Privacy Policy

Last updated: October 20, 2026 · Effective: October 14, 2026 (the Section 3 revision takes effect on October 20, 2026; the revisions to Sections 1, 5, 6 and 7 take effect on November 19, 2026)

OFFICE KAMIYA Inc. respects your privacy. This Privacy Policy explains how we collect, use, and handle information in the web application "AWAI."

1. Information We Collect

1-1. Account Information

You can sign in to the Service using either an email address and password, or a Google / Microsoft account via social login. Depending on the sign-in method, we obtain the following information:

  • Email address
  • Display name
  • Firebase UID (authentication identifier)

In addition, so that a registration benefit is not granted to the same person twice, we generate and retain the following values for a limited period (see "7. Data Retention and Deletion" and "7-2. Information retained after account deletion"):

  • When you receive a registration benefit by signing up with or linking a Google / Microsoft account on or after November 19, 2026 (JST), hashed values of the identifiers of those Google / Microsoft accounts
  • When you delete your account, a hashed value of your email address and related records

1-2. User-Provided Data

  • Conversation text (AI conversations, meeting transcripts, etc.)
  • Conversation titles
  • The display name you enter when joining a meeting
  • Meeting audio and camera video (we do not store them as files — see "2-2" and "2-3")
  • Audio of voice answers in group analysis (we do not store it as a file — see "2-2" and "2-3")

Conversation text, titles, and the display name you enter when joining a meeting are processed as necessary for providing the Service and stored on our servers.

1-3. Automatically Collected Information

  • Usage data (point usage, analysis count) — for quota management
  • IP address — temporarily recorded for security purposes (where it forms part of a consent record, it is retained for the period set out in "7-2"), and used to estimate your approximate country to determine the currency of prices
  • Browser identification (User-Agent) — for recording consent to these Terms and Policies (see "7-2")
  • Browsing information (pages viewed, referrer, device and browser type and state (such as screen size, language, and battery level), approximate location), identifiers such as cookies, and in-service interaction events with their accompanying details (the screen and kind of interaction, conversation and analysis identifiers, error codes, the amount and quantity in a purchase flow, and the like) — for analytics, advertising features, and measuring ad results (see "5-1" and "5-2")

2. Data Processing

2-1. Text processing

Entered text is sent to and processed by Google's generative AI (Gemini) for the following purposes:

  • Thought structure extraction, classification, and summarization
  • Text vectorization (Embedding)
  • Cluster analysis and report generation

All of the above processing involves sending text data to Google's generative AI (Gemini).

2-2. Audio and video

In the meeting feature, participants' audio and camera video are sent and received through LiveKit Cloud (LiveKit, Inc.), the real-time communication platform (see "5" for details).

Audio is sent to Google's generative AI (Gemini) for transcription and simultaneous interpretation. When interpretation is enabled, the generated interpretation audio is delivered to the other participants through LiveKit Cloud.

In group analysis, when the host enables voice answers, a respondent can choose to answer by talking with an AI avatar instead of typing. In that case we use the device's microphone with the browser's permission and send the audio through our servers to Google's generative AI (Gemini). The AI-generated audio and video reach the respondent's device through our servers. The avatar and its voice are generated by AI.

We do not store audio or video as files. Audio is processed in real time; what is stored on our servers is the resulting transcript and its analysis. No recording is created, so it cannot be played back later.

We do not configure any reproduction of the speaker's own voice — interpretation audio and the avatar's voice use the provider's standard synthetic voice. Speakers in meetings are distinguished by a participant ID that we issue and pass to the communication platform; we do not extract voiceprints or other biometric features from audio.

Transcription, interpretation and the avatar's responses are generated automatically and we do not guarantee their accuracy.

2-3. How Google handles this data

We use Gemini Enterprise Agent Platform on Google Cloud to process text and audio and to generate images, audio and video. Data we send is not used to train or fine-tune Google's AI models.

However, to detect usage policy violations, Google may retain inputs for up to 90 days when suspicious use is automatically detected. In meetings with interpretation languages set, audio and text are temporarily stored on Google's side for up to 24 hours so that transcription and translation can resume after a dropped connection. In addition, inputs and outputs may be held in memory on Google's side for up to 24 hours to speed up responses.

For details, please review the Google Cloud Service Specific Terms.

3. Sharing and Public Exposure of Diagnosis Results

Part of an AI Type Diagnosis or AI Compatibility Diagnosis result becomes viewable by third parties in the cases below. Each of them stops when you turn off "Sharing settings" on the result page.

