1. Operator and Scope
In this policy, the “Operator” or “we” means the entity operating the Service (legal name: 〔TBD〕; address: 〔TBD〕; personal information protection manager: 〔TBD〕). This policy applies to all processing of your personal information when you access, register for and use the Service.
2. Information We Collect
Information you provide
- Account information: email address, display name, password (stored only as a hash, never in plain text), language preference.
- Profile (all voluntary): nationality/region, native language, education stage and current school/major, scores (GPA, JLPT / TOEFL / IELTS / EJU, etc.), target stage, year, schools, majors and professors, residence status, research and career intentions. You decide how much to fill in.
- User content: text you submit to tools (research plans, statements, ES, email drafts), uploaded files (PDFs, screenshots, résumés), voice-input audio and its transcripts, and generated results you save (drafts, reviews, experience cards, mistake notebooks, timelines).
- Inquiry and booking information: display name and contact details (email or WeChat ID) submitted through inquiry/booking forms.
- Payment-related information: subscription and entitlement status, credit balance and consumption records. Card details are processed directly by the payment provider shown at checkout; we do not store your full card number.
Information collected automatically
- Authentication and security data: IP address and device information (User-Agent) at sign-in. One-time verification codes are stored only as HMAC hashes, single-use and attempt-limited — never in plain text.
- Session data: server-side session tokens with creation/activity/expiry times and associated IP and device information.
- Access and usage logs: access times, page paths, feature-usage events, and AI usage and cost records (for quota management and billing).
- Analytics data: we log page views and feature events first-party and store a randomly generated anonymous identifier (anon_id) in your browser's local storage to stitch pre- and post-login journeys; where enabled, we also use the product analytics tool PostHog (Section 7).
3. Purposes of Use
We use personal information to the extent necessary for the following purposes:
- Providing, maintaining and personalizing the Service's features (search, matching, generation, review, practice, timelines);
- Running AI features: sending your inputs to third-party AI providers to generate results (Section 4);
- Authentication, session management, abuse prevention and security;
- Processing subscriptions, credits and billing (through the payment provider shown at checkout) and making communications required under commerce law;
- Responding to inquiries and sending important service notices;
- Analyzing usage in aggregated/statistical form to improve features and develop new ones;
- Complying with legal obligations, handling disputes and protecting legitimate rights.
We will obtain your prior consent before using personal information beyond these purposes, except where permitted by law.
4. AI Processing and Third-Party Model Providers
Generation, review, matching, parsing and transcription rely on third-party AI providers (currently including DeepSeek and Google (Gemini), as actually enabled). Text you submit to AI tools, uploaded files and voice data are sent to these providers to the extent necessary to generate results.
- We do not use your user content to train our own models; transmission to third parties is solely to generate the results you request;
- Generated results are stored in your account as run history and saved content, and you can delete them yourself;
- Please avoid submitting highly sensitive information you do not want processed by third parties (Section 12).
5. Voice Input
When you use voice input, processing follows one of two paths depending on your browser:
- In-browser speech recognition: where the browser's speech feature (e.g. Web Speech API) is used, your audio is processed by the browser vendor (e.g. Google) under its own terms, and we receive only the resulting text;
- Server-side transcription: where the browser lacks support or the feature is enabled, recordings are uploaded to our servers and sent to a speech-to-text provider for transcription; audio is used solely to produce the transcript.
6. Cookies and Local Storage
We use cookies and browser local storage to keep you signed in, remember your language, save UI state (such as checklist toggles) and store the anonymous analytics identifier (anon_id). We use no third-party advertising cookies and do not track you for advertising.
You can manage or clear cookies and local storage in your browser; disabling some items may break sign-in and related features.
7. Product Analytics (PostHog)
Where enabled, we use PostHog to understand feature usage and improve the Service. It collects page views, feature events and summary device/browser information, used for aggregate analysis only — never for ad targeting. Data may be processed outside Japan (Section 9). You can refuse the related cookies in your browser without affecting core features.
