ZARMS Privacy Policy

Xgene Inc. (the “Company”) establishes this ZARMS Privacy Policy (this “Policy”) as set out below, in compliance with the Act on the Protection of Personal Information (the “APPI”) and other related laws and regulations, regarding the handling of personal information in ZARMS, the cloud service provided by the Company (the “Service”).

This Policy sets out provisions specific to the Service under the Company’s “Privacy Policy” (https://www.xgene.co.jp/en/privacy). Matters not covered by this Policy are governed by the Company’s Privacy Policy. If the two differ with respect to the Service, this Policy prevails.

This Policy applies to customers and users of the Service, and also to people who view the service website (https://www.zarms.cloud) and the help website (https://help.zarms.cloud) (including people who are not users of the Service; “Site Visitors”).

Article 1 (Definitions)

The terms “personal information,” “personal data,” “retained personal data,” “personally referable information,” and “special care-required personal information” in this Policy have the meanings given in the APPI. The terms “Customer,” “Team,” “User” (“Member” in the Service), “Admin,” “Owner,” “External Client,” “joining a Team,” “leaving a Team,” and “deleting personal data from ZARMS” have the meanings given in the ZARMS Terms of Service.

Article 2 (Our Role)

1. The Company handles personal information relating to accounts, contracts and billing, inquiries, use of the Service, and similar matters as a business operator handling personal information.
2. With respect to personal information contained in information that a Customer or User enters or stores in a Team (Members’ names and departments, cards, comments, files, etc.; “Team Data”), the Company handles it as a party entrusted by the Customer, to the extent necessary to provide the Service to the Customer. The Customer and its Admins decide what to enter into Team Data and with whom to share it.
3. Within a Team, personal information is displayed to other Users based on the roles and permissions set by the Customer or its Admins.

Article 3 (Information We Collect)

The Company collects the following information.

1. Account information: the identifier, display name, name, email address, and profile picture received from Google when you sign in with a Google account
2. Team Data: information that Users enter or create (cards, comments, mentions, tasks, requests and approvals, departments and titles, etc.)
3. Google Drive and related information: information within the scope set out in Article 5
4. Contract and billing information: Customer name, billing contact name and email address, plan, invoices, payment history, and customer identifiers at the payment service provider. Credit card numbers are collected and managed by the payment service provider; the Company does not hold them.
5. Usage records: operation history within a Team (audit logs, which do not include IP addresses or user agents), records of consent to the Terms of Service and other documents (date and time of consent, document version, and browser information), usage of AI features and credits, and records of API key issuance and External Client connections
6. Access and device information: IP address, browser, OS, and device type, access date and time, pages viewed, referrer, cookies and other identifiers, and records of on-screen interactions (Article 10)
7. Inquiry and material request information: email address, organization name, name, phone number (optional), inquiry type, inquiry content, and whether you consented to receive marketing emails (including the date and time of consent and the wording and version of the consent text), provided through the inquiry and material request form on the service website, by email to the Company (contact@zarms.cloud, support@zarms.cloud), or during support. When the form is submitted, we check browser and device information and similar data to prevent fraudulent submissions (Article 10).
8. Email delivery and engagement records: delivery status of emails sent by the Company, whether and when they were opened or clicked, the links clicked, the IP address, browser, and other information at that time (Article 10, Paragraph 2), and records of consent to receive marketing emails and of unsubscribing
9. Records of browsing and interactions on the service website and help website: Site Visitors’ pages viewed, referrer, in-page interactions (clicks, scrolling, etc.), session recordings (session replay; data is masked and not recorded), browser and device information, and cookies and other identifiers (Article 10). For people who submit an inquiry or material request from the service website, these records are linked to the inquiry information. For people confirmed to be users of the Service, these records are linked to their account. In these cases, earlier records of viewing the service website or help website on the same device and browser may also be linked to the inquiry information or account.
10. Information from inquiries within the Service and from Help: the content of inquiries received through the inquiry channel within the Service (shown to signed-in users) and the inquiry channel in Help (shown only to people confirmed to be users of the Service), together with the session replay and interaction records on the Service and the help website that are automatically attached to such inquiries
11. Service website AI chat information: questions entered in the AI chat on the service website (“Ask AI” on each page) and the conversation, the AI’s answers, a per-conversation ID, the path of the page being viewed, the heading of the section shown on screen, and the IP address used for rate limiting (Article 6, Paragraph 9)
12. Launch announcement signup (waitlist) information: the email address you enter when signing up through “Start for free” on the service website, the date and time of signup, and the record of your consent to receive marketing emails (including the date and time of consent and the wording and version of the consent text). When the form is submitted, we check browser and device information, etc. to prevent fraudulent submissions (Article 10).

