Privacy Policy

This is a reference translation. The Japanese version is the official document.

Lab2Aid (“we,” “us,” or “our”) recognizes the protection of customers’ personal information as an important responsibility, establishes this Privacy Policy, and endeavors to handle personal information appropriately.

1. Information We Collect

We may collect the following information in providing the Service: • Name or display name, email address, and profile image received from Google or Apple when you log in or register with an account from either company, limited to information provided by those companies • Username, profile image, and other information you configure in the Service, including images you upload • Details of purchases, including plans, Coins, amounts, and dates and times. Credit card numbers and security codes are entered directly on the payment provider’s (Stripe) page and are not received by us. We may view information such as the card brand and last four digits in the payment provider’s administrative interface • Service usage records, including login records, Coin balances and transactions, apps and AI models used and their dates and times, game records, and access logs • Survey responses, bug reports, and inquiry contents, including device and browser information submitted with reports • Information obtained through cookies • Information obtained through analytics tools, including IP address, pages viewed, time on page, referrer, and browser information • Content entered when using AI features, including text and images

2. Purpose of Use

We use collected information for the following purposes: • Providing and operating the Service, including generating responses using AI • Billing, payment processing, and confirming purchase details • Responding to inquiries • Improving the Service and developing new features, including analyzing access activity • Preventing improper use, ensuring safety, and investigating and addressing malfunctions • Addressing violations of the Terms of Service • Sending maintenance and other important notices

3. Disclosure to Third Parties, Outsourcing, and Handling Outside Japan

【Disclosure to third parties】 We do not provide personal information to third parties except with the user’s consent or where permitted by the Act on the Protection of Personal Information or other applicable law. 【Outsourcing and use of external services】 We outsource part of the work necessary to provide the Service to the following providers or use their services. Each provider handles information only to the extent necessary for its stated purpose. When we provide personal data to a foreign provider, we identify the recipient, country, relevant legal system, and measures taken by the recipient in this section and in “6. Handling of Input in AI Features,” and obtain consent. Consent concerning payment, delivery, email, and analytics providers is obtained during registration. Consent concerning AI providers is obtained when applying for the Pro plan or purchasing Coins, as described in section 6. ■ Stripe Japan, Inc. (payment provider) Country: Japan. Information is also handled in the United States and other countries by its group companies; we cannot identify all such countries in advance Information handled: Email address, member identifier, and purchase details, including plan or Coins and amount. Credit card numbers and security codes are entered directly by users on Stripe’s page and are not received by us Purpose: Payment, plan changes and cancellation, and receipt procedures ■ Cloudflare, Inc. (delivery and communications protection) Country: United States. Communications pass through the company’s facilities around the world; we cannot identify all transit countries in advance Information handled: Communications with our website generally, including IP address, browser information, accessed page URLs, and transmitted and received content Purpose: Website delivery and communications protection ■ Google LLC (email: Gmail) Country: United States Information handled: Email address, inquiry contents, and emails sent by us Purpose: Responding to inquiries and sending notices ■ Google LLC (analytics: Google Analytics) Country: United States Information handled: Information described in “5. Cookies” Purpose: Analyzing access activity ■ Google LLC (news search) Country: United States Information handled: Search terms generated from questions entered in AI chat Purpose: Retrieving news headlines as described under 【News search】 in section 6 ■ OpenAI OpCo, LLC / Anthropic, PBC / Google LLC / SpaceXAI LLC (xAI) (AI providers) Country: United States Information handled: Content entered into AI features and instructions necessary for the features to operate. We do not add registered information such as names or email addresses. If entered content itself contains personal information, that information is also transmitted Purpose: Processing AI features 【Measures taken by providers】 Among the providers above, Stripe, Cloudflare, Inc., and Google LLC for analytics state in their published data-processing terms that they handle information in accordance with our instructions to provide their services, implement security measures, and notify us if a data breach or similar incident occurs. This reflects our review of their published terms on October 7, 2026. Google LLC for email and news search handles information according to its Privacy Policy. Measures taken by AI providers are described in section 6. Communications pass through Cloudflare’s facilities when the website is viewed before login. Google Analytics also transmits information from the browser before login. Collection can be disabled by the method described in section 5. 【Server locations】 We rent servers located in the United States and France to store and process user information, including account information, usage records, Coin balances, and AI input processed on our servers. The server providers are HOSTINGER PTE LTD of Singapore and Contabo GmbH of Germany. We manage and operate the servers ourselves and control access to stored information. In its published data-processing terms, Hostinger states that it implements security measures and provides notice if a data breach or similar incident occurs. This reflects our review on October 7, 2026. Contabo GmbH is a German provider subject to the EU General Data Protection Regulation (GDPR). 【Handling outside Japan】 As described above, user information is stored and processed on servers outside Japan, in the United States and France, and is handled through services provided by U.S. providers. The personal-information protection systems of the relevant countries are as follows, based on materials published by Japan’s Personal Information Protection Commission. • United States: There is no comprehensive federal law applying to personal-information protection across all sectors, based on a survey current as of October 2021. Some states have comprehensive personal-information protection laws. https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/ • France and Germany: Both countries are designated by the Personal Information Protection Commission as foreign countries with personal-information protection systems recognized as providing a level of protection equivalent to Japan for protecting individuals’ rights and interests. The EU General Data Protection Regulation (GDPR) applies. https://www.ppc.go.jp/enforcement/infoprovision/EU/ • Singapore: The Personal Data Protection Act is a comprehensive law, based on a survey current as of February 2022. https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_singapore/ Please review each provider’s published terms and privacy policy for details of its handling of information. See section 6 for handling of content entered into AI features.

