KANATA Privacy Policy

1. Introduction

2. Personal Information Protection Manager

3. International Contacts and Offices

4. Personal Information We Collect

In providing the Service, the Company may collect the following categories of personal information. For users residing in the United States, the corresponding categories under U.S. state laws are also indicated.

The Company will not collect special-care personal information as defined under the APPI without the prior consent of the data subject (except where permitted by law). The Company does not collect or process, in connection with the Service, special-care personal information under the APPI or special categories of personal data under Article 9 of the GDPR or Article 9 of the UK GDPR (information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health, sex life, or sexual orientation; collectively, "Sensitive Information"). Users shall not provide Sensitive Information to the Company through input, upload, or any other means in the Service. If a user provides Sensitive Information, the Company will not actively use such information for the purpose of providing the Service, and will take appropriate measures, including deletion, in accordance with applicable laws and the Terms.

5. Legal Basis for Processing

5.1 All Users

Pursuant to the APPI, the Company specifies the purposes of use for personal information (Article 6) and does not handle personal information beyond the scope necessary to achieve those purposes, except as permitted under exceptions provided by the APPI or by the personal information / data protection laws of each applicable jurisdiction. Consent is obtained at the time of registration for the Service. For requests to suspend use or third-party provision, please refer to Section 13.

5.2 European Economic Area and the United Kingdom

For users residing in the EEA and the United Kingdom, we process personal data on the following legal bases.

For processing based on legitimate interests, the Company conducts balancing tests to confirm that the rights and freedoms of users are not unduly affected.

5.3 United States

Under U.S. state privacy laws, the Company acts as a "business" or "controller" when processing your personal information in connection with the Service. When processing personal information on behalf of corporate users, the Company acts as a "service provider" or "processor".

6. Purposes of Use of Personal Information

The Company uses personal information for the following purposes:

• To provide, operate, and maintain the Service (including account creation, identity verification, and customer support)
• To process billing and payments
• To improve the Service, develop new features, and enhance quality (including analysis of usage patterns)
• To ensure security and to prevent and detect misuse
• To comply with applicable laws and regulatory requirements
• To send notifications and updates regarding the Service

The Company will not use personal information beyond the scope necessary to achieve the purposes set forth above (data minimization principle).

7. Consent and Withdrawal of Consent

8. Third-Party Provision

The Company may provide personal information to third parties only in the following cases:

• Service providers (entrusted parties): cloud hosting, payment processors, analytics providers, and AI service providers. Under the APPI, these arrangements constitute entrustment of handling and do not constitute "third-party provision."
• Where required by law: when required by law or in response to lawful requests from courts, regulatory authorities, or law enforcement
• Business succession: in connection with a merger, acquisition, or business transfer
• With your consent: where prior consent has been obtained

The Company enters into agreements with entrusted parties that obligate them to implement appropriate safeguards in accordance with applicable laws.

9. Sale and Sharing of Personal Information

10. Cross-Border Data Transfers

Because the Service is provided globally, personal information may be transferred outside Japan. Depending on the jurisdiction, the Company applies the following safeguards:

• Japan: Under the APPI, when providing personal data to third parties located outside Japan, the Company will obtain prior consent from the data subject, confirm that the recipient has implemented measures meeting the standards prescribed by the rules of the Personal Information Protection Commission, or confirm that the recipient is located in a country recognized as having an equivalent level of protection.
• EEA and UK: For personal data of EEA and UK users, the Company implements Standard Contractual Clauses or other appropriate safeguards.
• Other jurisdictions: The Company enters into data processing agreements or other legally binding instruments to ensure an appropriate level of protection.

11. Data Security

In accordance with the safeguards required under the APPI (organizational, personnel, physical, and technical measures), the Company implements security measures including the following:

• Data encryption in transit (TLS/SSL) and at rest
• Access control and authentication management
• Regular security assessments and audits
• Employee training and education on personal information protection

No method of transmission over the Internet or method of electronic storage is completely secure, and absolute security cannot be guaranteed.