The Company does not intend to collect special care-required personal information. Users must not enter special care-required personal information in free-text fields, comments, attachments, or the like.

Article 4 (Purposes of Use)

The Company uses the information it collects for the following purposes.

1. Providing the Service (sign-in, management of Teams, Users, and permissions, and features such as cards, comments, notifications, file integration, search, and export)
2. Providing AI features (summaries, classification, drafts, generating suggestions, assisting search, etc.)
3. Contracts, billing and payment of fees, and credit management
4. Identity verification, prevention of misuse and unauthorized access, ensuring security, and investigating and responding to failures
5. Tracking operations through audit logs, managing authoritative records, and handling disputes and inquiries
6. Responding to inquiries, material requests, and support (including sending replies and materials)
7. Important notices about the Service, and notices of changes to the Terms of Service, this Policy, and the like
8. Informing you about new features, ways to use, events, campaigns, etc. of the Service and the Company’s services (including sending news and marketing emails, and including emails to people who consented to receive marketing emails when making an inquiry or material request)
9. Improving the content and delivery of emails and measuring their effectiveness by measuring delivery, opens, and clicks of emails sent by the Company
10. Improving the Service and developing new features through usage analysis and surveys (including use as statistics that do not identify individuals)
11. Fulfilling obligations under laws or contracts (including retaining accounting and tax records)
12. Improving the content and structure of the service website and help website by analyzing how they are viewed (including analyzing the questions asked in the service website’s AI chat and its answers)
13. For users of the Service, linking browsing and interaction records on the service website and help website to their accounts and using them for support, Help, and improvement of the Service
14. Responding to inquiries from within the Service and from Help (including using the session replay and interaction records automatically attached to inquiries to understand the situation and reply)
15. For people who submit an inquiry or material request from the service website, linking their browsing and interaction records on the service website to the inquiry information and using them to respond to the inquiry, improve the content of our communications, and analyze how the Service is being evaluated and adopted
16. For people who sign up for the launch announcement (waitlist) on the service website, sending the launch announcement and later information about the Service by email

Marketing emails are sent only if you have consented in the consent field for receiving marketing emails (for users of the Service, this consent is obtained separately from consent to the Terms of Service). Customers and Admins cannot consent on your behalf. You can unsubscribe at any time from the link in each email or from the settings screen of the Service. Emails from the Service are sent from addresses on subdomains of the zarms.cloud domain (app.zarms.cloud and www.zarms.cloud).

If the Company changes a purpose of use, it does so only within the scope reasonably considered to be related to the original purpose, and publishes the changed purpose on the Service.

Article 5 (Handling of Google User Data)