3-1. Share URLs

  • AI Type Diagnosis: A share URL is generated automatically when the user opens the result page.
  • AI Compatibility Diagnosis: When a compatibility result is produced, share URLs are generated automatically for the compatibility result page and for the host's and the guest's AI Type Diagnosis result pages. The sharing setting of the compatibility result page is controlled by the host, and the sharing setting of each AI Type Diagnosis result page by its owner (for a guest-mode diagnosis, by the host).

Any third party who knows a share URL can view that result page. Sharing settings are on by default. When turned off, the page can no longer be viewed through its share URL within about an hour at most.

Information that is public via the share URL:

  • Diagnosis result card (job name, polarized axes, signature moment, character image, thinking story, kindred minds, fitting roles, etc.)
  • Thought node structure (coordinates in 3D space, classifications, relational edges)
  • OGP image (preview image for social media sharing)

Information that is not included in the share URL:

  • The original conversation text (your input)
  • Summary text of each node
  • Vector representations (Embeddings)
  • Account information (email, display name, etc.)

3-2. Showcasing within the Service

  • Recent diagnoses: We may show the title, signature moment and character image of an AI Type Diagnosis result on the screens of other users signed in to the Service.
  • Compatibility examples: On pages of the Service, whether or not the visitor is signed in, we may show the combined character image of the two people in an AI Compatibility Diagnosis and each person's character image. No text is shown. This is limited to pairs where the sharing settings of the compatibility result page, the host's AI Type Diagnosis result page and the guest's AI Type Diagnosis result page are all on.

Showcasing within the Service never shows account information or share URLs.

If the corresponding conversation is deleted, the share URL is invalidated at the same time and the result is no longer showcased within the Service. However, when the guest of an AI Compatibility Diagnosis deletes the conversation, the compatibility result and the guest's AI Type Diagnosis result remain as the host's record (when the host deletes the conversation, both people's data are deleted). On and after November 19, 2026 (JST), the sharing setting of the guest's AI Type Diagnosis is then turned off, and information derived from the guest's diagnosis no longer appears through share URLs or showcasing within the Service (before that date, it is only hidden from the guest's screens and the sharing setting does not change). Preview images (OGP images) of share URLs posted to social media or similar services are held by those services, and we cannot delete them.

4. Payment Processor

Order processing for paid plans is handled by Stripe, Inc. We do not have access to full credit card numbers. We only receive necessary transaction information (name, email, order ID, country). For details on how Stripe handles your payment information, please refer to Stripe's Privacy Policy.

5. External Services We Use and Where Data Goes

We use the following external services to operate the Service:

  • Google Cloud Japan G.K. (Japan) — Processing of text and audio and generation of images, audio and video (Gemini Enterprise Agent Platform). Sent: conversation text, meeting audio and the display names entered when joining a meeting, audio of voice answers in group analysis, and the instructions and images used to generate character images. Processing may take place on servers outside Japan, such as in the United States
  • LiveKit, Inc. (United States) — Real-time communication for meetings. Sent or relayed: IP address, device, browser, and network type, the display names entered when joining a meeting, audio (including AI-generated interpretation audio), camera video, and subtitle text. We do not use any recording feature
  • Google Cloud Japan G.K. (Japan) — Account authentication (Firebase Authentication). Email address, display name, authentication identifier. Processing may take place on servers outside Japan, such as in the United States
  • Google Cloud (Japan region) — Servers and database
  • Cloudflare, Inc. (United States) — Website delivery, relaying communications with our servers, and abuse prevention. Sent or relayed: IP address, browser information, and the content of communications routed through Cloudflare, including conversation text, audio of voice answers in group analysis, and the AI-generated avatar's audio and video
  • Resend (United States) — Sending notification emails. Email address
  • Google LLC (United States) — Analytics and advertising features (Google Tag Manager / Google Analytics / Google Ads). Sent: browsing information, identifiers such as cookies, interaction events with their accompanying details (see "5-1")
  • X Corp. (United States) and X Asia Pacific Internet Pte. Ltd. (Singapore) — Measuring the results of ads on X (formerly Twitter). Sent: browsing information, identifiers such as cookies, and the like (see "5-2")

For payments, see "4. Payment Processor."

Transfers to providers located outside Japan are made under appropriate safeguards, including standard contractual clauses. You may request a copy of those safeguards, and information about the destination country, its data protection framework, and the measures taken by the recipient, from the contact in "10. Contact."

