Skip to content
Firstweb

Privacy Policy

Effective date:

Firstweb ("we", "us") sets out this Privacy Policy ("this Policy") for the handling of personal and other information on the website we operate (the "Website") and in "集客AIアシスタント" (the "Service"). This English version is a translation. If there is any discrepancy between the Japanese and English versions, the Japanese version prevails.

1. Operator

The business that handles information under this Policy is:

Name
Firstweb
Representative
佐藤祥大
Address
Provided without delay upon request
Contact
firstweb.sato@gmail.com

2. Information we collect

2.1 Website

  1. The Website does not use cookies for analytics or advertising.
  2. Cloudflare, Inc., which delivers the Website on our behalf, records access logs such as IP addresses, browser types, and access times to deliver and protect the Website.
  3. When you contact us by email, we collect the information you send, such as your name, restaurant or company name, email address, phone number, and the content of your inquiry.

2.2 Service

  1. Information from LINE: your LINE user identifier (user ID) and display name.
  2. Restaurant information: the name of the restaurant you register, its place identifier on Google Maps (Place ID), and delivery settings.
  3. Public information from Google Maps: public information obtained through the Google Places API, such as star ratings, numbers of reviews, and new reviews (reviewer display name, date, rating, and an excerpt) of your restaurant and nearby restaurants of the same type.
  4. Information obtained by connecting your Google Account (Google user data): described in Section 4.
  5. Dashboard user information: email addresses, display names, and authentication identifiers of agency staff and others who use the Service's dashboard.
  6. Usage information: records of operations (identifiers of the user and target, and the time) and records of errors and other system behavior.

The Service does not collect personal information about the customers who visit your restaurant.

3. How we use information

We use the information we collect only for the following purposes:

  1. Providing the Service (creating and delivering summaries, creating drafts of posts and replies, and publishing the posts and replies you approve)
  2. Identifying and authenticating users and managing connection status
  3. Investigating problems, maintaining and improving the Service, and keeping it secure
  4. Responding to inquiries and sending important notices, such as changes to this Policy or the Terms of Service, or changes to your connection status
  5. Responding to violations of the Terms of Service and misuse

We do not use the information we collect for advertising or sell it.

4. Google user data

The Service handles the following data obtained through Google APIs ("Google user data") only if you agree to connect your Google Account. Connecting is optional, and the daily summary works without it.

4.1 Data we access

The only permission the Service requests is to manage your Google Business Profile (OAuth scope https://www.googleapis.com/auth/business.manage). With this permission, we access:

  1. Names and identifiers of the Google Business Profile accounts you manage
  2. Names and identifiers of the locations (restaurants) in those accounts
  3. Reviews of those locations (such as the reviewer display name and profile photo URL, rating, text, time posted, and existing replies)
  4. Authorization information needed to keep the connection (a refresh token)

4.2 How we use it

We use Google user data only to provide the Service's features to you: choosing the location to connect, creating drafts of review replies and posts, and sending to your Google Business Profile the replies and posts that you have reviewed and approved on LINE. We never publish posts or replies automatically without your approval.

4.3 How we store it

  1. Refresh tokens are encrypted with AES-256-GCM and stored in a database in the Google Cloud Tokyo region. The encryption key is managed in a secret management service separate from the database (Google Cloud Secret Manager).
  2. Access tokens are obtained for each operation and never stored.
  3. Account and location names and identifiers, and Place IDs, are stored until you disconnect, to identify the connected location.
  4. Conversation data handled while creating a draft, such as review text and drafts, is kept only as temporary records and deleted automatically within 30 minutes.
  5. Authorization information is never written to logs.

4.4 How we share it

We share Google user data with the following companies only as needed to provide the Service. We disclose it to any other third party only when required by law.

  1. Google LLC (Gemini API): to create drafts, we send the review text, the reviewer's display name, the rating, and the restaurant name for replies, and the restaurant name and the content you sent for posts. The data is processed under the Gemini API paid service terms, and the content we send is not used to improve Google's products.
  2. LY Corporation (LINE Messaging API): drafts and confirmation screens are sent to you as LINE messages, so review content and drafts pass through LINE.

4.5 What we never do

  1. We do not sell Google user data.
  2. We do not use Google user data for advertising, including targeted, retargeted, or interest-based advertising.
  3. We do not use Google user data to develop, improve, or train generalized AI or machine learning models.
  4. People read Google user data only with your explicit consent, when necessary for security purposes such as investigating abuse, when necessary to comply with the law, or for our internal operations after the data has been aggregated and anonymized.

4.6 Disconnecting and deleting data

  1. You can disconnect at any time from the LINE menu. When you disconnect, we revoke the authorization with Google and delete the stored refresh token and the account and location names and identifiers.
  2. You can also disconnect from Third-party apps & services in your Google Account.
  3. If you ask us to disconnect or delete your data through the contact in Section 12, we will do so within 7 business days.
  4. Deleted data is also removed from our backups, which are kept for up to 7 days.

4.7 Compliance with the Google API Services User Data Policy

集客AIアシスタント's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Disclosure to third parties

Except as permitted by law, we do not provide personal data to third parties without your prior consent. Providing data to the service providers described in Sections 4 and 6 is outsourcing within the scope needed for the purposes of use, and is not disclosure to a third party in this sense.

6. Service providers and foreign transfers

We entrust the handling of information to the following companies to operate the Website and the Service:

  1. Google LLC (United States): cloud infrastructure (Google Cloud, with data stored in the Tokyo region), user authentication, and draft creation (Gemini API)
  2. LY Corporation (Japan): sending and receiving messages on LINE
  3. Cloudflare, Inc. (United States): delivering the Website

When we entrust data to companies in the United States, we confirm that they have established systems that meet the standards set by the Personal Information Protection Commission of Japan, and we take the necessary and appropriate measures to ensure those systems continue to be implemented. For information about the personal information protection system in the United States, see the information published by the Personal Information Protection Commission (in Japanese).

7. Security measures

To prevent the leakage, loss, or damage of personal data, we take the following measures:

  1. Organizational: we appoint a person responsible for handling personal data and check how it is handled.
  2. Personnel: we make sure everyone who handles personal data knows the rules for handling it.
  3. Physical: we protect devices that handle personal data from theft and loss.
  4. Technical: we encrypt communications (HTTPS), store authorization information encrypted, minimize access rights, and keep access records.
  5. Understanding the external environment: when entrusting data to companies abroad, we take measures based on an understanding of the personal information protection systems of those countries.

8. Retention

Google user data is retained as described in Section 4.3. Other information is retained only as long as needed for the purposes of use and deleted without delay when no longer needed. System logs are deleted within 90 days.

9. Your rights

You or your agent may request that we notify you of the purposes of use of the personal data we hold, disclose it, correct, add to, or delete it, stop using or erase it, stop providing it to third parties, or disclose records of provision to third parties. Please contact us using the details in Section 12. We will respond without delay in accordance with the law after confirming your identity.

10. Cookies and browser storage

The Website does not use cookies. Your choice of display theme (light or dark) is stored only in your browser's local storage (localStorage) and is never sent to our servers.

11. Changes to this policy

We may change this Policy to reflect changes in the law or in the Service. We will post any changes on the Website and will also announce important changes in the Service.

12. Contact

For questions about this Policy or how we handle information, requests regarding your rights, or requests to disconnect or delete your data, please contact:

Name
Firstweb
Representative
佐藤祥大
Address
Provided without delay upon request
Contact
firstweb.sato@gmail.com