STORYAI / Legal

Privacy Policy

1. Purposes of Use of Personal Information

We collect the following types of information through the specified acquisition methods for each defined purpose of use.

No.PurposeInformation CollectedMethod of Acquisition
1To provide our products and services
  • IT system information (usernames, user IDs, location information, IP addresses, online identifiers, resources accessed, access timestamps, device names, domain names, information regarding resources included in alerts, and additional information regarding software usage patterns such as cookies)
  • Threat intelligence related to security events and alerts, including malicious files, network fragments, processing details, domain names, and network paths
  • User account credentials to access our services
  • Personal contact information (name, address, email address, telephone number, fax number, and job title/organizational affiliation)
  • Employment information (company name, workplace, title, and work history)
  • Consultations, technical support, and service delivery related to information technology
  • Communication and data regarding overall data re-menu configuration, administrator reconfigurations, email transmissions, technical support, and administrative management where remote administrative access may occur
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
2For business communication, meetings, and contract execution/management with business partners
  • Contact information (name, address, email address, telephone number, fax number, and job title/organizational affiliation)
  • Employment information (company name, workplace, title, and work history)
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
3For surveys and analysis regarding the planning, R&D, and other sales/marketing activities of products and services
  • Employment information (company name, workplace, title, and work history)
  • Communication and data regarding overall data re-menu configuration, administrator reconfigurations, email transmissions, technical support, and administrative management where remote administrative access may occur
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
4To provide updates, announcements, and event invitations regarding products and services handled by us
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Employment information (company name, workplace, title, and work history)
  • Communication and data regarding overall data re-menu configuration, administrator reconfigurations, email transmissions, routine executions (including contents), and email communications in the course of providing IT consultations, support, and services where remote administrative access may occur
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
5To respond to inquiries, requests, and support tickets
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Employment information (company name, workplace, title, and work history)
  • Communication and data regarding overall data re-menu configuration, administrator reconfigurations, email transmissions, routine executions (including contents), and email communications in the course of providing IT consultations, support, and services where remote administrative access may occur
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
6To promote and improve public relations (PR) and investor relations (IR) activities
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Employment information (company name, workplace, title, and work history)
  1. Direct provision from the individual
7To ensure company security and manage organizational crises
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
8For communication and evaluations regarding employment decisions of job applicants and recruitment activities
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Gender
  • Age
  • Information related to hiring decisions
  • Evaluative information for hiring decisions, including aptitude, qualifications, achievements, and resume/work history (including items combinable with other data to identify individuals)
  • Collection of this applicant data is strictly limited to what is necessary for recruiting operations.
  1. Direct provision from the individual
  2. Indirect collection from third parties
9For personnel and labor management of officers and employees
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Gender
  • Age
  • Information related to personnel decisions
  • Individual identification numbers (My Number, employee IDs, etc.)
  • Evaluative information for employment determinations, including aptitude, qualifications, performance, and background (including items combinable with other data)
  • Other personal details, which may include physical, physiological, mental, psychiatric, cultural, or social identity information
  1. Direct provision from the individual
  2. Indirect collection from third parties
10To conduct business equivalent to any of the above, and to carry out operations necessary for the smooth and harmonious execution of company administration
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Employment information (company name, workplace, title, and work history)
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
11To comply with statutory requirements or directives, notices, and guidance from administrative authorities
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Organizational data (company name, organizational unit, title, and assignment)
  • Employment information (company name, organizational unit, title, and assignment)
  1. Direct provision from the individual
  2. Purposeful automated logging when the individual utilizes our services
  3. Indirect collection from third parties
12For shareholders' exercise of statutory rights and fulfillment of legal obligations, communications, information provisioning, and shareholder registry management
  • Contact information (name, address, email address, telephone number, fax number, and job title/timezone information)
  • Organizational data (company name, organizational unit, title, and assignment)
  1. Direct provision from the individual

2. Security Control Measures

To prevent unauthorized leaks, loss, or damage of personal data, we implement the following necessary and appropriate technical, physical, and organizational security measures to maintain and enhance security standards.

