Privacy Policy

1. Our approach

San Space Japan G.K. (“we,” “us,” or “our”) handles personal information appropriately when providing “NinjaFlow” (the “Service”), in accordance with Japan’s Act on the Protection of Personal Information and other applicable laws.

2. Information we collect

• Account information, including your email address and authentication information.
• Workspace and subscription information, including plan and payment status. We do not store credit-card numbers; our payment processor, Stripe, handles them.
• Content you enter or upload to the Service, such as meeting notes and business flows.
• Usage and log information, including access logs, generation counts, and token usage.

3. How we use information

• To provide, maintain, and improve the Service, authenticate users, and process payments.
• To respond to inquiries and send important notices.
• To prevent misuse and analyze service usage.

4. Sharing and service providers

Except where required by law, we do not provide personal information to third parties without the individual’s consent. To provide the Service, we use the following service providers:

• Hosting: Railway Corp. (United States)
• Database and authentication: Supabase Inc. (United States)
• Payment processing: Stripe, Inc. (United States)
• AI processing: Anthropic, PBC (United States). Content entered in the Service is sent for flow generation when that function is used.
• Official consultation intake: the NinjaFlow application consultation database.

When personal information is provided to third parties located outside Japan, we take appropriate measures under Japan’s Act on the Protection of Personal Information.

5. Official consultation intake

Our official consultation intake collects a consultation category, company or department, business contact name, business email address, optional organization-size range, and required consultation text. We use this information to respond to the consultation and make necessary contact. We do not request attachments, credentials, payment information, health information, government-issued identifiers, or confidential information.

We retain consultation originals and content-free intake audit events in the NinjaFlow application database for seven years. Public intake admission does not depend on the ability to delete an individual copy of the internal notification. Full content in the NinjaFlow database is limited to designated consultation responders who are authenticated and audited as developer administrators.

The internal intake notification includes only the consultation category, received time, and an opaque reference, plus opaque delivery controls (a thread reference, a delivery-attempt reference, and a one-time completion token) that contain no contact details or consultation content. It does not include the consultation text, company or department, business contact name, business email address, or organization-size range. The notification process hides its inputs and outputs from run history, and that run history follows the standard retention, legal-hold, and access configuration of our business environment. Please do not submit confidential information or sensitive personal information through the consultation intake.

6. AI processing

Content you enter is sent to an AI provider’s API to generate business flows and related materials. The API plan we use is configured so that submitted data is not used to train AI models.

7. Security measures

To prevent unauthorized access, loss, or leakage of personal information, we use measures including encrypted communications, access controls that separate data by workspace, and permission management.

8. Requests for access, correction, or deletion

You may request access to, correction of, suspension of use of, or deletion of your personal information. Please contact us using the details below. We will verify your identity and respond in accordance with applicable law.

9. Cookies

We use cookies to maintain sign-in state and for related service functions. We do not currently use third-party advertising cookies.

10. Changes to this Policy

We may revise this Policy in response to legal or service changes. We will notify you in the Service of material changes.

11. Contact

San Space Japan G.K.
Nishishinbashi Dai-ichi Hoki Building 2F, 3-5-2 Nishishinbashi, Minato-ku, Tokyo 105-0003, Japan
Email: [email protected]