Other than transfers made in connection with entrusted processing, we do not provide personal data to third parties without your consent. What is sent to Google for analytics and advertising features is as set out in "5-1", and what is sent to X for measuring ad results is as set out in "5-2"; neither involves providing Google or X with the personal data we hold (account information or conversation text).

5-1. Analytics and Advertising Features

We use Google Analytics through Google Tag Manager to measure how pages on the Service are viewed. Measurement uses first-party cookies set by Google Analytics (such as _ga).

We also use the following two Google Analytics Advertising Features:

  • Google signals — For users who are signed in to a Google account and have turned on Google's "Ads Personalization," their use of the Service is associated with information Google holds about them. As a result, usage across multiple devices and browsers, together with estimated age, gender, and interests, is reflected in our analytics reports.
  • Remarketing — We may serve ads on Google's advertising network to people who have visited the Service.

In these features, the first-party cookies (or equivalent identifiers) described above may be used together with third-party cookies (or equivalent identifiers) that Google holds for advertising. The associated information may be used by Google for cross-device analysis and for ads personalization.

What is sent to Google through these features is browsing information, identifiers such as cookies, and in-service interaction events with their accompanying details (the screen and kind of interaction, conversation and analysis identifiers, error codes, the amount and quantity in a purchase flow, and the like); we do not include information that directly identifies you, such as your name or email address. What we see are aggregated reports; we do not receive information from Google that identifies individual users. We do not use or provide the conversation text you enter, or its analysis results, for advertising.

Regions and consent — On and after November 19, 2026 (JST), advertising features are enabled for access from all regions. However, for access from the European Economic Area (EEA), the United Kingdom, or Switzerland, we store identifiers such as cookies, associate data using those identifiers, personalize ads, and use remarketing only if you consent. On your first visit from these regions we ask for your consent, and you can use the Service even if you do not consent. You can change or withdraw your choice at any time from "Cookie settings" at the bottom of the page. If you do not consent, Google tags do not run and send no information to Google. (Before that date, advertising features are not enabled for access from the EEA, the United Kingdom, or Switzerland, and we do not associate data using cookies or similar identifiers, personalize ads, or carry out remarketing there. The Google tag does, however, send browsing information (including the URL of the page you are viewing) to Google.)

Your choice is stored in your browser. In addition, as a record of the consent request, we record on our servers the date and time of the choice, the country, the choice made, and an identifier generated for each browser, and retain it for 5 years. This record does not include information that directly identifies you, such as account information.

How to opt out — The following are available. What each one stops differs:

For how Google handles this data, see How Google uses information from sites or apps that use our services.

5-2. Measuring the Results of Ads on X

To measure the results of the ads we run on X (formerly Twitter), we use X's website tag (the X Pixel) through Google Tag Manager. The X Pixel measures whether people who came to the Service from an ad on X went on to take actions such as signing up, and uses first-party cookies set by the X Pixel (such as _twclid) together with cookies (or similar identifiers) held by X.

What is sent to X is browsing information (including the URL of the page you are viewing), device information (such as screen size, language, time zone, and battery level), identifiers such as cookies, a value identifying a click on an X ad, and the kind of interaction event (such as completing sign-up or submitting the contact form). We do not include information that directly identifies you, such as your name or email address. X may use the information sent to it to measure ad results, to show ads on X to people who have visited the Service, to optimize the targeting and delivery of ads on X, and to improve X's products.

Regions — The X Pixel does not run for access from the European Economic Area (EEA), the United Kingdom, or Switzerland.

How to opt out — The following are available:

For how X handles this data, see X's Privacy Policy.

6. Legal Basis for Processing (GDPR/CCPA Compliant)

We process minimal personal data based on "necessity for contract performance" and "legitimate interests." Purposes:

  • Providing the Service and account management
  • Technical support
  • Service improvement
  • Advertising measurement and delivery (for access from the EEA, the United Kingdom, and Switzerland, Google's advertising features only with consent, and no X ad measurement; see "5-1" and "5-2")
  • Tax and accounting obligations

7. Data Retention and Deletion

Retention periods by data category:

