Privacy Policy

Exapolicy LLC ("we", "our", or "us") recognizes the protection of the personal information we handle as an important responsibility. We comply with the Act on the Protection of Personal Information of Japan (the "APPI") and other applicable laws and regulations, and handle personal information appropriately in accordance with this Privacy Policy (this "Policy").

1. Basic Principles

We handle personal information in accordance with the following principles:

1. Minimum necessary collection: We obtain personal information only to the extent necessary for our business and by appropriate means. We do not obtain personal information that is not needed.
2. Clear purpose of use: When obtaining personal information, we specify or publish its purpose of use in advance. We do not use it beyond that purpose.
3. Restriction on provision to third parties: We do not provide personal information to third parties except with the prior consent of the individual or as permitted by law.
4. Security control measures: We take necessary and appropriate measures to prevent the leakage, loss, or damage of personal information.
5. Privacy by design: In designing our products and services, we take data minimization as a basic principle and aim for designs that do not obtain or retain data that is not needed.

2. Business Operator Information

Business name	Exapolicy LLC (エクサポリシー合同会社)
Address	BIG Office Plaza Ikebukuro 1206, 2-62-8 Higashi-Ikebukuro, Toshima-ku, Tokyo 170-0013, Japan
Contact for personal information	cov-support@exapolicy.co.jp (see Section 13)
Contact	cov-support@exapolicy.co.jp

3. Personal Information We Obtain

We may obtain personal information in the following situations:

1. Inquiries and support: name, company or affiliation (optional), email address, the content of the inquiry or support request, and other information necessary to respond.
2. Provision of products and services: information necessary to provide products and services and to manage licenses and subscriptions.
3. Use of our website: access logs (IP address, browser type, date and time of access, etc.) and information obtained through cookies and similar technologies (see Section 8).

We obtain this information by appropriate means and limit it to the minimum necessary.

4. Purposes of Use

We use the personal information we obtain within the scope of the following purposes:

1. Responding to inquiries and support requests
2. Providing, operating, maintaining, and improving our products and services
3. Managing licenses and subscriptions
4. Notifying you of product updates and important notices
5. Providing information about our products and services (unless you opt out)
6. Responding to conduct that violates our terms of use or agreements
7. Complying with applicable laws and regulations

We do not handle personal information beyond the scope necessary to achieve these purposes. If we change a purpose of use, we do so only within a scope reasonably related to the original purpose, and we notify the individual or publish the change.

5. Provision to Third Parties

We do not provide personal information to third parties without the prior consent of the individual, except in the following cases:

1. Where required by law
2. Where necessary to protect a person's life, body, or property and it is difficult to obtain the individual's consent
3. Where particularly necessary to improve public health or to promote the sound development of children and it is difficult to obtain the individual's consent
4. Where it is necessary to cooperate with a national government agency, a local government, or a party entrusted by either in carrying out duties prescribed by law, and obtaining the individual's consent is likely to impede the performance of those duties

6. Outsourcing

We may outsource all or part of the handling of personal information to external parties to the extent necessary to achieve the purposes of use (for example, website hosting, email delivery, and access analytics). In such cases, we exercise necessary and appropriate supervision over the contractor.

7. Security Control Measures

To prevent the leakage, loss, or damage of personal information and to otherwise manage it securely, we take necessary and appropriate measures, including the following:

• Organizational measures: appointing a person responsible for the handling of personal information and reviewing the status of handling
• Personnel measures: necessary management of persons who handle personal information
• Physical measures: appropriate management of devices and media used to handle personal information
• Technical measures: access control, encryption of communications (HTTPS/TLS), and countermeasures against unauthorized access
• Understanding the external environment: where we handle personal information using services operated on servers located in a foreign country (cloud storage, email, backup, etc.), we take necessary and appropriate measures after understanding the personal information protection framework of that country

Technical details of how data is handled within our products are disclosed in each product's documentation (see Section 10).

8. Cookies and Access Analytics

Our website (https://exapolicy.com/) may use cookies and access analytics tools to improve our services and to understand access patterns. The information obtained in this way does not directly identify individuals. You can disable cookies in your browser settings, although some functions may then be limited.

9. Requests for Disclosure, Correction, Suspension of Use, etc.

An individual or their representative may request notification of the purpose of use, disclosure, correction, addition, or deletion, suspension of use or erasure, and suspension of provision to third parties with respect to that individual's personal information held by us. Please direct requests to the contact in Section 13. After verifying the identity of the requester, we respond within a reasonable period in accordance with applicable law.

10. Handling of Data in Our Products

The specific handling of data in each of our products and services (storage on the local device, retention period, deletion, integration with external services, etc.) is disclosed in the end-user license agreement for that product (EULA), its data-handling documentation, and its help documentation.

In our locally-executed products (including browser extensions), our basic design is that we do not collect or retain users' data, embodying Section 1-5 (privacy by design) of this Policy at the product level.

11. Handling of Personal Information in Foreign Countries

11.1 Handling by us

In the course of operating our business, we may handle personal information using external services (cloud storage, email, backup, access analytics, etc., including services operated on servers located in a foreign country). In such cases, we:

1. appropriately supervise the use of the service as outsourcing, and, in accordance with Section 7, take necessary and appropriate security control measures after understanding the external environment, including the personal information protection framework of that country; and
2. where the law requires the individual's consent or other procedures for the provision of personal data to a third party in a foreign country, obtain that consent or carry out those procedures.

11.2 Use of external services by users through our products

When a user uses external cloud services through our products, a transfer of data to the country where the service provider is located may occur between the user and that provider. Such a transfer takes place at the user's own discretion and within the user's relationship with that provider. For details, please refer to each product's documentation and the privacy policy of each service provider.

12. Revisions to This Policy

We may revise this Policy in response to changes in laws and regulations, changes in our business, and other circumstances. A revised Policy takes effect when it is posted on our website. We will give notice on our website when we make material changes.

13. Contact

For inquiries and requests regarding this Policy or our handling of personal information, please contact:

• Exapolicy LLC (エクサポリシー合同会社)
• Email: cov-support@exapolicy.co.jp
• Inquiries: Contact form (Japanese)
• Web: https://exapolicy.com/