CategorySecurity Measure Details
Supervision of Personnel Handling Personal Data & User Authentication ControlsUser authentication mechanisms are enforced, and technical security measures including rigorous password management are maintained.
Access Control
  • Privileged access criteria and document management policies are strictly enforced; sensitive information is password-protected and subject to formal authorization procedures.
  • Passwords for accessing personal data must be complex and comply with specialized criteria.
  • Files and directories storing personal data strictly adhere to encryption governance protocols.
  • Personal data is only accessible via designated secure, isolated environments.
Input and Processing Control
  • Storage of personal data is systematically governed.
  • System audit trails record who accessed personal data, timestamps, access/modification authorization privileges, and areas requiring rectification.
Access Permissions & External Request Logs
  • Directives and instructions from individuals or personnel/HR divisions are methodically recorded and managed.
  • Audit trails of directives and workflows are preserved to ensure evidence preservation in the event of an incident.
Availability & Disaster Recovery Controls
  • Disaster recovery drills and training are routinely conducted.
  • Redundant data backups are systematically maintained.
  • Data restoration and recovery systems are established alongside periodic backup restoration tests.
Prevention of Unlawful Data LeaksContinuous system monitoring and maintenance workflows are implemented to safeguard against data leaks, including 24/7/365 coverage during non-working days and weekends.

3. Provision of Personal Data to Third Parties

We will not disclose or provide personal data to third parties without prior consent, except where permitted by applicable law. Sharing data under joint use arrangements or disclosing data to contractors/processors (see Section 5) does not constitute provision to third parties.

We may disclose personal data without prior consent under the following legitimate grounds:

  1. When required by applicable laws and regulations;
  2. When necessary to protect human life, physical safety, or property, and obtaining consent is impractical;
  3. When especially necessary to enhance public health or promote the healthy upbringing of children, and obtaining consent is impractical;
  4. When necessary to cooperate with national administrative agencies, local public bodies, or their delegates in executing statutory duties, where obtaining consent might impede such execution.

4. Joint Use of Personal Information

We may jointly utilize the personal data in our custody as follows:

  1. Items of Jointly Used Personal Data
    Name, company name, department, title, address, telephone number, fax number, email address, and other data fields necessary to achieve the designated purposes.
  2. Scope of Joint Users
  3. Purposes of Joint Use
    To fulfill the purposes specified above in Section 1 ("Purposes of Use of Personal Information").
  4. Entity Responsible for Management of Joint Use
    ZEAL Corporation (Personal Information Protection Manager)

5. Supervision of Contractors / Processors

To the extent necessary to achieve the stated purposes, we may entrust all or part of personal data handling operations to external service providers. In such cases, we select qualified contractors and ensure necessary and appropriate supervision—including data protection covenants in agreements—so that entrusted data receives protection equivalent to our internal standards.

6. Confirmation, Rectification, and Rights of Data Subjects

We endeavor to maintain accurate and up-to-date personal data within the scope necessary for our stated purposes. If you wish to request access, correction, addition, deletion, suspension of use, erasure, or cessation of provision to third parties regarding your personal data, please reach out to our contact window:

<Personal Data Inquiries Window>

  • Mailing Address: Meguro Tokyu Building 6F, 2-13-17 Kami-Osaki, Shinagawa-ku, Tokyo 141-0021, Japan
    ZEAL Corporation, Personal Information Inquiries Window
  • Email: zeal_privacy@zdh.co.jp

7. Cookie Policy

We may utilize cookies for the following operational purposes:

  1. Displaying optimized and relevant advertisements on third-party websites based on your interests and activity across our website;
  2. Distributing advertisements and promotional campaigns regarding our products and services;
  3. Tailoring and presenting personalized website content;
  4. Monitoring site visitor metrics and web traffic volume;
  5. Enhancing and optimizing our services.

We may also store and access cookies via third-party service providers entrusted with ad delivery and site administration.

* What is a Cookie?
A cookie is a small data file transferred between your browser and the web server during web visits, stored on your computer or device. When revisiting the same page, the site operator can utilize this cookie information to tailor content.
If your browser settings permit cookie acceptance, our website may retrieve these cookies. If cookie storage is permitted, we may associate collected web browsing history with personal information.
You can disable cookies by adjusting your browser preferences. Please note that disabling cookies may cause access restrictions or prevent you from accessing authenticated services.

8. Collection of Access Logs

To facilitate web maintenance and service optimization, this site logs visitor access history. Access logs encompass visitors' domain names, IP addresses, browser and OS environments, access timestamps, visited pages, and navigation patterns.

9. Retention and Deletion Criteria

Personal data gathered by us will be permanently erased upon the occurrence of either of the following events:

  1. When the stated purposes in Section 1 have been fulfilled, and retaining the personal data is no longer necessary;
  2. When the original purposes in Section 1 cannot be completed, but maintaining data is no longer necessary due to project cancellation, business termination, etc.

10. Amendments to this Policy

The terms within this policy take effect on the publication date. This policy may be amended at our discretion. When updates occur, the "Last Revised Date" will be updated accordingly, and modifications take effect immediately upon the stated revision date.

