Privacy Policy

Last updated: 2026-10-13

This is an English translation of the Japanese プライバシーポリシー, provided for reference. If the two differ, the Japanese version prevails.

TSUQREA Inc. (株式会社ツクリエ; “we”) handles personal information in “mukumo” (the web service provided at mukumo.com and app.mukumo.com, and related apps and APIs; the “Service”) in accordance with the Act on the Protection of Personal Information of Japan (the “APPI”) and other laws, as set out in this Privacy Policy. Terms have the same meanings as in the Terms of Service.

1. Business operator

2. Information we collect

2.1 Information you provide

• Account: Name, email address, profile picture, display language, passkey public keys, and two-factor authentication settings (secret values are stored encrypted)
• Organization: Organization name, members and their roles, and the email addresses of people you invite
• What you enter and save: Settings such as sites and keywords, the content of conversations with the AI, attached images, imported files, the AI’s name, look and speaking style settings, preferences you have the AI remember, and your ratings of AI answers with their reasons
• Voice and calls: Your voice (sent to an external service to be transcribed; for calls and voice input, we do not store the voice itself), transcribed text, and call summaries
• Meeting records: Meeting audio and video recordings (including participants’ voices, video and shared screens), imported audio and video files, transcribed text, names given to speakers, meeting titles and dates, and who made the recording
• Payments: Billing information, subscription status, and records of credit purchases and use. Card numbers are received directly by our payment provider, Stripe, and we do not store them
• Referrals: Organizations that started from a referral link, the referring organization or partner, when the link was opened, and the date of the first payment
• Inquiries: The content of inquiries and contact details

2.2 Information from signing in with an external account

To keep sign-in linked, we also store the authentication credentials (tokens) issued by each service.

2.3 Information from external services connected by an organization

• Google Analytics and Search Console: The connected Google account’s email address, information about accessible properties, aggregated traffic and search performance for sites selected by the organization, and authentication credentials to maintain the connection (Section 3)
• LINE Official Account: Friends’ LINE user IDs, display names and profile pictures, exchanged messages, form responses, and records of link clicks and entry routes
• Slack: Slack user IDs and email addresses (to link them with accounts on the Service), and messages sent to the AI
• Instagram: The connected account’s IDs, username and profile picture, the access token (stored encrypted), and public posts (images, videos and captions)

Personal information of third parties that an organization brings into the Service, such as LINE friends’ information and the voices and statements of meeting participants captured in meeting records, is handled as entrusted to us by that organization and within the scope of its instructions.

2.4 Information recorded automatically

• IP address, browser type, and sign-in time of the devices used to sign in
• Records of actions within an organization (audit logs)
• Error information (before sending, we remove parts that could identify individuals, such as URL query strings and message text)
• Device identifiers for delivering notifications to the app
• Browsing information collected through cookies and similar technologies (Section 8)

3. Handling of Google user data

Sign in with Google and connecting Google for an organization’s analytics and SEO request permission through separate actions. Signing in with Google alone does not give the Service access to Google Analytics or Search Console data. These integrations do not access Gmail, Google Drive or Google Calendar data.

3.1 Sign in with Google

• Information and use: We use your name, email address and profile picture (scopes openid, email and profile) to create your account, sign you in, verify your identity, and display this information
• Storage and deletion: This information and the authentication credentials issued by Google are stored as account information. Deleting your account deletes the account and its Google sign-in connection. This is separate from deleting analytics data shared within an organization

3.2 An organization’s Google Analytics and Search Console connection

This integration is used when an organization owner or administrator grants permission on Google’s consent screen and configures the relevant sites and properties.

