Privacy Policy

Subako プライバシーポリシー

Kikuvi, Inc. (“Company”) has established the following Privacy Policy (“Policy”) regarding the protection of personal information of all users (“Users”) of the “Subako” service (“Service”) provided by the Company; the Company will handle personal information appropriately in accordance with this Policy. This Policy applies regardless of the User’s place of residence.

The meanings of terms used in this Policy shall be as used or set forth in data protection laws applicable in the User’s place of residence.

1. Data Controller for the Processing of Personal Information

The Company is the controller responsible for processing Users’ personal information. Please see Section 12 below for the Company’s contact information.

2. Items of Personal Information Collected

The Company collects the following personal information about Users:

Name, email address, password, information about the User’s affiliation, and other information relating to the User’s account or registration.

Prompts, text, files, and other information that Users input, transmit, or upload when using agents in the Service.

As a general rule, the Company does not request the provision of information such as race, ethnic origin, religious or philosophical beliefs, health information, sexual orientation, genetic information, biometric information, criminal history, or other information protected as sensitive personal information or special categories of personal data under applicable data protection laws (collectively, “Sensitive Personal Information”); however, Sensitive Personal Information may be included in the content that Users enter, submit, upload, or speak while using the Service.

Online identifiers, such as cookie IDs, information about the device Users are using, location information, browsing history, and other use information relating to the Service, including access logs, IP addresses, browser information, and browser language settings.

Information about inquiries and communications from Users to the Company, and similar information.

3. Purposes of Use and Legal Basis for Processing

The Company collects and uses Users’ personal information within the scope of the purposes of use listed below (“Purposes of Use”). Where required by applicable data protection laws and regulations, the Company will process personal information based on the legal grounds listed in the table below.

(a) For User registration, identity verification when using the Service, and User management	Performance of a contract
(b) To provide the Service and provide after-sales service	Performance of a contract
(c) To bill Users for the Service	Performance of a contract
(d) To prevent and address fraudulent activities and other misconduct	Legitimate interests, performance of the contract
(e) To maintain and manage the Service	Legitimate interests
(f) To conduct research and analysis of marketing data, and to consider and implement marketing initiatives	Consent, legitimate interests
(g) To conduct campaigns, sweepstakes, and surveys	Consent
(h) To improve the Service, and to plan, research, and develop new products and services	Consent, legitimate interests
(i) To respond to inquiries and contact Users	Performance of the contract, legitimate interests
(j) Provision of information to third parties in accordance with the methods described in this Policy	Consent, legitimate interests, compliance with legal obligations

4. Disclosure to Third Parties

Except as permitted by applicable data protection laws and regulations, the Company will not provide, disclose, or share the personal information the Company handles with third parties without first obtaining the relevant User’s consent.

(a) When the Company entrusts the handling of personal information to contractors, service providers, or processors to the extent necessary to achieve the purposes of use

(b) When personal information is provided in connection with a business succession resulting from a merger or for other reasons

(c) When necessary to comply with requests from laws and regulations, courts, regulatory agencies, or other public authorities

(d) When necessary to protect human life, physical safety, property, safety, or important rights and interests

(e) When necessary to prevent, investigate, or respond to fraud, security incidents, or other illegal or inappropriate conduct

(f) When necessary to establish, exercise, or defend the rights of the Company, Users, or third parties; and

(g) In other cases permitted by law

5. Outsourcing and International Data Transfers

When providing the Service, the Company may entrust the handling of Users’ personal information to the following third-party contractors to the extent necessary to achieve the purposes of use. Please note that, depending on the location of the third-party contractors listed below, Users’ personal information may be transferred overseas. The Company will implement appropriate safeguards in accordance with applicable laws and regulations when engaging in international data transfers.

(a) AI Processing

To provide the features of this Service, the Company transmits data entered or submitted by Users to the following third-party AI services:

OpenAI, Inc. (U.S.)

(b) Infrastructure

Amazon Web Services, Inc. (Amazon Web Services (AWS)) (U.S.)

Cloudflare, Inc. (U.S.)

Stripe, Inc. (U.S.)

(d) Email Delivery

Twilio Inc. (SendGrid) (U.S.)

(e) Analytics and Quality Control

Google LLC (Google Analytics)

(f) Customer Management

HubSpot, Inc. (U.S.)

(g) Security Management

Vanta Inc. (U.S.)

