Privacy Policy

In this Policy, "Personal Information" means personal information as defined by Japan's Act on the Protection of Personal Information, as well as any information protected as personal data or personal information under applicable data protection laws in other countries or regions.

We collect the following information to the extent needed to provide the Service:

1. Account information: your Google account identifier, email address, display name, and profile image
2. Profile information: the display name and profile image you set
3. Service content: prompts, conversation history, uploaded images, logos and other assets, projects, designs, Output, and exported files
4. Usage and technical information: IP address, browser, operating system, device information, access times, pages viewed, features used, cookies and other identifiers, and error and security logs
5. Subscription and payment information: Stripe customer ID, subscription plan and status, billing and payment history, card brand, and last four digits. We do not collect or store full card numbers or security codes in the Service.
6. Support information: your name, email address, message, attachments, and support history
7. Integration information: identifiers for clients connected through MCP or similar methods, authorized scopes, connection times, and records of actions taken through the Service

1. Directly from you when you register, enter information, upload content, generate content, contact us, or otherwise use the Service
2. Automatically when you access or use the Service
3. From Google, Stripe, and other service providers when needed for authentication, payment, or delivery of the Service
4. From MCP clients and other external services you authorize to connect

1. To provide, store, sync, export, and operate the Service
2. To verify your identity and manage login, accounts, and MCP connections
3. To generate and edit designs, images, and other content with AI
4. To manage paid-plan signup, payment, renewal, plan changes, cancellation, refunds, and credits
5. To respond to inquiries and investigate and resolve outages and defects
6. To detect, prevent, and address misuse, violations of our Terms, and security threats
7. To send important notices about authentication, payments, outages, and changes to our Terms or policies
8. To analyze use of the Service and improve it without identifying individuals or User Content
9. To comply with legal obligations and establish, exercise, or defend legal claims

We do not send marketing emails about new features, promotions, or other advertising.

Where the EU General Data Protection Regulation (GDPR), UK GDPR, or another law requires us to state a legal basis, we process Personal Information on the following grounds:

1. Performance of a contract: to create your account and provide AI generation, storage, payment processing, and other Service features you request
2. Legal obligation: to meet tax, accounting, and other legal requirements, and to establish, exercise, or defend legal claims
3. Legitimate interests: to secure the Service, prevent fraud, respond to support requests, and improve the Service, including analytics where permitted by applicable law
4. Consent: for optional processing such as Google Analytics in regions where prior consent is required

To process your instructions, the Service sends prompts, relevant conversation history, attached images, and related design data to the Anthropic or OpenAI API.

We do not use User Content to train AI models. Inputs and outputs sent through the Anthropic and OpenAI APIs are not used to train their models unless you explicitly opt in. We do not enable data sharing for training.

Under their standard settings, AI providers may retain some inputs and outputs for up to 30 days to monitor misuse and comply with law.

AI provider safety systems may automatically review inputs and outputs and may reject certain requests.

We use cookies and local storage that are necessary to keep you signed in, maintain security, remember language and theme preferences, and provide other features you request. These technologies cannot be declined.

We start Google Analytics automatically in Japan and the United States. In other regions, or when we cannot determine the country, we start it only after you select Allow in the cookie consent prompt. You can decline or change your choice in every region.

We engage the following providers to process information or use their services as needed to deliver the Service:

1. Vercel: Service hosting and delivery, request-country detection, and platform logs
2. Cloudflare: content delivery, security, logs, file storage, image processing, and export processing
3. Supabase: authentication, database hosting in the Tokyo region, and real-time synchronization
4. Google: Google sign-in, support through Google Workspace, and Google Analytics
5. Stripe: payments, billing, subscriptions, and refunds
6. Anthropic: conversations, design generation, and related file processing
7. OpenAI: image generation and editing
8. Pexels, Iconify, Google Fonts, and jsDelivr: asset search and delivery of images, video, icons, fonts, and approved scripts
9. MCP clients and other integrations you choose: access to and operation of the Service within the permissions you grant

We do not sell or disclose Personal Information to third parties except in the following circumstances. Processing by a service provider as needed to fulfill the purposes above may not constitute third-party disclosure under applicable law.

1. You have given consent
2. Disclosure is necessary to protect a person's life, health, or property and obtaining consent is difficult
3. Disclosure is required by law or in response to a lawful request from a court, regulator, or other authorized public body
4. Information is transferred to a successor as part of a merger, sale, or other business succession

We do not sell Personal Information or share it for third-party behavioral advertising.

Your Personal Information may be processed or stored outside Japan when we use external services. The main recipients include Vercel, Cloudflare, Google, Stripe, Anthropic, OpenAI, and the other providers listed in Article 8.

We protect Personal Information processed outside Japan through contractual safeguards, access controls, encryption, and other reasonable measures. Where required by applicable law, we use standard contractual clauses or another valid transfer mechanism.

User Content is not made available to other users or the public and, as a rule, is not accessed by our authorized personnel.

Authorized personnel may access User Content only to the extent needed to respond to a support request, investigate an outage or defect, address misuse, or comply with law. Access is limited to what is necessary for their role.

1. Account information, projects, conversations, uploaded assets, and Output: for the life of your account; deleted immediately from active systems when you delete your account
2. Inputs and outputs sent to Anthropic and OpenAI: up to 30 days under each provider's standard settings, except where longer retention is needed to address misuse or comply with law
3. User-level and event-level Google Analytics data: 14 months; anonymous aggregate reports may be retained longer
4. Transaction records for billing, payments, and refunds: generally seven years under tax and accounting laws
5. Hash of your Google account identifier used to prevent repeated free-credit claims: retained until the Service is discontinued and does not include your name or email address
6. Support, security, and misuse records: for as long as needed to handle the matter and prepare for legal claims

We use reasonable safeguards to prevent unauthorized disclosure, loss, or damage of Personal Information, including encryption in transit, access controls, least-privilege permissions, authentication, row-level database security, log monitoring, and vendor review.

If a Personal Information breach occurs, we will investigate, mitigate its impact, notify the appropriate authorities, and inform affected individuals as required by applicable law.

Subject to applicable law, you may make the following requests regarding your Personal Information:

1. Access to Personal Information we hold and information about how it is processed
2. Correction, completion, or updating of inaccurate Personal Information
3. Deletion or erasure of Personal Information
4. Suspension or restriction of processing or cessation of third-party disclosure
5. Data portability where provided by applicable law
6. Withdrawal of consent and objection to processing based on legitimate interests

Send requests to hello@rikyu.ai. We may ask for information needed to verify your identity. Requests are free of charge and will be handled without undue delay as required by law. You may also lodge a complaint with the data protection authority where you live.

The Service is intended for people aged 18 or older and may not be used by anyone under 18. If we learn that we have collected Personal Information from someone under 18, we will take reasonable steps to delete it promptly.

We may update this Policy to reflect changes in law, the Service, or how we handle Personal Information.

If we make a material change, we will notify you by email or through the Service before it takes effect. The revised Policy applies from the date it is posted on this page or the effective date stated in the notice.

Data controller: Kaisei Suzuki

Address: We will disclose it without delay upon request.

Email: hello@rikyu.ai