Privacy Policy

1. Information we collect

• Account information (company name, contact person, email address, etc.)
• Connection details for linked social accounts, including access tokens and authenticated session data
• Post material the customer uploads to the Service (text, images, etc.)
• Engagement data for posts (views, likes and similar, as far as each platform exposes it)
• The content of enquiries and AI chat conversations
• Service usage data (access logs, etc.)

2. Purpose of use

• To provide, operate and improve the Service
• To generate and localize posts with AI
• To respond to enquiries and send important notices
• To prevent misuse

3. Linked networks and external services

The Service connects to the following external services on the customer's instruction. Information obtained from them is never used for any purpose other than providing the Service.

3-1. TikTok

• Scopes requested: user.info.basic (basic profile information) and video.publish (publishing videos on the customer's instruction)
• Data stored: the TikTok open ID, the access and refresh tokens (encrypted at rest with AES-256-GCM), the token expiry, and the account's avatar image URL
• Purpose: to deliver posts the customer has created or scheduled to the customer's own account, and to show the linked account in the interface
• Information obtained from TikTok is never used for advertising, sold to third parties, or disclosed to anyone other than the customer
• Disconnecting: the customer can disconnect at any time from the dashboard, and the tokens are deleted on disconnection

3-2. Google and LINE sign-in

• Scopes requested: openid, email and profile for Google; openid, profile and email for LINE
• Data stored: the email address and display name only
• Purpose: identity verification and sign-in
• We never access the customer's mailbox, contacts or friend list

3-3. RED (Xiaohongshu)

• RED provides no public API, so the browser session the customer authenticates by QR code is held on a Company-managed server in Japan and used solely to publish and retrieve analytics on the customer's instruction
• We never hold the customer's RED password
• When the connection is removed, the session data we hold is deleted

3-4. LINE Official Account / Instagram / Facebook / X

• LINE Official Accounts are connected with a channel access token the customer issues in LINE Developers. The token is stored encrypted (AES-256-GCM) and deleted when the connection is removed
• When broadcasting to LINE, the post's text and image are sent to LY Corporation (Japan) and delivered to all friends of the customer's LINE Official Account. The Company does not obtain friends' personal data (such as user IDs); it reads only aggregate figures such as the friend count, to estimate message usage before sending
• Publishing to Instagram, Facebook and X is not yet available, and no post content is sent to them or to any external publishing service
• Before this becomes available, the Company will add the external services used and the information sent to this Policy and notify customers

3-5. AI processing

• Text entered into the Service is sent to Anthropic (the Claude API) to localize post copy, answer AI chat, and draft comment replies
• Text sent in this way is not used to train AI models

3-6. Infrastructure, payments and email

• Hosting and file storage: Vercel Inc. (the platform the Service runs on, and where images and videos are kept)
• Payments: Stripe, Inc. (card details never pass through the Company; Stripe handles them directly. We receive only the outcome of the charge and limited billing details such as country and postal code)
• Email delivery: Resend (notices, password resets and similar)

3-7. Analytics and ad measurement (external transmission)

On the Service's website, the following tools send the visitor's browsing information to their providers. Names, email addresses and phone numbers are never sent. The X Pixel is not loaded on the operator console.

• Google Analytics (Google LLC): pages viewed, referral source, browser information, identifiers such as cookies, and the fact that an account sign-up was completed, to understand site usage and measure advertising. How to opt out: Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout)
• X Pixel (X Corp.): pages viewed, browser information, identifiers such as cookies, and the fact that an account sign-up was completed (a random ID only), to measure X (formerly Twitter) advertising. How to opt out: X's "Personalization and data" settings (https://x.com/settings/account/personalization). For how X Corp. handles this data, see X's Privacy Policy (https://x.com/privacy)
• In either case, disabling cookies in your browser settings also limits this transmission

3-8. Transfers to third parties outside Japan

Of the processors and recipients listed in 3-1 to 3-7, Anthropic (United States), Vercel (United States), Stripe (United States), Resend (United States), Google (United States), X Corp. (United States), TikTok (Singapore and elsewhere) and RED (China) are located outside Japan. Data protection regimes in those countries may differ from Japan's. The Company transmits information only as far as providing the Service requires, and handles it under its agreements with each provider and the safeguards they publish.

4. Disclosure to third parties

Except where required by law, the Company does not provide personal information to third parties without the individual's consent. Processing entrusted to the external services listed above is limited to what is necessary to provide the Service.

5. Security measures

• All traffic is encrypted with TLS
• Passwords are stored hashed and never kept in plain text
• TikTok access and refresh tokens are encrypted at rest with AES-256-GCM
• Database access is restricted by origin and by privilege
• Access rights are limited to what each role needs (principle of least privilege)

6. Disclosure, correction and deletion

Requests from the individual to disclose, correct or suspend the use of their retained personal data are handled without delay in accordance with the law. On cancellation, customer data is handled under the Company's procedures except where a statutory retention obligation applies.

7. Contact

Email: support@rakusocia.jp (Great Bright Science and Technology Inc., personal data enquiries)