8. Sharing and Entrustment
We do not sell your personal information, and do not share it without consent except in the following cases:
- Entrustment: within the scope necessary for the purposes of use, we entrust processing to providers in these categories, with necessary and appropriate supervision — AI model providers (DeepSeek, Google, etc.), payment processing (the provider shown at checkout), email delivery (e.g. Resend), SMS delivery (when enabled), cloud infrastructure/hosting (〔TBD: hosting provider〕), product analytics (PostHog, when enabled);
- Legal grounds: where required by law, or where necessary to protect life, body or property and consent is difficult to obtain, and other cases permitted by law;
- Business succession: transfers accompanying mergers or business transfers (the successor is bound by this policy).
9. Transfers to Third Parties Outside Japan
Some of the above providers are located outside Japan. AI model providers include DeepSeek in China and Google in the United States. The payment provider may be Stripe or Creem depending on deployment and region; its location and cross-border processing terms are described at checkout and in that provider's privacy policy. Email delivery (Resend) and analytics (PostHog) are mainly located in the United States; cloud hosting is located in 〔TBD〕. Your personal information may therefore be provided to third parties abroad to the extent necessary for entrusted processing.
- Information on each country's data-protection regime is available in the surveys published by Japan's Personal Information Protection Commission (PPC);
- We require overseas recipients, by contract, to implement protections equivalent to Japanese law and monitor their implementation;
- Where the law requires consent, we obtain it through this policy and on-screen notices before you use the relevant features (AI generation, payment, etc.).
10. Security Measures
- Organizational and personnel measures: designated responsibility for data handling, restricted access to personal data, and necessary training and supervision;
- Technical measures: encrypted transport (TLS); hashed password storage; HMAC-hashed, attempt- and time-limited one-time codes; access control and operation logging;
- Session protection: sessions are revoked immediately when you sign out, change your password, or your account is suspended;
- Awareness of the external environment: security measures implemented with knowledge of the regimes of the countries where overseas processing occurs (Section 9).
No transmission or storage method is absolutely secure; please safeguard your password. In the event of a reportable breach, we will report to the PPC and notify affected individuals as required by law.
11. Retention and Deletion
- While your account exists, we retain your account information, profile and user content to provide the Service;
- You can delete saved content and run history within the Service at any time;
- When you delete your account, we delete personal information tied to it; logs and transaction records needed for security, dispute handling or legal obligations are deleted after the statutory or necessary period.
12. Sensitive Personal Information
We do not actively request “special care-required personal information” under Japanese law (health and medical history, disabilities, beliefs, criminal history, etc.). If you include such information in free-text fields or uploads, you are deemed to consent to its handling under this policy, including AI processing under Section 4. Please avoid submitting unnecessary sensitive information; you can delete submitted content at any time or request deletion via Section 15.
13. Minors
Users under 18 should use the Service with the consent of a legal guardian. The Service is not offered to children under 13; if we learn we have collected a minor's personal information without guardian consent, we will delete it promptly.
14. Your Rights (Disclosure and Related Requests)
Regarding retained personal data, you may request under law: notification of purposes of use; disclosure (including records of third-party provision); correction, addition or deletion; and suspension of use or of third-party provision.
- Most account information, profile data and saved content can be viewed, corrected or deleted directly within the Service;
- For other requests, contact the desk in Section 15. After verifying that the requester is the data subject or their legal representative, we will respond within a reasonable period;
- We charge no fee for such requests in principle; where actual costs (e.g. postage) arise, we will explain them in advance.
15. Contact; Changes to This Policy
For inquiries, complaints and disclosure requests concerning personal information, contact: personal information desk ryugakujinja@gmail.com. We will respond sincerely and promptly. If you are dissatisfied with our response, you may also consult or complain to Japan's Personal Information Protection Commission (PPC).
This policy may be updated as laws or the Service change. We will revise the date at the top of this page, and announce material changes separately by posting on the Service or by email.