(h) Authentication and User Management

WorkOS, Inc. (U.S.)

6. Period of Retention of Personal Information

The Company will retain Users’ personal information for the period necessary to achieve the purposes of use, the period during which the Company is subject to applicable statutory retention obligations, or the period necessary to manage and resolve contractual relationships, inquiries, or disputes with Users—whichever is longer. When determining the retention period, the Company will take into account the nature of the personal information, the purposes of processing, the Company’s relationship with the User, statutory obligations, and security management requirements. Upon expiration of the retention period, the Company will securely delete, anonymize, or otherwise process all personal information in accordance with applicable laws and regulations.

7. Withdrawal of Consent

Users may withdraw their consent to the handling of personal information at any time. If you wish to withdraw your consent, please do so via the settings screen of this Service or by contacting the Company using the contact information in Section 12. Please note that withdrawing your consent may result in your inability to use all or part of the Service.

8. Security Measures

The Company will take necessary and appropriate measures to prevent leakage, loss of, or damage to, the personal information the Company handles, and to ensure the security of that information. For inquiries about the security measures the Company implements, please contact the Company using the contact information in Section 12.

9. Requests for Disclosure and Other Requests

The Company will respond to Users’ requests to exercise their rights relating to personal information in accordance with applicable data protection laws and regulations. To the extent permitted by applicable laws and regulations, Users may exercise their rights regarding their personal information, including without limitation the right to access, disclosure, correction, deletion, suspension of use, restriction of processing, objection, data portability, refusal of sale or sharing, and restriction of the use or disclosure of sensitive personal information.

(a) Access, Disclosure, and Provision of Information

In accordance with the procedures set forth in (e) below and to the extent permitted by applicable data protection laws, Users may request access to, disclosure of, or provision of information about their personal information held by the Company, the purposes of processing, the categories of personal information, the categories of recipients to whom the information has been provided or with whom the information has been shared, and other information required by law.

The Company may refuse to comply with part or all of a User request if permitted to do so by applicable data protection laws. In these situations, the Company will notify the User of the reasons for the refusal, to the extent required by law.

Please note that the Company will not charge a fee for the exercise of User rights, except as permitted by applicable data protection laws. However, if a request is manifestly unfounded, excessive, or repetitive, the Company may charge a reasonable fee or refuse to comply with the request in accordance with applicable data protection laws.

(b) Correction, Addition, and Deletion

Users may request corrections or additions to, or deletion of, their personal information in accordance with the procedures set forth in (e) below. In these situations, the Company will conduct an investigation without delay to the extent necessary to achieve the purpose of use and, based on the results, correct, add to, or delete the relevant personal information to the extent permitted by applicable data protection laws and regulations.

Users may request suspension of the use of their personal information or suspension of provision of their personal information to third parties by following the procedures set forth in (e) below. In these situations, the Company will respond appropriately in accordance with applicable data protection laws and regulations.

(d) Additional Rights Based on Place of Residence

Depending on the data protection laws applicable in the User’s country of residence, the User may be able to exercise the following rights in addition to those listed above:

• Right to Data Portability: You may have the right to receive your personal information held by the Company in a structured, machine-readable format, and to have that personal information transferred to another controller.

• Right to Request Restriction of Processing: Under certain conditions, you may have the right to request that the Company restrict the processing of your personal information.

• Right to Object: If the Company processes personal information based on its legitimate interests, you may have the right to object to that processing.

• Rights Regarding Automated Decision-Making: You may have the right not to be subject to a decision based solely on automated processing, including profiling.

• Right to Lodge a Complaint with a Supervisory Authority: You may have the right to lodge a complaint with the data protection supervisory authority in your country of residence regarding the Company’s handling of your personal information.

• Right to Object to the Sale or Sharing of Personal Information: If the Company sells or shares your personal information with third parties, you may have the right to object to those actions.

• Right to Restrict the Use of Sensitive Information: If the Company collects sensitive personal information, you may have the right to request that the Company restrict its use and disclosure of that information.

• Non-Discrimination: The Company will not treat you in a discriminatory manner for exercising any of the foregoing rights.

(e) Procedures

To exercise rights such as requests for disclosure or other rights under applicable data protection laws, Users may submit a request via the Service’s settings screen, the Company’s designated form, or the contact information listed in section 12 (Contact Information). Depending on the nature of the request and the personal information the Company holds, the Company may verify the User’s identity or the authority of the User’s representative (if any) to the extent reasonably necessary. The Company will respond to User requests within the period prescribed by applicable data protection laws.

