Privacy Policy

We recognize that protecting personal information is extremely important, and we consider handling and protecting our members' personal information appropriately to be a social responsibility.

We comply with the Act on the Protection of Personal Information of Japan (the "APPI") and other relevant laws and norms, and strive to keep personal information secure.

This Policy explains how this website and the Service collect, use and protect personal information. In this Policy, a "member" means a user who has logged in to the Service's app.

This Policy applies to the Service we provide, including the creator app "Tonakai" and this website.

This Policy applies to members who use the Service in Japan.

We collect the following information in the Service by lawful and fair means.

We do not collect location information, contacts (address book), date of birth or My Number (Japan's individual number) in the Service.

We use the personal information we collect for the following purposes.

• Registration, login, identity verification and account management
• Confirming that a connected social account is the account a campaign was offered to
• Selecting campaigns that suit you, and proposing you to advertisers
• Running campaigns (offer notices, reviewing and giving feedback on submissions, checking posts, contact with our staff)
• Calculating and paying fees, issuing invoices, withholding tax and other tax and accounting work, and sending copies of invoices and payment records
• Notifying you of deadlines and news, including by push notification
• Responding to inquiries
• Detecting and investigating errors, and improving the Service
• Measuring advertising and marketing, and analyzing install sources (attribution)
• Preventing misuse and dealing with violations of the Terms of Service
• Complying with laws
• Other work reasonably related to the purposes above

If we need to change these purposes, we will do so within a reasonable scope and notify you on this website or in the Service.

When you use our app and website, the following information is sent from your device to the following companies through the modules below.

Information sent is handled under each company's privacy policy:

• Sentry: https://sentry.io/privacy/
• AppsFlyer: https://www.appsflyer.com/legal/services-privacy-policy/
• Firebase Authentication: https://firebase.google.com/support/privacy
• Expo: https://expo.dev/privacy
• Google Analytics: https://policies.google.com/technologies/partner-sites

With iOS App Tracking Transparency (ATT), tracking with the IDFA happens only if you agree in your device's permission dialog. You can keep using the Service if you do not. You can change this at any time in Settings → Privacy & Security → Tracking. On Android 12 or later, you can delete your advertising ID at any time in Settings → Privacy → Ads (on some devices, Settings → Google → Ads); once it is deleted, the advertising ID is not collected. On Android 11 or earlier, you can opt out of ads personalization on the same screen, in which case the advertising ID is not used for personalized ads.

You can stop data being sent to Google Analytics by disabling cookies in your browser or by using Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout).

We do not provide personal information to third parties without your prior consent, except:

• When required by law
• When necessary to protect a person's life, body or property and it is difficult to obtain consent
• When especially necessary to improve public health or promote the healthy upbringing of children and it is difficult to obtain consent
• When cooperating with a national or local government body carrying out duties prescribed by law
• When personal information is succeeded to in a merger, company split, business transfer, etc.
• When entrusting it to contractors to the extent needed for the purposes of use (see Article 7)

Because of the nature of the Service, we may also provide the following information to advertisers (including advertising agencies acting for them) to the extent needed to propose and run campaigns. By using the Service, you agree to this.

• Social account information (account name, follower count, public post performance, follower demographics, etc.)
• Statistics of videos published for a campaign (views, likes, comments, etc.; for YouTube, as set out in Article 15)
• Scripts, draft videos and other campaign submissions, and post URLs
• Campaign progress

We never provide your bank account or other payment information to advertisers. We require recipients to manage personal information appropriately and use it only for the campaign.

We entrust all or part of the handling of personal information to the following companies, to the extent needed for the purposes of use.

When we entrust the handling of personal information, we choose contractors with adequate security measures, set confidentiality and security obligations by contract, and supervise them appropriately. Contractors do not use personal information for anything other than the contracted purpose or provide it to third parties.

Information on the personal information protection systems of the foreign countries concerned is available on the website of Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku).

When we run a business jointly with group companies or partners, we may use personal information jointly within the following scope.

• Items used jointly: name, contact details, contents of consultations, etc.
• Purpose of joint use: providing joint services, running activities, marketing, etc.
• Joint users: our group and partners (names to be announced separately)
• Responsible party: our personal information manager (contact in Article 18)

We strive to keep your personal information accurate and up to date, and take the following measures to prevent leaks, loss, damage, alteration and unauthorized access.

• Managing and logging access rights
• Limiting who can view or change bank account information to staff who need it for payments, and logging those views and changes
• Encrypting communications and data
• Technical security such as firewalls
• Physical security of the servers
• Staff training and internal audits
• Understanding the systems of foreign countries where companies handle personal information for us

We keep personal information for as long as needed for the purposes of use. When you delete your account:

• Login information, connected social account information (including access tokens), payment information, bank account and push tokens are deleted when the account is deleted.
• Campaign records (offers and responses, fee negotiations, submissions, messages, notification history, posting fees you set) and invoices (including the name or company name, address, invoice registration number and bank account copied onto them) are kept as transaction records for the period required by tax and other laws, then deleted.
• Public social media information and records of past transactions are held by us separately from the app account, and may be kept after the account is deleted. To have them deleted or their use stopped, contact us at the address in Article 18.

