vai vai chat Privacy Policy

Last Updated: October 2025

Non-Profit Organization immi lab (hereinafter, "the Organization") establishes this Privacy Policy (hereinafter, "this Policy") regarding the handling of Users' personal information in the service (hereinafter, "the Service") provided on this website.

Article 1 (Personal Information)

"Personal information" refers to "personal information" as defined in the Personal Information Protection Act, meaning information about a living individual that can identify a specific individual by name, email address, contact information, or other descriptions included in the information, and information (personal identification information) that can identify a specific individual solely from that information.

Article 2 (Method of Collecting Personal Information)

The Organization may ask for personal information such as name and email address when the User registers to use the Service.
In addition, the Organization collects information such as chat history (prompts/responses), location information, and education/work information voluntarily provided by the User during the process of using the Service.

Article 3 (Purpose of Collecting and Using Personal Information)

The purposes for which the Organization collects and uses personal information are as follows:

For the provision and operation of the Service.
To respond to inquiries from Users (including verifying identity).
To send emails announcing new features, updates, campaigns for the services the User is using, and other services provided by the Organization.
To send necessary communications such as maintenance and important notices.
To identify Users who violate the Terms of Service or attempt to use the Service for an unfair or improper purpose, and to deny them use.
To allow Users to view or change their registered information, delete it, and view their usage status.
For the provision and personalization of AI educational support.
For service improvement (including AI training and statistical analysis).
For purposes incidental to the above uses.

Article 4 (Changes to the Purpose of Use)

The Organization shall change the purpose of use of personal information only when it is reasonably recognized that the purpose of use is related to the purpose before the change.
If the purpose of use is changed, the Organization shall notify the User of the changed purpose or publicly announce it on this website by the method specified by the Organization.

Article 5 (Provision of Personal Information to Third Parties and International Data Transfer)

The Organization shall not provide personal information to a third party without the prior consent of the User, except in cases stipulated by law or other laws concerning personal information protection.
- When there is a need to protect the life, body, or property of a person, and it is difficult to obtain the consent of the individual.
- When there is a special need to improve public health or promote the sound development of children, and it is difficult to obtain the consent of the individual.
- When it is necessary to cooperate with a state organ, a local public entity, or a person entrusted by them in executing the affairs prescribed by law, and obtaining the consent of the individual is likely to impede the execution of the affairs.
- When the following matters have been announced or publicized in advance, and the Organization has notified the Personal Information Protection Commission:
  - That the purpose of use includes provision to a third party.
  - The data items to be provided to the third party.
  - The means or method of provision to the third party.
  - That the provision of personal information to a third party will be stopped at the request of the individual.
  - The method for accepting requests from the individual.
Third-Party Data Processors and International Data Transfer
For the operation and improvement of the Service, the Organization provides and stores personal data with third-party service providers located outside Japan, as follows:

Third-Party Processor	Location	Function
Google Gemini AI	USA	Core AI chatbot functionality.
Supabase	USA	Primary database and backend data storage.
PostHog Inc.	USA	Service improvement and user analytics.
Langfuse GmbH	USA	LLM observability and performance analytics.

International Data Transfers Disclosure
To operate and improve the vai vai chat service, the Organization transfers your personal data to and stores it with service providers located outside of Japan, including in the United States of America (USA). These countries may have different data protection laws than Japan. By using our service, you acknowledge and consent to this transfer, storage, and processing of your information by these third parties in their respective locations.
Notwithstanding the preceding paragraphs, in the following cases, the recipient of the information shall not be considered a third party:
- When the Organization outsources all or part of the handling of personal information to the extent necessary for achieving the purpose of use.
- When personal information is provided due to the succession of business through merger or other reasons.
- When personal information is jointly used with a specific person, and the individual has been notified in advance or can easily learn of the fact, the items of personal information to be jointly used, the scope of joint users, the purpose of use by the users, and the name or title of the person responsible for managing the personal information.

Article 6 (Use of Analytical Tools)

The Organization uses the following analytical tools to analyze the usage status of the Service and improve the Service. The use of these tools is disclosed in this Policy:

PostHog
Langfuse

Article 7 (Security Management of Personal Information)

The Organization takes necessary and appropriate measures, including the following, for the prevention of leakage, loss, or damage of personal information, and other security management of personal information:

Encryption (in transit and at rest).
Adoption of secure storage practices.
Organizational, human, physical, and technical security management measures.

Article 8 (Disclosure of Personal Information)

When the individual requests the disclosure of their personal information, the Organization shall disclose it to the individual without delay. However, the Organization may not disclose all or part of the information if disclosure falls under any of the following, and if the decision not to disclose is made, the Organization shall notify the individual of that fact without delay:
- When there is a risk of harming the life, body, property, or other rights or interests of the individual or a third party.
- When there is a risk of significantly impeding the proper execution of the Organization's business.
- When it would violate other laws and regulations.
A fee of 10,000 JPY per request will be charged for the disclosure of personal information.
Notwithstanding the preceding paragraph, information other than personal information, such as usage history and characteristic information, will generally not be disclosed.

Article 9 (Correction and Deletion of Personal Information)

If the User determines that their personal information held by the Organization is incorrect, the User may request the Organization to correct, add, or delete (hereinafter, "Correction, etc.") the personal information through the procedure specified by the Organization.
If the Organization determines that there is a need to comply with the User's request in the preceding paragraph, the Organization shall make the Correction, etc., to the relevant personal information without delay.
If the Organization makes a Correction, etc., based on the provision of the preceding paragraph, or if it decides not to make a Correction, etc., it shall notify the User of this without delay.
Users who wish to delete their account should contact the Organization via the specified withdrawal procedure or the contact window listed in Article 12. Upon request for account deletion, all associated data will be permanently removed from the system.

Article 10 (Suspension of Use, etc., and Retention Period of Personal Information)

If the Organization is requested by the individual to suspend or erase the use (hereinafter, "Suspension of Use, etc.") of personal information on the grounds that the personal information is handled beyond the scope of the purpose of use or that it was acquired by unauthorized means, the Organization shall conduct the necessary investigation without delay.
If the Organization determines that it is necessary to comply with the request based on the results of the investigation in the preceding paragraph, the Organization shall suspend the use, etc., of the relevant personal information without delay.
If the Organization suspends the use, etc., based on the provision of the preceding paragraph, or if it decides not to suspend the use, etc., it shall notify the User of this without delay.
Notwithstanding the preceding two paragraphs, if the Suspension of Use, etc., requires a large amount of expense or if the Suspension of Use, etc., is otherwise difficult, and if alternative measures necessary to protect the User's rights and interests can be taken, the Organization shall take this alternative measure.
(Retention Period) The Organization retains the User's data until the User explicitly deletes their account. The Organization may also delete inactive accounts (e.g., no login for more than one year) and the associated data after prior email notification.

Article 11 (Changes to this Privacy Policy)

The content of this Policy may be changed without notifying the User, except for matters otherwise stipulated in laws and regulations or this Policy.
Unless otherwise specified by the Organization, the changed Privacy Policy shall take effect when it is posted on this website.

Article 12 (Contact Window)

Please contact the following window for inquiries regarding this Policy, the handling of personal information, or the exercise of data subject rights:

Email Address: vaivai@immilab.org