Privacy Policy

In this Policy, "personal information" means personal information as defined in Article 2, Paragraph 1 of the Act; that is, information about a living individual that can identify the specific individual by name, date of birth, or other description contained in such information (including information that can be readily collated with other information and thereby identify the specific individual), or that contains an individual identification code.

The Company acquires personal information by lawful and fair means. The personal information acquired by the Company mainly includes the following:

• Name, company name, department, job title, e-mail address, telephone number, address, and other contact details;
• Information provided in the course of inquiries, business discussions, contract procedures, and other communications;
• Information provided by applicants in connection with recruitment screening (such as information contained in résumés and work histories);
• Information acquired through the exchange of business cards or by other means at exhibitions, seminars, and events (including cases where information on visitors or participants is provided to the Company through organizers or other third parties);
• Information automatically acquired in connection with the use of the Company's website (such as access logs, cookies, and device/browser information; please refer to "9. Cookies and External Transmission").

The Company uses the personal information it acquires within the scope of the following purposes:

• To provide, operate, maintain, and improve the Company's services (including the AI agent governance platform "Tumiki" as well as AI/system development and consulting);
• To communicate with customers and business partners, and to manage business discussions, the conclusion and performance of contracts, and billing and settlement;
• To respond to inquiries, requests, complaints, and the like;
• To provide information such as announcements regarding the Company's services, products, seminars, and events;
• To conduct sales activities and provide information regarding the Company's services and products, based on personal information acquired through exhibitions, seminars, and events;
• To carry out recruitment screening and recruitment activities (including communication with applicants);
• To analyze the usage of the Company's website and to improve its quality and user experience;
• To respond to acts that violate laws or this Policy;
• For purposes incidental to the above purposes of use.

Where the Company changes a purpose of use, it will do so within a scope reasonably deemed to have relevance to the pre-change purpose, and will notify the individual of, or publicly announce on the Company's website, the changed purpose of use.

In principle, the Company does not acquire special care-required personal information (such as medical history, results of health examinations, and other information defined in Article 2, Paragraph 3 of the Act) without the consent of the individual. However, in the course of performing work entrusted by a customer, the Company may handle data including special care-required personal information under the customer's control, in which case such handling follows the scope of the agreement with, and the instructions of, the relevant customer.

In providing "Tumiki" to customers, in entrusted system/AI development, and in performing other work, the Company may be entrusted with the handling of personal data by customers. In such cases, the Company handles such personal data only within the scope of the agreement with the customer and the customer's instructions, and does not use it for any purpose other than the entrusted purpose. The conditions for handling such personal data (including the scope of handling, security control measures, and return or deletion) are governed by the individual agreement or data handling arrangements between the customer and the Company.

Except in the following cases, the Company will not provide personal data to third parties without obtaining the prior consent of the individual:

• Where based on laws and regulations;
• Where necessary for the protection of the life, body, or property of an individual, and it is difficult to obtain the consent of the individual;
• Where especially necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain the consent of the individual;
• Where it is necessary to cooperate with a national government organ, a local government, or a party entrusted thereby, in executing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the execution of such affairs;
• In other cases permitted under the Act.

The Company may entrust all or part of the handling of personal data to third parties within the scope necessary to achieve the purposes of use. In such cases, the Company selects the entrusted party after conducting an appropriate examination, concludes an entrustment agreement, and exercises necessary and appropriate supervision.

In using cloud services, external artificial intelligence (AI) related services, and the like, the Company may entrust the handling of, or provide, personal data to third parties located in foreign countries. In such cases, the Company will do so in accordance with the Act, after taking measures such as providing the required information and obtaining the consent of the individual. The Company endeavors to ensure that appropriate security control measures are taken by such third parties located in foreign countries.

On the Company's website, cookies and similar technologies may be used, and information on usage may be acquired and transmitted through access analysis tools and the like, in order to improve convenience and to analyze usage. Such information may be acquired in a form that cannot, by itself, identify a specific individual. Users may refuse to accept cookies through their browser settings; however, in that case, some functions of the Company's website may not be available.