• Information collected: The connected Google account’s email address, accessible Analytics property IDs, names and time zones, and Search Console properties and permissions. For selected sites, we retrieve aggregates such as GA4 users, sessions, page views, traffic sources and top pages, and Search Console clicks, impressions, click-through rates, positions, search queries and pages. This feature does not export individual visitors’ raw events
• Permissions and use: We use analytics.readonly and webmasters.readonly to verify properties, display reports and support SEO analysis within the organization, and continuously save daily reports when enabled by an administrator. These permissions are read-only; we do not change Google Analytics or Search Console settings or data. We also use openid and email to identify the connected account
• Storage: Authentication credentials that maintain the connection are stored encrypted. Settings, aggregates and retrieved reports are stored in Cloudflare databases and storage. When continuous storage is enabled, daily reports are also stored in Google Cloud BigQuery, separated by organization. BigQuery data is stored in the Tokyo region
• Stopping and deletion: Revoking the Service’s access in your Google Account settings prevents new retrieval using that permission. You can stop continuous storage of daily reports in the Service. Stopping collection, revoking permission or deleting an individual user’s account does not immediately delete daily reports stored for the organization. See Sections 9 and 11 for retention periods and deletion requests

3.3 Sharing and limits on the use of Google data

We use information obtained from Google to provide the features described above that users request. Organization members can view their organization’s analytics data according to their roles. We do not use this information for advertising delivery or targeting, sell it, or use it to train AI models. Transfers to third parties are limited to those permitted by the following Google policy, including entrusting data to processors in Section 6, such as Cloudflare and Google Cloud, as necessary to provide these features.

The Service’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes of use

1. Providing the Service (managing accounts and organizations, AI features, transcribing meeting records, integrations with LINE, Slack and other services, and notifications)
2. Verifying identity, protecting sign-in, and preventing fraudulent use
3. Billing and managing credits (including referral rewards)
4. Responding to inquiries, and sending important notices about the Service (changes to the Terms of Service, outages and security)
5. Investigating failures, checking the quality of AI answers, and improving the Service
6. Analyzing how the Service is used (as statistics that do not identify individuals)
7. Responding to conduct that violates the Terms of Service, and responding as required by law

5. Provision to third parties

We do not provide personal data to third parties without your consent, except in the following cases:

• When required by law
• When it is necessary to protect a person’s life, body or property and it is difficult to obtain your consent
• When it is necessary to cooperate with a national agency or similar body in carrying out duties prescribed by law, and obtaining your consent may interfere with those duties
• Other cases permitted under the APPI

Entrusting data to the processors in Section 6, and provision in connection with the succession of business due to a merger or similar event, do not constitute provision to third parties.

6. Processors (contractors and external services)

To the extent necessary to provide the Service, we entrust the handling of personal data to the following kinds of businesses:

• Servers, databases and sending email (United States)
• Storage of Google analytics data connected by organizations (Cloudflare and Google Cloud, United States-based providers; BigQuery data is stored in the Tokyo region)
• AI answers and summaries, web research (search terms and URLs), and voice transcription and speech synthesis (United States)
• Checking the quality of AI answers and investigating failures (United States and Germany)
• Access analytics (Section 8) and payments (United States)
• Integrations with LINE, Slack and other services, and notifications to iPhone and other devices (Japan and United States)

Information is sent to external services that an organization connects itself (such as research services used with its own API keys, or MCP servers) according to that organization’s instructions. How the information is handled there is governed by each provider’s terms.

7. Provision to third parties in foreign countries

As described in Section 6, we entrust personal data to businesses located in the United States and Germany. By agreeing to this Policy when you start using the Service, you consent to the provision of personal data to third parties in foreign countries.

• Foreign systems: The personal information protection systems of each country can be checked in the Personal Information Protection Commission’s survey of personal information protection systems in foreign countries (Japanese). Germany (EU) is a region that the Personal Information Protection Commission has recognized as having a system with a level of protection equivalent to Japan’s
• Processors’ measures: Each company publishes its policy on handling personal information and takes security measures such as access restrictions and encryption. We use each company after checking its terms and data processing conditions
• On request, we will promptly provide information about the processors’ measures

8. Cookies and similar technologies

You can stop Google Analytics with the Google Analytics Opt-out Browser Add-on. For how each company handles data, see the Google Privacy Policy and the Microsoft Privacy Statement.

You can stop our own analytics in this browser by opening the opt-out link. Visits from the EU, the UK and Switzerland are not sent until a consent signal is received. Measurement cookies are not used in browsers that send Global Privacy Control. This opt-out is separate from Google Analytics and Microsoft Clarity settings.