12. Data Retention

The Company retains personal information for the period necessary to achieve the purposes of collection or for the period required by law. Following termination of the service contract, the Company will delete or anonymize user data within 30 days in accordance with Article 9 of the Terms (except where retention is required by law).

13. Your Rights

You may exercise the following rights with respect to your personal information. The application of each right depends on the law applicable to your place of residence.

* May not be available in all U.S. states. ** Disclosure in electronic record format is available under the APPI. *** Filed through the State Attorney General.

13.1 How to Exercise Your Rights

• Email: ga@third-scope.com
• Web form: via the "Privacy Settings" page within the Service

13.2 Supervisory Authorities

If you are not satisfied with the Company's response, you may lodge a complaint with the following supervisory authorities:

• Japan: Personal Information Protection Commission (PPC) — https://www.ppc.go.jp
• EEA: The data protection supervisory authority of your member state — https://edpb.europa.eu/about-edpb/about-edpb/members_en
• UK: Information Commissioner's Office (ICO) — https://ico.org.uk
• U.S.: The Attorney General's Office of your state

14. Universal Opt-Out Mechanisms

The Company recognizes and respects browser-based universal opt-out mechanism signals, including the Global Privacy Control (GPC). Where you access the Service from a browser or device that transmits such signals, the Company will treat them as valid opt-out requests in accordance with applicable laws.

15. Cookies and Tracking Technologies

The Service uses cookies and similar technologies. For details, please refer to our Cookie Policy. For users in the EEA and the UK, the Company obtains consent through a cookie consent banner before placing non-essential cookies.

16. Generative AI — Special Provisions

KANATA AI uses generative AI technology to create content. The following provisions apply:

• Text input and content uploaded by users may be transmitted to third-party AI service providers for the purpose of content generation
• The Company does not use user input data for training AI models
• Users shall not include in inputs or uploads to the Service any Sensitive Information (special-care personal information and special categories of personal data) as defined in Section 4. The Service is not intended to process Sensitive Information; if a user inputs such information, the Company will not actively use such information for the purpose of providing the Service, and will take appropriate measures, including deletion, in accordance with applicable laws. Users should also avoid inputting personal information that is not necessary for business purposes. Where a corporate user inputs personal information of its employees or related parties, that corporate user shall be responsible for providing appropriate notice to and securing a legal basis with respect to such data subjects.

For users in the EEA and the UK, the legal basis for this processing is performance of a contract or consent. Under the APPI, this processing falls within the purposes of use specified in Section 6.

17. Children's Privacy

The Service is primarily intended for business use and is not directed to children.

• Under 13: The Company does not knowingly collect personal information from children under the age of 13. If the Company becomes aware that such information has been collected, it will be promptly deleted in accordance with applicable laws.
• Under 16: The Company will not sell or share personal information of minors under the age of 16 in accordance with applicable laws.

18. Data Protection Impact Assessments

The Company conducts data protection impact assessments for processing activities that may pose a high risk to the rights and freedoms of individuals (including the generative AI content processing features). The results of such assessments will be provided upon request from the relevant supervisory authority.

19. Data Breach Response

20. Financial Incentives

The Company does not offer any financial incentive program in connection with the collection, retention, sale, or sharing of personal information.

21. Changes to This Policy

The Company may update this Policy from time to time. Updated policies will be published on our website. For material changes, the Company will notify users by email or in-app notice. Where a material change requires a new legal basis, the Company will obtain consent before such change takes effect.

22. Complaints and Inquiries

If you have any questions, complaints, or concerns regarding this Policy, please contact us via the contact in Section 2. If you are not satisfied with the Company's response, you may lodge a complaint with the relevant supervisory authority (Section 13.2).

23. Governing Law

This Policy is governed by the laws of Japan. Any dispute arising from or related to this Policy shall be resolved in accordance with Article 29 of the Terms. This governing law provision does not limit your rights under any mandatory data protection laws applicable in your place of residence.