  • Meeting audio and camera video, audio of voice answers in group analysis, and AI-generated audio and video: We do not store them (processed in real time; no files are created. For temporary retention on Google's side, see "2-3")
  • Transcripts and analysis results: While your account is active
  • Account information: While your account is active (for handling after deletion, see "7-2")
  • Hashed identifiers of the Google / Microsoft accounts used for a registration benefit: While your account is active, and for 1 year after deletion (see "7-2")
  • Records of cookie consent requests: 5 years (see "5-1")
  • Server logs: 30 days (certain administrative activity records: 400 days)
  • Browsing information collected by analytics and ad measurement: Per the Google Analytics data-retention setting, or as determined by X (not stored on our servers; see "5-1" and "5-2")
  • Payment information: Held by Stripe, Inc. (we never hold card numbers)
  • Information retained after account deletion: As set out in "7-2" (1 year for the re-registration check; for deletions before November 19, 2026 (JST), the point-balance restore record for the period set out in "7-2"; 5 years for consent records)

We do not operate any automatic deletion after a fixed period. You can delete conversations, analysis results, and your account at any time from Settings (except transaction records required by tax law).

When you delete data, it is removed from our database immediately (except as set out in "7-2. Information retained after account deletion"). It remains for a limited period in backups kept for disaster recovery, but we do not use those backups for any purpose other than recovery.

7-1. Meeting records

What you say during a meeting is stored as part of that meeting's record. That record is stored under the host's account.

If a participant other than the host deletes their account, the link between their account and their remarks is removed, but the remarks themselves remain as part of the record, so that it does not become incomplete for the other participants (the display name shown during the meeting remains in the record).

If the host deletes their account, the entire record of that meeting is deleted, including the remarks of the other participants.

A meeting's record can be deleted by the meeting's host. If you would like your own remarks deleted, please contact the host of that meeting, or our support desk. We handle such requests individually.

7-2. Information retained after account deletion

Even after you delete your account, the following information is not deleted and is retained for the periods stated below.

To prevent a registration benefit from being granted twice, we retain the account identifier (Firebase UID), a hashed value of the email address, where you received a registration benefit by signing up with or linking a Google / Microsoft account, hashed values of the identifiers of those Google / Microsoft accounts, and the deletion date for 1 year from deletion. The hashed values are used solely to check whether a registrant is the same person; we do not retain the original email address or the identifiers of those accounts themselves. We delete these records once the year has passed, after which a new registration becomes eligible for the registration benefit again.

To restore your point balance, and only where you deleted your account before November 19, 2026 (JST) while a paid plan period was still running, we retain the balance of points granted by the subscription as of the deletion until November 19, 2026 (JST). It is used to restore that balance if you sign in again with the same account during the paid-plan period that remained at the time of deletion and before that date. We delete all of these records on that date.

To record your consent to these Terms and Policies, we retain the user identifier, the version number and version hash of what you consented to, the date and time of consent, the IP address, and the browser identification (User-Agent) for 5 years. It is used to establish the facts if consent is later disputed.

We do not use these records for any purpose other than those above. If you request deletion, there are cases where we cannot comply, in light of the purposes and retention periods above; in that case, please raise it with the contact in "10. Contact" and we will handle it individually.

We implement industry-standard security measures.

8. Handling of Minors' Data

  • The Service is not designed to receive direct data submissions from children under the age of 13.
  • When a minor aged 13 to 17 uses the "Guest Mode" feature under direct parental supervision, any conversation text and diagnosis results entered are stored under the supervising parent's (host's) account.
  • Control and the right to delete such data reside with the parent. We do not accept disclosure or deletion requests directly from minors; such requests must be made through the parent.
  • Parents may delete conversations and diagnosis results generated in Guest Mode at any time, in the same manner as their own data.

9. Your Rights

Depending on your jurisdiction, you have the following rights:

  • Access and Data Portability: Download your transcripts and analysis results (thought nodes) in JSON format via the "Export Data" function in Settings. Because a meeting's record is stored under the host's account, meetings you joined as a participant are not included in your own export. If you need that content, please contact the host of the meeting or our support desk
  • Rectification: You can request correction of inaccurate information
  • Erasure (Right to be Forgotten): You can delete your data via "Delete Account" in Settings. See "7. Data Retention and Deletion" for what deletion covers

10. Contact

OFFICE KAMIYA Inc.
#403 27-1, Matoba, Shimizu-cho, Sunto-gun, Shizuoka-ken, JAPAN 411-0907
Email: [email protected]

Regarding transfers to providers located outside Japan, you may request a copy of the safeguards in place, as well as information on the name of the destination country, the data protection framework of that country, and the measures taken by the recipient, from the contact above.