9. Retention and deletion

• Account: Kept until you delete your account. When you delete your account, we delete the account, sign-in methods, sign-in records and device information, as well as your information stored in the Service (the content of conversations with the AI, attached images and files, text transcribed from calls and their summaries, your profile picture, the AI’s name, look and speaking style settings, preferences you had the AI remember, your ratings of AI answers and their copies, and your link to Slack)
• What remains in the organization: Items shared within the organization (organization files, LINE exchanges, meeting records, audit logs, etc.) remain as organization data after you delete your account. Audit logs and meeting records keep the names of the people who performed actions or made recordings
• Meeting records: Recordings and transcribed text are kept as organization data until they are deleted by the person who made the recording or by an owner or administrator of the organization. When they are deleted, the recordings and transcribed text are deleted. Recordings sent to Soniox for transcription are deleted when transcription finishes (even if transcription fails, they are erased on Soniox’s side within 30 days)
• Organization: Even after an organization is deleted, its data and audit logs are kept so that it can be restored after a mistaken deletion. The same applies to an organization deleted together with an account (an organization with only that person). If you want complete deletion, please contact us at the contact point in Section 11
• Conversations: When you delete a conversation, we delete its content, attached images and files, and the text transcribed from calls in that conversation and their summaries. However, copies of answers you rated low remain until you withdraw the rating or delete your account. Quality-check records (Langfuse) remain regardless of deleting conversations or accounts
• Records after deletion: Deleted data also remains for up to 30 days in records for recovering from failures (backups) and in temporary copies (the progress of web research and reduced-size images), and is then erased. During this period, it cannot be viewed from the Service’s screens
• Communication logs: Server communication logs are erased after about 7 days
• Our analytics: Page and interaction records are erased after 400 days. Our analytics on this site does not store form input values
• Google analytics data connected by organizations: Continuously stored daily reports and daily aggregates used on screen become eligible for deletion 400 days after the report date. Temporary copies of retrieved reports become eligible for deletion 30 days after retrieval. Deletion can be delayed while scheduled processing is stopped or unavailable. Stopping storage or deleting an organization does not immediately delete its BigQuery data. To request deletion before the retention period ends, an organization owner or administrator should contact us through Section 11
• Information that the law requires us to keep (such as transaction records) is kept for the required period

10. Security measures

• Technical measures: All communication is encrypted (HTTPS). Instead of passwords, you sign in with email confirmation codes, passkeys or external accounts. Two-factor authentication secrets and authentication credentials for LINE, Slack and other services are stored encrypted, and API keys are stored in an irreversible form (hashes). We limit the number of sign-in attempts
• Access control: Organization data can be handled only by members of that organization, according to their roles. The operator’s admin console can be used only by our designated accounts, and operator actions are recorded
• Organizational and personnel measures: We limit who handles personal data, and set and enforce rules for handling it
• Understanding the external environment: Data is stored mainly on services of Cloudflare, Inc. (United States), and the servers are located mainly in the Asia-Pacific region (including Japan). We take security measures based on an understanding of the systems in the countries where processors are located (Section 6)

11. Requests for disclosure and contact point

To request notification of the purpose of use, disclosure (including records of provision to third parties), correction, addition, deletion, suspension of use, erasure, or suspension of provision to third parties of retained personal data, please use the contact form below. We will respond without delay after confirming that you are the person concerned (or, for an agent, their authority). No fee is charged.

• Contact point: TSUQREA Inc., mukumo Inquiries
• Form: contact form
• Address: 1-13-11 Kusunokicho, Nishi-ku, Hiroshima-shi, Hiroshima 733-0002, Japan

You can also correct your name, email address and profile picture on the Service’s settings screen. For personal data entrusted to us by an organization, such as LINE friends’ information, please contact that organization. We will respond according to the organization’s instructions.

Complaints about the handling of personal information are also accepted at the same contact point.

12. Training AI models

We do not use your data to train AI models, and we do not provide it to third parties for the purpose of training models. Under OpenAI’s terms, information sent to the OpenAI API, which we use to create AI answers, is not used to train OpenAI’s models.

13. Changes to this Policy

We may change this Policy in line with amendments to laws or changes to the Service. When we change it, we will announce it on this page, and we will also announce important changes in the Service or by email.