or property. However, we entrust the handling of information to the following providers to the extent necessary to operate the Service.

4. International transfers

All of the providers listed above are located outside Japan (primarily in the United States), and data may be processed and stored on servers outside Japan. We entrust data to these providers after confirming that they implement appropriate security measures.

5. Retention periods

• Account information and user content: for as long as the account exists. On deletion of the account, data is deleted or transferred to another collaborator in the manner we specify.
• Session information: deleted progressively after expiry (7 days by default).
• Email verification and password reset tokens: expire one hour after issue.
• Consent records: retained until the account is deleted, in order to evidence that consent was given.
• Operational logs: automatically deleted 30 days after they are recorded.
• Payment records: retained by Stripe and by us for the period required by law.

6. Security measures

• The database is encrypted at rest (Cloudflare D1).
• All communications are encrypted with TLS.
• Passwords are stored as one-way hashes (scrypt) and never in plain text.
• Session cookies carry the Secure and HttpOnly attributes.
• The administrative dashboard can be accessed only by pre-registered administrators.

7. Your rights

You may request disclosure, correction, addition, deletion, suspension of use or suspension of provision to third parties of your personal information held by us. Please contact us using the details at the end of this Policy. We will respond in accordance with applicable law after verifying your identity.

You can also delete your account information and user content yourself from the settings screen of the Service.

8. Information relating to minors

The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected such information, we will delete it promptly. If you are under 18, please use the Service with the consent of a parent or legal guardian.

9. Information for residents of the EEA and the UK (GDPR)

If you live in the European Economic Area (EEA), the United Kingdom or Switzerland, we handle your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the UK GDPR. The controller of your personal data is Imaginest Studio / Naotsugu Zushi, contactable at support@imaginest-studio.com.

We rely on the following legal bases for processing.

You have the following rights in respect of your personal data.

• The right of access
• The right to rectification
• The right to erasure (the right to be forgotten)
• The right to restriction of processing
• The right to data portability (to receive your data in a machine-readable format)
• The right to object to processing, including processing based on legitimate interests and direct marketing
• The right to withdraw consent
• The right to lodge a complaint with the data protection supervisory authority in your country

To exercise these rights, contact us using the details at the end of this Policy. After verifying your identity we will respond within one month as a rule.

International transfers: we are based in Japan, which the European Commission has recognised as providing an adequate level of protection; the United Kingdom carried that recognition over into UK law after Brexit. Transfers to providers located in the United States (such as Cloudflare and Stripe) are made on the basis of the Standard Contractual Clauses (SCCs) and, for transfers from the United Kingdom, the International Data Transfer Agreement (IDTA) or the UK Addendum, or other appropriate safeguards implemented by those providers.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. Retention periods are set out in section 5.

10. Changes to this Policy

We may amend this Policy in response to changes in law or in the Service. If we make a material change, we will notify you before the effective date by posting within the Service or by sending a message to your registered email address.

11. Contact