1. Scope of access: Through Google OAuth, ZARMS asks users for access within the following scopes:
   1. Basic profile information (openid, email, profile): for sign-in and account identification
   2. Google Drive files (drive.file): limited to files created from ZARMS and files and folders that the user selects with Google Picker. ZARMS does not access the user’s entire Google Drive.
2. Use: Data received from Google is used only to provide and improve the ZARMS features the user uses. Specifically, this means creating, displaying, and organizing files and folders; reading the body of documents specified by the user to create summaries and search indexes; and processing in AI features run by the user (Article 6).
3. Storage: Google credentials (refresh tokens) are stored encrypted. Summaries and search indexes created from documents are stored as Team Data. Files on Google Drive themselves are stored in the Google account of the user or Customer, and are not deleted by deleting a Team, removing a Member from a Team, or the procedure for deleting personal data from ZARMS.
4. Sharing: The Company does not sell Google user data or use it for serving or targeting advertising. The Company transfers Google user data to third parties only (1) when entrusting its handling to the service providers in Article 7 to provide and improve the Service, (2) at the user’s operation or instruction (including sharing within a Team and sending to External Clients the user has authorized), (3) when required by law, or (4) in connection with a merger, acquisition, or transfer of business or assets (only with the user’s prior explicit consent).
5. Human access: The Company’s employees do not view Google user data except with the user’s consent, when necessary for security purposes (such as investigating misuse), when necessary to comply with the law, or for aggregated processing that does not identify individuals.
6. AI training: The Company does not use data obtained from Google Workspace APIs to develop, improve, or train generalized AI or machine learning models.
7. ZARMS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Revoking access: Users can revoke ZARMS’s access at any time from “Third-party apps & services” in their Google Account. After revoking access, Google Drive integration features can no longer be used.
9. Deleting Google user data: If access is revoked under the preceding paragraph, the Google credentials (refresh tokens) stored by the Company are deleted automatically. Other Google user data (summaries and search indexes created from documents, etc.) can be deleted through operations on the Service (including the procedure for deleting personal data from ZARMS; Article 12, Paragraph 6), or by request by email (support@zarms.cloud). Data contained in Team Data is handled in cooperation with the Customer as described in Article 13, Paragraph 2.

Article 6 (AI Features)

1. When a user runs an AI feature, or when a search index is created, the Company sends the information needed for processing (the user’s prompt, the target Team Data, parts of document bodies, etc.) through Vercel Inc.’s AI Gateway to Google LLC’s generative AI models (Gemini) and embedding models.
2. The Company does not use the information it sends to train its own AI models. The Company uses AI providers’ services under terms of use providing that submitted information (input and output data) is not used to train the AI providers’ models.
3. However, under their terms of use, AI providers may log submitted information and generated results for a limited period to detect and prevent misuse and to comply with the law. The location of this logging and processing is not limited to Japan.
4. The Company does not send AI feature prompts, responses, tool arguments, or their results to its usage analytics tool (PostHog). What it sends is the feature name, the model name and its provider, token counts, the reason processing ended, the time taken, the names of the tools used, the user ID, the session ID, the environment name, and, when an error occurs, the error message and where it occurred.
5. When a user connects an External Client via MCP to use the Service, the Company sends to its usage analytics tool (PostHog) the name and description of the tool called, the time taken, whether an error occurred and its type, the External Client’s name and version, the User-Agent, the conversation ID, the session ID, and the user ID. It does not send tool arguments, response content, error messages, or text written by the External Client such as the reason for the call.
6. If AI features are turned off in a Team’s settings, the Company does not send that Team’s information to the AI providers in Paragraph 1 (including creating search indexes of Google Drive documents and AI processing run by the Service when called from an External Client). Sending to External Clients that a user has connected themselves is outside the scope of this setting.
7. AI features may be used only by users aged 18 or older (Article 13 of the Terms of Service).
8. Output from AI features may be inaccurate. Users should check the content before making important decisions.
9. When a question is entered in the AI chat on the service website, the Company sends the question, the conversation, and the text of the page being viewed to Cloudflare, Inc.’s Workers AI (Google’s open model Gemma) to generate an answer. Cloudflare states that it does not retain the content after generating the answer and does not use it to train AI models. To improve the content and structure of the site and understand frequently asked questions, the Company sends the question and the AI’s answer, the path of the page being viewed and the section heading, a per-conversation ID, and the PostHog identifier (Article 10, Paragraph 3) to its usage analytics tool (PostHog), where they are stored in the US. Before sending, strings that appear to be email addresses or phone numbers, and long numbers, in the question and answer are masked (masking may not catch everything, so please do not enter personal information in the AI chat). The visitor’s IP address is not sent to PostHog. Nothing is sent to PostHog from a device and browser that has declined measurement under Article 10, Paragraph 4, or from a browser with Global Privacy Control enabled. Conversations are excluded from session recordings. In the browser, conversations are kept only in the visitor’s tab and are deleted when the tab is closed. To prevent abuse, the number of questions is limited per IP address (the IP address is used only to apply the limit and is not stored).

