Privacy Policy

This Privacy Policy (the “Policy”) sets forth the Company’s handling policy for personal information and other data of Individual Users and Corporate Users in connection with the AI avatar-integrated SaaS platform provided by the Company (the “Service”).

The Service is intended only for Individual Users who are at least 18 years old, or businesses that can enter into contracts as corporate entities. If used by an individual, persons under the age of 18 may not use the Service. For corporate use, it is assumed that the person in charge of the contract is an adult.

For the purposes of operating the Service, managing contracts, and ensuring safety, the Company collects the following information.

• ・For Individual Users: name, email address, date of birth, payment information, usage history, etc.
• ・For Corporate Users: company name, department name, name of the person in charge, email address and phone number of the person in charge, payment information
• ・Credit card payment history through payment processors such as Stripe
• ・Access logs, cookies, browser information, device information
• ・Conversation content with AI avatars and LLMs (for the purposes of service quality improvement and safety audits)
• ・Records of inquiries and support communications

Acquisition of Information via OAuth Authentication

The Company provides login via SNS accounts (OAuth authentication) using Supabase. In such cases, the Company obtains information within the scope necessary for authentication (e.g., name, email address, profile image, etc.) from the SNS provider selected by the User (e.g., Google, GitHub, Apple, X (formerly Twitter), etc.).

Such information will be used only for login authentication and identity verification, and will be provided in accordance with the terms of use and privacy policy of the SNS provider.

Due to the nature of the Service, including AI conversations, the Company prohibits use by persons under the age of 18.

For Individual Users, the Company verifies age by the following methods.

1. Explicit consent at sign-up confirming that the User is at least 18 years old
2. Verification via credit card payment (a credit card held by an adult)

For corporate use, it is assumed that the person in charge of the contract is an adult. If use or false declarations by minors are discovered, the Company will immediately suspend the account and delete data.

The Company uses collected information for the following purposes.

1. Providing, operating, and improving the Service
2. Contract management, billing and payment processing, and payment of usage fees
3. Preventing fraud and impersonation, and maintaining security
4. Age verification and proper enforcement of usage restrictions
5. Improving the response quality and safety of LLMs and AI avatars (including detection of inappropriate statements)
6. Contacting persons in charge and providing operational support for corporate contracts
7. Legal compliance and dispute response
8. Login processing and identity verification via SNS authentication (via OAuth, including Google, GitHub, Apple, X, etc.)

The Company manages data primarily in a server environment located in Japan (Tokyo region). However, due to the nature of cloud services, some backup data and log data may pass through servers located outside Japan.

• ・Supabase: operates in the Tokyo region. Main data is stored in Japan. Some backup and authentication processing may be performed overseas.
• ・Vercel: distributed using an Edge Network. Content and cookies may be temporarily stored on servers outside Japan.

Data of Users residing in the EU or EEA will be appropriately protected as Japan is recognized as an “adequacy decision” country under Japan’s Act on the Protection of Personal Information.

If data is transferred to countries outside Japan (e.g., the United States or Singapore), the Company will implement appropriate safeguards such as Standard Contractual Clauses (SCC) under Article 46 of the GDPR.

The Service provides interactive functions integrating AI models (LLMs) and VRM avatars. User input may be temporarily stored and analyzed for the following purposes.

• ・Improving response quality and preventing false positives
• ・Detecting high-risk statements such as self-harm, violence, or sexual expressions
• ・Internal audits of usage status and confirmation of safe operation

Such data will not be used for retraining AI models by third parties. Data will be retained only for the minimum necessary period and will be deleted or anonymized promptly after the purpose is achieved.

The Company may provide data to third parties within the minimum necessary scope for the following purposes.

These providers will manage personal information appropriately based on contracts with the Company.

The Company uses cookies to maintain login status, analyze access, and improve security. Users may refuse the storage of cookies through browser settings; however, in that case, some functions may not operate properly.

Even after a User deletes their account, the Company may retain data for a certain period within the scope required by laws. After the retention period ends, the Company will delete or anonymize the data in a secure manner.

Users residing in the EU/EEA have the following rights.

• ・Right of access to data
• ・Right to request correction or deletion
• ・Right to request restriction of processing or to object
• ・Right to request data portability

Such requests will be accepted at the contact point described below.

The Company implements the following measures to protect user data.

• ・SSL/TLS encryption of communication channels
• ・Access control and retention of authentication logs
• ・Periodic vulnerability assessments and security updates
• ・AI monitoring through detection of inappropriate statements
• ・Education of relevant personnel regarding personal information protection

The Service prohibits use by individuals under the age of 18. If registration or use by a minor is discovered, the Company will suspend the account and delete data.

For corporate use, it is assumed that the person in charge of the contract is an adult, and if operations by a minor person in charge are discovered, the same measures may be taken.

The Company may revise this Policy in response to changes in laws or changes to the Service. Revisions shall take effect at the time the revised content is posted on the Company’s website.

The interpretation and application of this Policy shall be governed by the laws of Japan. If any dispute arises in connection with the Service, the Osaka District Court shall have exclusive jurisdiction as the court of first instance.

• ・Company name: Sun-O-Ring Co., Ltd.
• ・Address: 2-1-1 Edobori, Nishi-ku, Osaka-shi, Osaka 550-0002, Japan
• ・Email: info@realplug.app
• ・Department or person in charge (Personal Information Protection Manager): Ichiro Takenaka (Representative Director)

• ・Supabase Privacy Policy
• ・Vercel Privacy Policy
• ・Stripe Privacy Center
• ・Google OAuth Privacy
• ・GitHub Privacy Statement