As a company that promotes the appropriate governance and safe utilization of AI agents, the Company ensures the appropriate handling of personal information and confidential information also when using generative AI and the like in its operations. In accordance with its internal rules, the Company manages the scope of information input into AI and does not engage in any use that is likely to harm the rights and interests of individuals.

The Company takes organizational, personnel, physical, and technical security control measures to prevent the leakage, loss, or damage of the personal information it handles, and otherwise to manage personal information securely. The specific details of these security control measures are set forth in the Company's internal rules. Inquiries regarding security control measures may be directed to the contact desk set forth in "13. Contact and Complaints Desk."

Where an individual requests, based on the Act, notification of the purpose of use, disclosure, correction, addition, or deletion of the content, suspension of use, erasure, or suspension of provision to third parties (hereinafter "Requests for Disclosure, etc.") of retained personal data, the Company will, after confirming that the request is made by the individual, respond without delay in accordance with the provisions of laws and regulations. Requests for Disclosure, etc. may be submitted to the contact desk set forth in "13. Contact and Complaints Desk."

For opinions, questions, complaints, or other inquiries regarding this Policy or the handling of personal information, please contact the following:

• RAYVEN Inc. Personal Information Inquiry Desk
• Contact form: https://rayven.co.jp/contact
• E-mail: info@rayven.cloud

The Company complies with the laws and regulations, guidelines established by the government, and other norms concerning the handling of personal information, and endeavors to review the status of its handling of personal information as appropriate and to make continuous improvements.

The Company uses YouTube API Services in an internal video production tool that it operates. The tool is used solely by the Company's employees to upload videos produced by the Company to YouTube channels that the Company manages, and is not offered to third parties as a service.

The Google Privacy Policy (https://policies.google.com/privacy) applies to the use of YouTube API Services. Please refer to that policy regarding Google's handling of information. The Company also complies with the YouTube Terms of Service (https://www.youtube.com/t/terms).

The information the Company obtains and handles through YouTube API Services is as follows.

• Video files produced by the Company and their titles, descriptions, and tags (uploaded by the Company)
• Identifiers of uploaded videos (video IDs) and the times at which they were posted
• Information about the Company's channel, used to confirm that the destination is the Company's own channel
• Statistics such as view counts for videos posted by the Company, used to understand the operating status of the Company's channel

The Company does not obtain personal information of viewers or other third parties through the tool. The Company does not authorize the tool with any third party's Google account, and does not collect or store information that identifies viewers as individuals.

Information obtained through YouTube API Services is stored in the Company's managed environment only for the period necessary to operate the Company's channel, and is deleted when no longer required. Authorization credentials stored by the Company (such as access tokens) may be revoked at any time from the Google security settings page (https://security.google.com/settings/security/permissions), after which uploads by the Company will stop.

The Company uses TikTok's Content Posting API in the internal video production tool described in Article 15. The tool is used solely by the Company's employees to send videos produced by the Company to a TikTok account that the Company manages, and is not offered to third parties as a service.

The TikTok Privacy Policy (https://www.tiktok.com/legal/privacy-policy) applies to the use of TikTok API Services. Please refer to that policy regarding TikTok's handling of information. The Company also complies with the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service).

The information the Company obtains and handles through TikTok API Services is as follows.

• Video files produced by the Company and the captions attached to them (sent by the Company)
• Identifiers of the videos sent and their processing status
• The identifier (open_id) of the Company's own account that granted authorization

The Company does not obtain personal information of viewers or other third parties through the tool. The Company does not authorize the tool with any third party's TikTok account, and does not retrieve other users' posts, profiles, or comments.

Authorization credentials stored by the Company (such as refresh tokens) are kept only in the Company's managed environment and are not provided to third parties. Authorization may be revoked at any time from the TikTok app settings, after which sending by the Company will stop.

The Company may amend this Policy in response to amendments to laws and regulations, changes in the Company's business, and the like. When this Policy is amended, the amended content will be posted on the Company's website. Where an amendment requires the consent of the individual under laws and regulations, the Company will obtain such consent by a method prescribed by the Company.