Privacy Policy

1. Information We Collect

(a) Information you provide

• Google account information (email, display name, profile photo URL)
• Profile information (company, title, phone number, LINE ID, etc.)
• Business card images and extracted contact data
• Meeting booking information, email content
• Transcribed text and AI summaries of meeting recordings (excluding the audio recordings themselves)

(b) Automatically collected information

• App usage logs, device tokens (for push notifications)

(c) Information from external services

• Google Calendar: calendar event data (when connected)
• Zoom: OAuth tokens, meeting ID and join URL (when connected)

2. Purpose of Use

• Business card OCR processing (via AI)
• Contact management, search, and grouping
• Meeting scheduling
• AI follow-up email generation
• Delivery and display optimization of deals and campaign information (ads) in the Plaza tab (see Section 11)
• Service improvement and fraud prevention

3. Business Card Information (Third-Party Personal Data)

• Legal basis: Business custom of exchanging cards
• Purpose: Contact management, meeting scheduling, follow-up emails
• Third-party transfer: Card images sent to AI (US servers) for OCR processing
• Retention: Until deleted by the user
• Rights: Card owners may request disclosure, correction, or deletion at support@tsumugu.tech

4. International Data Transfer

Card images may be transmitted to US servers (OpenAI) for AI processing.

5. Data Storage and Security

• Servers: Japan (GMO Pepabo LOLIPOP)
• OAuth tokens: AES-256-CBC encrypted
• Communications: HTTPS/TLS encrypted
• Authentication: JWT (HMAC-SHA256)

6. Your Rights

Under Japan's Act on the Protection of Personal Information (APPI), you may request disclosure, correction, deletion, or cessation of use.

Contact: support@tsumugu.tech

7. Changes to This Policy

Changes will be communicated via in-app notification or email at least 14 days before taking effect.

8. Zoom Integration Zoom

When you connect your Zoom account to this App, we collect and use the following information.

Information collected

• Zoom OAuth access token and refresh token
• Meeting ID, join URL, and host URL (start_url)

Purpose of use

• Creating Zoom meetings when booking appointments
• Updating Zoom meetings when appointment details (time, title) are modified
• Deleting Zoom meetings when appointments are cancelled

Data storage

• Zoom tokens are stored on servers in Japan, encrypted with AES-256-CBC
• Meeting IDs and URLs are stored only in our database
• We do not access meeting content (conversations, recordings, etc.)

Revoking access

• You can disconnect your Zoom account at any time from the App settings screen
• Upon disconnection, Zoom tokens are immediately deleted from our database and the authorization is revoked on the Zoom side (via zoom.us/oauth/revoke)
• You can also revoke access from Zoom at zoom.us/profile/connected_apps

Zoom Privacy Policy: https://explore.zoom.us/en/privacy/

9. Google API Integration Google Calendar

When a user connects their Google account to the App, we obtain and use the following information through the Google Calendar API.

Information We Obtain

• Google account email and OAuth access / refresh tokens
• Google Calendar event data (start / end time, title, presence of attendees)
• Free/Busy information (used to determine the host's availability)

Purpose of Use

• Display the host's real-time availability on the guest's booking screen
• Automatically create a booking event on the host's Google Calendar upon booking confirmation
• Update the Google Calendar event when a booking is rescheduled (time / title)
• Delete the Google Calendar event when a booking is cancelled
• Detect conflicts with the host's existing events

Data Storage

• OAuth access and refresh tokens are stored AES-256-CBC encrypted on servers located in Japan
• Calendar event contents are not persisted on our servers (fetched from the Google API on demand)
• Only the Google Calendar event IDs corresponding to bookings we created are stored alongside the booking record, for the purpose of later update or deletion

Limited Use Compliance (Google API Services User Data Policy)

tsumugu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We do not use Google user data for advertising purposes
• We do not use Google user data to train AI or machine-learning models
• We do not sell or transfer Google user data to third parties
• Humans do not read Google user data (except with the user's explicit consent, for security purposes, to comply with applicable law, or to investigate abuse)

Sharing, Transfer, and Disclosure of Google User Data

We do not sell Google user data (your Google account email address, OAuth tokens, or Google Calendar event data). We share, transfer, or disclose Google user data only in the following limited cases:

• Hosting provider (data processor): Google user data is stored on servers operated by GMO Pepabo, Inc. (LOLIPOP, located in Japan), which acts solely as our infrastructure provider and processes data only under our instructions.
• Legal requirements: when disclosure is required by applicable law, regulation, or valid legal process.
• Security and abuse prevention: when necessary to investigate or prevent fraud, abuse, or security issues.
• With your explicit consent.
• Business transfer: in the event of a merger or acquisition, with prior notice to users.

We do not share Google user data with any other third party, including advertisers or AI service providers. Google Calendar event data and Google account information are never transmitted to OpenAI or any other external AI service (the AI processing described in Sections 4 and 10 applies only to business card images and meeting transcripts).

Disconnecting the Integration

• You can disconnect Google integration at any time from the App settings screen
• Upon disconnection, OAuth tokens are immediately deleted from our database
• You can also revoke access from Google at myaccount.google.com/permissions

Google Privacy Policy: https://policies.google.com/privacy

10. Meeting Recording & AI Summary

(a) Audio recordings never leave your device

Audio recorded with the meeting recording feature is transcribed (converted from speech to text) entirely on your device. The audio recordings themselves are never sent to or stored on our servers.

(b) Storage and deletion of audio recordings

• Audio recordings are stored only on your device and are automatically deleted after 30 days by default (configurable in settings).
• Deleting a meeting record also deletes the corresponding audio on your device.

(c) Information sent to our servers

To generate AI summaries, only the transcribed text is sent to our servers and stored together with the summary and to-do items. You can delete these at any time. Transcribed text is encrypted at rest.

(d) AI processing (subcontracting)

Summarization of transcribed text is performed using the API of OpenAI, L.L.C. The submitted text is provided to OpenAI for the purpose of summarization.

(e) Your responsibility regarding recording

Before recording a meeting, please obtain the consent of the other participants. Obtaining such consent is your responsibility.

11. Advertising in the Plaza Tab

The "Plaza" tab displays deals and campaign information (advertisements) from shops and services. To show you relevant information, we use the following data to control ad display:

• Your registered industry, prefecture, and city
• Optionally registered age group and gender (not used unless registered)
• Time of use and impression counts for each ad (to prevent excessive display)

• Business card and networking data (connections, exchange history, etc.) are never used for advertising purposes.
• No personally identifiable information is provided to advertisers (only aggregated statistics are shared).
• We do not provide data to third-party ad networks and do not perform cross-app tracking.