Article 7 (Entrustment of Handling)

The Company entrusts the handling of personal information to the following businesses to the extent necessary to achieve the purposes of use. The Company selects service providers appropriately and supervises them as necessary and appropriate through contracts and other means.

The Service’s database is stored on servers in Japan (Tokyo), and the application’s server-side processing also runs in Japan (Tokyo). The Service does not store files themselves; files are stored in the Google Drive of the user or Customer (Article 5, Paragraph 3). However, the service providers above include businesses outside Japan, and information may be processed and stored outside Japan for AI processing, usage analytics, receiving and managing inquiries, sending emails from PostHog, recording email delivery, rate limiting, and uptime monitoring and log storage (all in the US), delivering the service website, processing inquiry form submissions, and generating AI chat answers (Cloudflare; processed on servers in the country or region closest to the visitor), payments (including processing by Stripe’s affiliates and subprocessors), and similar purposes.

Article 8 (Provision to Service Providers Located Outside Japan)

1. As described in the preceding Article, the Company entrusts the handling of personal data to businesses in the United States and Ireland. Processing and storage by these businesses may take place in these countries or elsewhere outside Japan. Information is stored in the US for usage analytics (PostHog; including users’ email addresses and display names, and browsing and interaction records in Help), sending emails and recording their delivery (notification emails for the Service are sent from the US by Resend, and news and marketing emails are sent from the US by PostHog; including the delivery status and records of opens and clicks for each), rate limiting (Upstash), and uptime monitoring and log storage (Better Stack). Payment information is handled by Stripe Payments Europe, Limited in Ireland, the counterparty to Stripe’s data processing agreement, and may be processed in the US and other countries by its affiliates (including Stripe, LLC in the US) and subprocessors. Information from inquiries and material requests on the service website (email address, organization name, name, other inquiry information, and records of consent to receive marketing emails) is registered in PostHog and stored in the US regardless of whether you consented to receive marketing emails. Processing of form submissions and prevention of fraudulent submissions are performed by Cloudflare (Cloudflare, Inc. in the US) on servers in the country or region closest to the visitor (form contents are not stored at Cloudflare). Inquiry emails to support@zarms.cloud are received by PostHog and stored in the US. Emails to contact@zarms.cloud are received by Resend, forwarded to PostHog, and stored in the US. IP addresses sent to PostHog are used only to estimate approximate location (country, region, etc.) upon receipt and are not stored. In particular, the AI provider (Google LLC) may log submitted information for a limited period to detect and prevent misuse, and the storage location is not limited to any particular country (Article 6). Conversations in the service website’s AI chat are processed by Cloudflare’s Workers AI (Cloudflare, Inc., United States) to generate answers and are not stored at Cloudflare. Records of questions and answers are sent to PostHog and stored in the US (Article 6, Paragraph 9).
2. The Company has confirmed that its US service providers have established, through terms of use, data processing agreements, and the like, a system to take measures consistent with the intent of the provisions of Chapter 4, Section 2 of the APPI (a system that meets the standards prescribed in Article 28, Paragraph 1 of the APPI). In accordance with Paragraph 3 of the same Article, the Company takes the measures necessary to ensure the continued implementation of equivalent measures, such as periodically checking how the service providers handle personal data and the systems of the foreign countries concerned. Upon request, the Company provides information about these measures at the contact point in Article 14 of this Policy.
3. For the personal information protection system of the United States, see the survey results of the Personal Information Protection Commission. The United States has no comprehensive federal personal information protection law; instead, it has state laws (such as the California Consumer Privacy Act) and sector-specific laws. There are also laws concerning government access to information.
4. Ireland is a member state of the European Union (EU), and the EU is designated as a foreign country with a personal information protection system that the Personal Information Protection Commission recognizes as being at a level equivalent to Japan’s in protecting individuals’ rights and interests.