Users may exercise their rights through an authorized representative where permitted by applicable data protection laws. In these situations, the Company may request the submission of information necessary to verify the representative’s authority. Additionally, to the extent permitted by law, the Company may seek direct confirmation from the User personally.

10. Use of Cookies

(a) Use of Cookies

The Company’s website and the Service use cookies and other similar technologies for tracking or analysis (collectively, “Cookies”) in order to provide Users with appropriate services.

(i) Overview of Cookies

A cookie is a small file containing arbitrary text that is exchanged between a web server and a User’s browser or device when the User accesses a website or uses this service, and is stored on the User’s device. The Company may use cookies to collect information regarding Users’ browsing history, service use history, device information, location data, online identifiers, and other use patterns. Even if this information does not directly identify a User on its own, it may be treated as personal information under applicable data protection laws.

Users can configure their browser settings to display a notification in advance when visiting a site that uses cookies, as well as to disable cookies and delete stored cookies. Please note that if you refuse to accept cookies or delete them, the features available on the website may be limited.

(ii) About Google Analytics

The Company uses Google Analytics, a service provided by Google. The Company receives the results of Google’s collection and analysis of Users’ browsing history based on cookies set by the Company or by Google, and the Company may use this information to understand Users’ use patterns and to improve the Company’s services. For information on how Google handles data in Google Analytics, please visit Google’s website.

“Google’s Use of Information Collected from Sites and Apps That Use Google Services”

https://policies.google.com/technologies/partner-sites

11. Minors’ Personal Information

The Company will handle the personal information of minors appropriately in accordance with applicable data protection laws and regulations and this Policy. If the personal information the Company has collected relates to a minor for whom the consent or approval of a parent or other legal guardian is required under applicable laws, the Company may seek confirmation of that consent or approval in accordance with law. If the Company becomes aware that it unintentionally has collected or received a minor’s personal information without obtaining the necessary consent or approval, the Company will delete the relevant personal information or take other appropriate measures in accordance with applicable laws.

12. Contact Information

Please contact the following office for any comments, questions, complaints, or other inquiries about the handling of personal information.

Kikuvi, Inc. Privacy Officer

7-14 Sakanoshita, Kamakura City, Kanagawa Prefecture 248-0021

Email: privacy@kikuvi.com

13. Procedures for Amending This Policy

Periodically, the Company may review its practices regarding the handling of personal information and amend this Policy as necessary. If the Company amends this Policy, the Company will notify Users of the amended content or make it public via the Company website, notices displayed on the Service, by email, or by other appropriate means. Unless otherwise specified, the amended Policy will take effect from the time the Company notifies Users or makes the amendment public.

Supplementary Provisions (U.S.A.)

These Supplementary Provisions set forth additional disclosures and rights applicable to Users residing in the State of California (“California Residents”), United States of America, pursuant to the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”). These Supplementary Provisions form part of the Policy and should be read in conjunction with it. In the event of any conflict between these Supplementary Provisions and the other provisions of this Policy, the Supplementary Provisions shall take precedence with respect to California Residents.

Appendix: Supplementary Provisions for California Residents (California Privacy Notice)

1. Categories of Personal Information Collected

Over the past 12 months, the Company has collected the following categories of personal information:

(a) Identifiers: name, address, ZIP code, phone number, email address, account name, IP address, cookie ID, and online identifiers.

(b) Personal Records: name, address, phone number, and date of birth

(d) Commercial Information: history of use of the Service and purchase history

(e) Internet or Other Electronic Network Activity Information: browsing history, search history, use of the Service, access logs, and browser information

(f) Geolocation Data: device location information

(g) Audio, Electronic, Visual, or Similar Information: audio data

(h) Professional or Employment-Related Information: information about the User’s employer

(i) Sensitive Personal Information: sensitive personal information as defined in this Policy (if included in content entered, transmitted, uploaded, or spoken by the User while using the Service)

2. Sources of Personal Information

The Company collects personal information from the following categories of sources.

