Privacy Policy

In providing the Service (including when offering a free trial), the Company collects the following information.

* Review text and star ratings are information published on Google Business Profile. The end users (consumers) who posted the reviews are not Users of the Service, and the Company uses and retains this information only for the purpose of providing the Service (generating AI draft replies).

The Company uses the collected information for the following purposes.

• Providing and operating the Service (including during the free trial period)
• Providing GBP management support features (review detection, AI draft reply generation, business information updates, GBP health check, etc.) (Okotae AI Pro), and performing GBP managed operation work (review replies, business information updates, regular posts, report preparation, etc.) (Full-Service Management Plan)
• Billing and payment processing for fees (including issuing invoices and credit checks)
• Notifications and communications to Users (LINE push notifications, dashboard notifications, email notifications)
• Improving the quality of the Service and analyzing its usage (including improving AI models after anonymization)
• Preventing misuse and responding to violations of the Terms of Service

In providing the Service, the Company entrusts information processing to the following businesses as external processors. Please note that each business's own privacy policy applies.

[Cross-border transfers] Personal information is transferred to Supabase Inc., Anthropic, PBC, Vercel Inc., and the access analytics service provider (all in the United States). These businesses maintain an appropriate level of personal information protection, such as that required by the GDPR.

[Anthropic API] Review text, business names, and star ratings are sent to Anthropic's Claude API in the process of generating AI draft replies. Anthropic has stated that it does not use requests made through the API for training purposes.

[Google Maps Platform] To provide the keyword ranking report, the Company sends search terms registered by the User and the location information of the business to Google Maps Platform (Places API). Information sent to Google is handled in accordance with the Google Privacy Policy (https://policies.google.com/privacy). From the search results, the Company records only the display rank of the User's business, the number of search results, and the observation conditions, and does not record the names or other information of other businesses.

* After cancellation, the User's registration information and AI output data are retained in a view-only state, and the User can resume use at any time with the registered payment method. If you wish to have your registration information and AI output data completely deleted (account closure), please contact the Company's designated inquiry desk. The Company will permanently delete the data 90 days after the deletion request, after which the data cannot be restored or recovered.

The Company takes the following security measures to prevent leakage, loss, or damage of the personal information it collects.

• Google Business Profile OAuth refresh_tokens are encrypted using AES-256-GCM and stored in the database
• Data separation between tenants using Supabase Row Level Security
• Production secrets are managed with the environment variable features of Vercel and Supabase
• Credit card information does not pass through the Company's servers and is managed by Stripe in compliance with PCI DSS

Users may make the following requests regarding their own personal information held by the Company, in accordance with Japan's Act on the Protection of Personal Information.

• Notification of the purposes of use
• Disclosure of personal information
• Correction, addition, or deletion of personal information
• Suspension of use or erasure of personal information
• Suspension of provision to third parties

Please send requests to the contact point (Article 9). We may ask you to submit identification documents.

The Service uses cookies and similar technologies (such as browser storage) to maintain login sessions and for access analytics to improve the Service.

Access analytics collects the pages viewed and records of on-screen actions (including screen recordings, which capture content displayed on the screen and content entered) and sends them to an access analytics service provider (United States). Password input is not recorded. The collected information is used only to analyze and improve the use of the Service.

The Company may revise this Policy as necessary. When making important changes, the Company will, in addition to posting them on the Service's website, notify Users at their registered email addresses. If a User continues to use the Service after the revision, the User is deemed to have agreed to the revised Policy.

Hours: Weekdays 10:00-18:00 Japan time (excluding weekends, Japanese national holidays, and the year-end and New Year holidays)