Article 9 (Provision to Third Parties)

1. The Company does not provide personal data to third parties without your consent, except in the following cases:
   1. When required by law
   2. When necessary to protect a person’s life, body, or property and it is difficult to obtain your consent
   3. When especially necessary to improve public health or promote the sound growth of children and it is difficult to obtain your consent
   4. When necessary to cooperate with a national agency, a local government, or a party entrusted by either of them in carrying out duties prescribed by law, and obtaining your consent is likely to impede those duties
   5. In other cases permitted under the APPI
2. The following do not constitute provision to third parties under the preceding paragraph:
   1. When the Company entrusts the handling of personal data as described in Article 7
   2. When personal data is provided in connection with the succession of a business due to a merger, company split, business transfer, or other reason
3. When a user sends information themselves using features of the Service, such as sharing within a Team, saving to Google Drive, or connecting an External Client, the transmission is made by the user’s own operation.

Article 10 (Cookies and External Transmission)

1. The Service uses cookies and similar technologies (such as browser local storage) to keep you signed in and for other features. You can disable cookies in your browser settings, but you may then be unable to sign in to the Service.
2. Emails sent by the Company (including notification emails for the Service and news and marketing emails) contain an image to confirm opens and links to measure clicks. When you open an email and the image is displayed, or click a link in the email, your email client or browser sends the date and time of the open or click, the link clicked, your IP address, browser and device information, and similar data to the email delivery provider (Plus Five Five, Inc. (Resend) for notification emails for the Service, and PostHog, Inc. (PostHog) for news and marketing emails). The Company uses this information to check email delivery, improve the content and delivery of emails, and measure their effectiveness. These records are stored in the US. Opens and clicks are recorded not only for marketing emails but also for notification emails for the Service. You can stop open tracking by turning off automatic image display in your email client.
3. In the Service, pursuant to Article 27-12 of the Telecommunications Business Act, information is sent from the devices of users and Site Visitors to the following external businesses.

For how each business handles information, see its privacy policy.

4. On the service website (www.zarms.cloud), we notify visitors on the site about the measurement of browsing by Google Analytics 4 and PostHog described in the preceding paragraph, and let them choose to decline. If you decline, that device and browser stops sending information for measurement to these businesses, and the cookies and similar data stored by PostHog are deleted. Your choice is saved in your browser on that device (local storage), and you can change it at any time from “Cookie settings” at the bottom of each page. Note that content submitted through the inquiry and material request form is received through PostHog regardless of this choice (Article 3, Item 9, and Article 8, Paragraph 1).

Article 11 (Security Control Measures)

To prevent leakage, loss, or damage of personal data and otherwise to manage personal data securely, the Company takes the following measures.

1. Basic policy and rules: We have established a basic policy and handling rules for personal data.
2. Organizational measures: We have appointed a person responsible for handling personal data and established a reporting and communication structure for incidents such as data leaks.
3. Human measures: We train our employees on handling personal data and set out confidentiality obligations in our work rules and other documents.
4. Physical measures: We take measures to prevent theft or loss of devices that handle personal data.
5. Technical measures: We have implemented per-Team access control (including row-level access control in the database), encryption of communications, encrypted storage of credentials, operation logging, and mechanisms to prevent unauthorized external access.
6. Understanding the external environment: As described in Article 8, we entrust the handling of personal data to service providers located in foreign countries (the United States and Ireland), and take security control measures with an understanding of the personal information protection systems of those countries.