(a) Direct Collection from Users: information provided directly by Users through account registration, use of the Service, and inquiries

(b) Automatic Collection: information automatically collected through cookies, access logs, and other technologies

3. Purposes of Use of Personal Information

The Company collects and uses personal information for the purposes described in Section 3 of this Policy. In addition, the Company may use personal information for the following business purposes, as defined in the CCPA/CPRA:

(a) Provision and operation of the Service

(b) Security and fraud prevention

(d) Maintenance and improvement of service quality

(e) Internal research and development

(f) Compliance with legal obligations and the exercise and defense of legal rights

4. Recipients of Personal Information

Over the past 12 months, the Company has disclosed personal information to the following categories of third parties for business purposes:

(a) Service Providers: outsourced contractors listed in Section 5 of this Policy, including AI processing, infrastructure, payment processing, email delivery, analytics, customer management, and security management providers.

(b) Professionals: attorneys, accountants, and auditors

(d) Business Successors: in the event of a merger, business transfer, or other corporate transaction

5. “Sale” and “Sharing” of Personal Information

The Company does not “sell” personal information, as defined in the CCPA/CPRA. The Company also does not “share” personal information with third parties for purposes of cross-context behavioral targeting advertising. The Company also does not intentionally sell or share the personal information of consumers under the age of 16.

6. Handling of Sensitive Personal Information

The Company may collect the following categories of information as sensitive personal information as defined by the CCPA/CPRA:

• Account data combined with a password, meaning a combination of a password that enables access to an account and information required to log in to the account.

• Other Sensitive Personal Information contained in content that Users enter, submit, upload, or speak while using the Service.

Of the items listed above, the Company does not actively seek to collect Sensitive Personal Information contained in content that Users enter, submit, upload, or speak; it is collected only when generated by the User’s actions.

The Company will use or disclose Sensitive Personal Information only for purposes expressly permitted by the CCPA/CPRA (to the extent necessary to provide the Service) and will not use or disclose it for any other purposes. Therefore, the Company has no obligation to support Users’ rights to restrict the use or disclosure of Sensitive Personal Information.

7. Retention Period

As described in Section 6 of the Policy, the Company will retain personal information for the period necessary to achieve the purposes of use, the period required by law, or the period necessary to manage the Company’s relationship with the User, whichever is longer. When determining the retention period, the Company will take into account the nature of the personal information, the purpose of collection, the Company’s relationship with the User, legal obligations, and security requirements.

8. Rights of California Residents

California residents have the following rights under the CCPA/CPRA:

(a) Right to Know: The right to request disclosure of the categories of personal information the Company has collected, the sources from which it was collected, the purposes for which it was collected, the categories of recipients to whom it was disclosed, and the specific personal information in question

(b) Right to Delete: The right to request the deletion of personal information the Company has collected, subject to certain exceptions.

(d) Right to Opt-Out: The right to refuse the sale or sharing of personal information (the Company currently does not sell or share personal information)

(e) Right to Non-Discrimination: The right not to be treated in a discriminatory manner for exercising the rights listed above

9. How to Exercise Your Rights

California residents may exercise their rights using the following methods:

• Email: privacy@kikuvi.com

• The settings screen of the Service

• The Company’s designated request form

Upon receiving a request, the Company will verify the User’s identity. To verify identity, the Company will cross-reference the information provided by the User with the information the Company holds, as well as via other reasonable methods. The Company will respond to the request within 45 days of receipt. However, if reasonably necessary, the Company may extend this period by an additional 45 days. In these situations, the Company will notify the User of the reason for the extension. Users also may exercise their rights through an Authorized Agent. In response to a request from an agent, the Company may require the submission of a power of attorney or other written authorization, and may seek direct confirmation from the User personally. Users will not be subject to retaliatory treatment for exercising their rights under the CCPA/CPRA.

10. Do Not Track

Section 22575(b) of the California Business and Professions Code grants California residents the right to know how the Company responds to “Do Not Track” settings in browsers. As no uniform technical standard has been established, the Company currently does not take any action in response to Do Not Track signals.

11. Shine the Light Act

In accordance with the definition in California’s “Shine the Light” Act (Cal. Civ. Code § 1798.83), the Company does not disclose personal information to third parties for their own direct marketing purposes.

12. Contact Information

If you have any questions about this Supplement or privacy in California, please contact the Company using the contact information provided in Section 12 (Contact Information) of the Policy.

13. Updates to Supplementary Provisions

The Company will review these Supplementary Provisions at least once every 12 months and update them as necessary. If any changes are made, the Company will post a notice on the Company website or in the Service.

Last Updated: September 10, 2026