This website may use cookies and similar technologies to improve the user experience and analyze access.

• Cookies alone do not identify you, but where they can identify you when combined with other information, we handle them as personal information.
• You can refuse cookies in your browser settings, though some features may then be limited.

You can view and correct your payment information and bank account at any time under "My page" in the app. You can also make the following requests about personal information we hold, and we will respond appropriately under the law.

• Notice of the purposes of use, and disclosure of personal information we hold
• Correction, addition or deletion
• Stopping use, erasure, or stopping provision to third parties
• Withdrawal of consent (where applicable)

Send requests by email to the contact in Article 18. To confirm that you are the person concerned or a legitimate agent, we may ask how you log in (LINE, phone number, Apple) or which social accounts you have connected, and may ask for identity documents. If we cannot meet a request, we will explain why.

You can delete your account at any time from "Delete account" under "My page" in the app. What is deleted and what is kept is set out in Article 10. See also Account and data deletion (Japanese).

Minors must have a parent or guardian's consent to provide personal information. If we find information for which consent cannot be confirmed, we will promptly delete it or stop using it.

LINE (LY Corporation): When you log in with LINE, with your consent we receive your LINE user ID and display name and check whether you have added our LINE Official Account as a friend. We do not receive your email address.

Apple (Apple Inc.): When you sign in with Apple, we receive your Apple user ID and the name you share on first sign-in. We do not ask you to share your email address. When you delete your account, we revoke the sign-in authorization with Apple.

Instagram (Meta Platforms, Inc.): The Service uses the Instagram API. When you connect an Instagram professional account, with your consent we receive the account ID, username, account type and follower count. The permission also covers viewing account insights (instagram_business_manage_insights), to check posts and their performance. We store the access token issued on connection, but do not currently use it to fetch insights. You can disconnect in the Instagram app under Settings → Apps and websites; we then delete the connection information for that account.

• Instagram Data Policy: https://www.facebook.com/help/instagram/155833707900388
• Instagram Terms of Use: https://www.facebook.com/help/instagram/581066165581870/

TikTok: The Service uses TikTok Login Kit. When you connect a TikTok account, with your consent we receive the account identifier, username and follower count. The permission also covers viewing your public video list (video.list), to check posts and their performance. We store the access token issued on connection, but do not currently use it to fetch video information. We never post on your behalf. You can disconnect in the TikTok app under Settings and privacy → Security and permissions → Manage app permissions.

• TikTok Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en
• TikTok Terms of Service: https://www.tiktok.com/legal/page/row/terms-of-service/en

YouTube (Google LLC): The Service uses YouTube API Services. When you connect your YouTube channel, with your permission on Google's authorization screen (youtube.readonly), we access:

• your channel ID, channel name and subscriber count;
• your list of videos, including unlisted ones; and
• the view, like and comment counts of your videos.

We use this to confirm that you own the channel a campaign was offered to, and to report the performance of the videos you publish for Tonakai campaigns. Statistics of a campaign video are shared with the advertiser that commissioned it (including an advertising agency acting for it), and not with anyone else.

We store your Google authorization token securely and use it only to refresh this data. We do not sell data obtained from YouTube, use it for advertising, or use it to train AI models. When you disconnect YouTube in the app, we delete the token, revoke the authorization with Google, and delete the data obtained through your authorization (except campaign records we keep as transaction records under Article 10). You can also revoke access at any time in your Google Account under "Third-party apps & services" (https://security.google.com/settings/security/permissions).

Tonakai's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Google Privacy Policy: http://www.google.com/policies/privacy
• YouTube Terms of Service: https://www.youtube.com/t/terms

X (X Corp.): The Service uses the X API. When you connect an X account, with your consent on X's authorization screen, we retrieve your user ID, username and follower count once each time you connect, to confirm that you own the account a campaign was offered to. X requires the permission to read posts (tweet.read) for this, so it appears on the authorization screen, but we do not use it to retrieve your posts. Immediately after retrieving this information we ask X to revoke the access token, and we do not store it, so we have no further access to your X account after you connect, and we never post on your behalf. When you disconnect X in the app, we delete the connection information for that account. Your public profile, posts and per-post view and like counts are collected through data providers, as set out in Article 3.

• X Privacy Policy: https://x.com/en/privacy
• X Terms of Service: https://x.com/en/tos

When you delete your account, we delete the information of your connected social accounts and revoke the access permissions with each platform.

As a rule, we do not collect sensitive personal information such as religion or medical and health information through the Service. Where it is needed for our work, we will state the purpose in advance and obtain explicit consent before collecting it.

We comply with the relevant laws of Japan and other applicable norms, and review this Policy regularly to keep it in line with the latest laws and our business.

For questions, consultations and the requests in Article 12 about our handling of personal information, contact:

We may revise this Policy as laws or our business change. We will post a notice on this website for significant changes. The revised Policy takes effect on the date it is published.