Article 12 (Retention Periods and Deletion)

1. During the contract period: Team Data is retained until the Customer deletes it (for the retention period of audit logs, see Paragraph 4).
2. After cancellation of a paid plan or termination of the contract: If a paid plan is canceled, the Team continues on the free plan and Team Data is not deleted. If the service agreement ends (such as by cancellation under the Terms of Service, but excluding deletion of the Team), the Team enters a canceled state in which only procedures such as export, deletion of the Team, and re-subscription can be performed. In either case, Team Data is retained until the Owner deletes the Team under the next paragraph, and the Company does not delete it automatically (except for audit logs past the period set out in Paragraph 4). Retained Team Data is handled only within the scope of the entrustment in Article 2, Paragraph 2. The Owner can delete Team Data at any time by deleting the Team under the next paragraph. The period during which data can be exported in the canceled state and other conditions are shown on the Service or in Help.
3. Deleting a Team: If the Owner deletes a Team, Team Data (including Member information, comments, and other personal information) is deleted immediately. Deleted information cannot be restored (for information remaining in backups, see Paragraph 8). A Team cannot be deleted during the billing period of a paid plan (including after cancellation, until the last day of the billing period).
4. Audit logs: Audit logs are retained for seven years from the time of recording and then deleted automatically (the most recent 13 months can be viewed on the Service’s screens). If a Team is deleted, its audit logs are retained separately from other data and deleted automatically one year after the deletion of the Team or seven years after recording, whichever comes first. Audit logs retained after the deletion of a Team can be viewed only by the Company’s operations staff and are used only for security, handling disputes, and accountability under laws and contracts.
5. Billing records: Records related to billing and payment (Customer name, billing address, invoices, payment history, customer identifiers at the payment service provider, records of notifications from the payment service provider, who deleted the Team and when, etc.) are retained even after deletion of the Team or termination of the contract, for the statutory retention period (in principle seven years, or longer if required by law), in order to fulfill accounting and tax retention obligations, handle billing inquiries and disputes, and prevent fraud, and are then deleted automatically. Retained records can be viewed only by the Company’s operations staff. Information held by the payment service provider is handled in accordance with its privacy policy.
6. Deleting personal data from ZARMS: Members cannot leave a Team themselves; the Team’s Admin (Owner or Manager) removes Members. If a Member who does not belong to any Team deletes their personal data from ZARMS through the procedure on the Service, account information such as name, email address, profile, sign-in information, and credentials for external integrations is deleted (except for the records in Paragraphs 5, 9, and 11). Comments and other content posted by the user in a Team and records of their operations remain as the Customer’s Team Data, and the poster or operator, and mentions of that user, are shown as “Deleted member.” If such content contains personal information and you wish to have it deleted, requests are accepted by the Customer (the Team’s Admin) or at the contact point in Article 14. In addition, when personal data is deleted from ZARMS, the user’s name, display name, and email address in PostHog are deleted. Usage records in PostHog (history of screen views, interactions, etc.) and session replays remain in a state not linked to the name or email address (linked only to the user ID). Session replays are deleted automatically within 90 days of recording at most. Usage records are retained for up to seven years from recording to improve the Service and then deleted. If you wish to have these records erased, you can request it under Article 13.
7. Google Drive files: Files on Google Drive created or operated on from ZARMS are not deleted by deleting a Team, removing a Member from a Team, or the procedure for deleting personal data from ZARMS. If necessary, the user or Customer should delete them on Google Drive.
8. Backups: Backups are taken daily and retained for seven days. If deleted information remains in a backup, it is erased within about seven days of deletion as backups past the retention period (seven days) are erased in sequence. During that time, it is not used for any purpose other than recovery from failures.
9. Records of consent to marketing emails and of unsubscribing: As an obligation under Article 3, Paragraph 2 of the Act on Regulation of Transmission of Specified Electronic Mail and Article 4 of its Enforcement Regulations, records of consent to receive marketing emails and of unsubscribing are retained for each email address until one month has passed from the last date a marketing email was sent to that address, and are then deleted (if a longer retention period is required by law, they are retained for that period). Even if personal data is deleted from ZARMS, these records are retained until that period has passed, as an exception to the deletion in Paragraph 6. Retained records are used only to confirm consent, comply with the law, and handle disputes.
10. Browsing records on the service website and Help: Session replays on the service website and Help are deleted automatically within 90 days of recording at most. Other browsing and interaction records are retained for the period necessary to improve the sites and then deleted. For people confirmed to be users of the Service, after personal data is deleted from ZARMS, their records are handled in a state not linked to their name or email address, as described in Paragraph 6. For people who are not users of the Service and have not made an inquiry, the Company has not linked their records to a name, email address, or the like, so even if we receive a deletion request, we may be unable to identify the person’s records and respond.
11. Records of consent to the Terms of Service and other documents: If personal data is deleted from ZARMS, the user ID, email address, date and time of consent, and name and version of the document consented to, from the records of consent to the Terms of Service and other documents (Article 3, Item 5), are retained for five years from the date of deletion as an exception to the deletion in Paragraph 6, for handling disputes about whether and to what consent was given and for accountability under laws and contracts, and are then deleted automatically. Browser information recorded at the time of consent is deleted when personal data is deleted from ZARMS. Retained records can be viewed only by the Company’s operations staff and are not used for any other purpose.
12. Inquiry and material request information: Information from inquiries and material requests on the service website is retained for the period necessary to respond to the inquiry, provide information, and analyze how the Service is being evaluated and adopted, and is then deleted. Deletion requests are accepted at the contact point in Article 14 (records of consent to receive marketing emails are retained as described in Paragraph 9).
13. Launch announcement signup (waitlist) information: Email addresses registered on the waitlist are retained for the period necessary to send the launch announcement and later information, and then deleted. If you ask us to stop sending emails, we will not send them afterward. Requests for deletion are accepted at the contact point in Article 14 (the record of consent to receive marketing emails is retained as described in Paragraph 9).