External Data Transmissions Across Our SaaS & Web Services

Across our services, we may collect the following user data depending on collection methodologies:

User-Provided Information

Information submitted directly by users to access or use our services includes:

  • Profile data: name, address, date of birth, gender, occupation, employer/affiliation, etc.;
  • Contact data: email address, telephone number, etc.;
  • Payment data: credit card numbers, bank account information, etc.;
  • Identity verification data: photo ID images (driver's licenses, passports, etc.) displaying user portraits;
  • Information inputted or submitted through web input forms and other designated channels.

Information Collected Automatically Through Service Usage

  • Payment Processing via Stripe:
    We utilize Stripe to process payments across our service. Users submit the required payment information directly, which is stored securely in Stripe's infrastructure. In using Stripe, our internal systems retain no identifiable financial data other than the User ID, Username, and Email address.
    Data collected via Stripe is governed under Stripe's Privacy Policy (available at https://stripe.com/jp/privacy). We assume no liability for damages resulting from the use of Stripe services.
  • Traffic and Access Data:
    We may record technical access information regarding your use of our service and apps, including:
    • HTTP Referrers
    • IP addresses
    • Server access logs
    • Cookies, ADIDs, IDFAs, and other device identifiers
  • Usage Analytics (Google Analytics & FullStory):
    To analyze usage trends and enhance service performance, we deploy Google Analytics and FullStory. These tools capture page views, impression counts, visit frequency, conversion actions, clicks, and other browsing behavioral metrics ("Numerical Metrics"), alongside referrers, IP addresses, and cookie/ADID/IDFA identifiers. Numerical Metrics are anonymized, aggregated, and reported to us. We do not obtain directly identifiable personal data through Google Analytics or FullStory.
    Data gathered via these services is administered under the privacy policies of Google LLC ("Google") and FullStory Inc., respectively:

External Transmissions Related to Application Usage

Users acknowledge and agree that to evaluate user behavior and fulfill the purposes set out below, our applications may transmit information to Google's Firebase platform for analysis and operations:

  1. Google Analytics for Firebase (Firebase Analytics)
  2. Firebase Cloud Messaging
  3. Firebase Hosting

Data gathered by Google is processed and retained under Google's responsibility in accordance with Google's policies. For detailed information, review the following:

Handling of Google User Data

Our application strictly adheres to the Google API Services User Data Policy, including the Limited Use requirements, regarding the handling of user data obtained through Google APIs.

1. Data Accessed

With your explicit consent, our application accesses and collects the following data from your Google account:

  • Your Google email address
2. Data Usage

The Google user data we access is processed and used strictly for the following purposes:

  • To provide account registration and login functionality for our service.
  • To send system-related notifications, as well as marketing communications such as information about new features and updates.
3. Data Sharing

We do not sell, transfer, or share your Google user data with any third parties. Exceptions are limited to trusted infrastructure providers (e.g., cloud hosting services) necessary to operate our application, or when explicitly required by law.

4. Data Storage & Protection

We securely store and protect your Google user data using industry-standard security measures. This includes encrypting data in transit (using HTTPS/TLS) and at rest, as well as enforcing strict access controls to prevent unauthorized access, loss, or alteration.

5. Data Retention & Deletion

Your Google user data is retained only for as long as it is necessary to provide our services to you. If you delete your account or explicitly request data deletion, all your Google user data will be permanently and securely deleted from our systems within 30 days. Users can request data deletion at any time by contacting us at:

Privacy Protection Commitments

  • Recognizing the importance of personal data, "ZEAL" exercises the utmost care in protecting privacy across this website and implements the following initiatives.
  • "ZEAL" appoints personal data managers within each department handling personal information.
  • When "ZEAL" collects personal data from customers, we state the purpose, contact window, and scope of use, collecting only what is strictly necessary. When personal data is collected under these conditions, it shall be deemed that the customer has consented to "ZEAL" utilizing the personal data within the announced scope and purpose.
  • "ZEAL" securely manages personal data provided by customers and will never disclose or provide it to third parties other than authorized business partners.
  • "ZEAL" may occasionally send information regarding beneficial services or products via email. If you prefer not to receive these messages, you may contact our designated inquiry desk to suspend transmissions.
  • When customers request the disclosure, inspection, or correction of their personal data, "ZEAL" will handle the request promptly within a reasonable scope upon receiving contact via our inquiries desk.
  • "ZEAL" complies with all applicable laws and regulatory standards regarding personal information gathered via this website and will periodically review and improve the measures outlined above.
  • "ZEAL" logs the originating IP addresses of site visitors. This data is used solely to assess overarching usage trends and compile statistical analyses.
  • To enhance browsing convenience, "ZEAL" may deploy technologies such as Cookies and Web Beacons for session management and activity tracking. Unless explicitly stated otherwise in advance, these technologies are never combined with personally identifiable information.

Enacted: August 14, 2020
Revised: November 25, 2025