Article 13 (Requests for Disclosure, etc.)

1. You may request, with respect to retained personal data held by the Company, notification of the purposes of use, disclosure (including disclosure of records of provision to third parties), correction, addition, or deletion, suspension of use or erasure, and suspension of provision to third parties. Requests are accepted at the contact point in Article 14. Because session replay and interaction records are automatically attached to inquiries made through the inquiry channel within the Service, if you do not want them attached, please make your request to the email address in Article 14. Identity verification, the method of disclosure, and fees are governed by the Company’s Privacy Policy.
2. For personal information contained in Team Data, the Company handles it under an entrustment from the Customer, so please first make your request to the Customer (the Team’s Admin). If a request is made to the Company, we will respond in cooperation with the Customer.
3. Requests for suspension of use or erasure of personal data held by the Company, such as sign-in information, usage analytics records, and marketing email delivery records, are accepted by email (support@zarms.cloud) even while you belong to a Team, and the Company handles them individually (erasure of usage records in PostHog and the like cannot be performed through operations on the Service) (excluding records retained under laws or this Policy, such as the records in Article 12, Paragraphs 5, 9, and 11). While you belong to a Team, the procedure for deleting personal data from ZARMS cannot be used, so if you wish to leave a Team, please ask an Admin. If you cannot contact an Admin, please contact the same email address.

Article 14 (Company Information and Contact)

• Company: Xgene Inc.
• Representative: Teppei Kawabe, Representative Director
• Address: N&E BLD. 6F, 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan (we do not accept visitors at this address)
• Inquiries: Inquiries about the Service are accepted at the following contact points. They are also described on the Help contact page (https://help.zarms.cloud/en/contact).
  • Signed-in Members: the inquiry channel within the Service (session replay and interaction records are automatically attached to inquiries; Article 3, Item 10)
  • People who cannot sign in to the Service: email (support@zarms.cloud)
  • People considering adopting the Service: the inquiry form on the service website (https://www.zarms.cloud/en/contact) or email (contact@zarms.cloud)
• Inquiries and complaints about the handling of personal information, and requests for disclosure, etc.: in addition to the contact points above, by email (support@zarms.cloud) or at the contact point set out in the Company’s Privacy Policy. If you do not want session replay or other records attached, please contact us by email.

Article 15 (Changes to This Policy)

1. The Company may change this Policy as necessary due to amendments to laws, changes to the Service, or other reasons.
2. When making a change, the Company will publish the changed content and its effective date on the Service or the Company’s website by the effective date. For changes that legally require your consent (including expanding the scope of use of Google user data), the Company will obtain consent by the method it prescribes.