4. Information Management

We endeavor to keep personal information accurate and manage it securely. We take the following measures to prevent leakage, loss, or alteration of personal information. • Basic policy and handling rules: We establish this Policy and define methods for obtaining, using, storing, and deleting personal information. • Response to breaches: If a personal-information breach or similar incident occurs, we investigate it and, where required by law, notify affected individuals and report it to the Personal Information Protection Commission. • Limiting handlers: We limit persons who handle personal information to those necessary for operation. • Access restrictions: We require authentication for servers and administrative interfaces that store personal information and limit who can access them. • Protection against unauthorized access: We update server software and use mechanisms to detect and block unauthorized access. • Encryption in transit: Communications between users’ devices and our website are encrypted. • Device and record management: Devices used to handle personal information are protected against theft and loss. Database backups are stored in encrypted form. • Not retaining card data: Credit card numbers and similar information are managed by the payment provider and are not stored on our servers. • Reviewing contractors: We review information-handling terms for providers to which work is outsourced. • Retention periods: Personal information is retained for the period necessary for its purpose. We endeavor to delete information promptly when it is no longer required. After account deletion, records required for legal obligations, payment verification, or dispute handling are retained only for the necessary period. • Handling outside Japan: After understanding the personal-information protection systems of the countries identified in section 3, namely the United States, France, Germany, and Singapore, we implement security measures.

5. Cookies

The Service uses cookies to improve user experience and the Service. We use Google Analytics 4, provided by Google LLC, to analyze access activity. Google Analytics uses cookies to collect information including IP address, pages viewed, time on page, referrer, browser information, and identifiers stored in cookies, and transmits it to Google LLC’s servers. We use this information to understand access activity and improve the Service, and do not use it to identify individuals. Google LLC’s purposes of use are described at https://business.safety.google/intl/ja/tba-jp/. To disable data collection by Google Analytics, you may use Google’s opt-out add-on at https://tools.google.com/dlpage/gaoptout. You may also refuse cookies through your browser settings, but some parts of the Service may not function properly. For details of Google’s handling of data, please review Google’s Privacy Policy at https://policies.google.com/privacy.

6. Handling of Input in AI Features

The Service includes features in which AI processes content entered by customers, including AI chat. The provisions in this section concerning transmission to external AI providers apply only to AI included in the Pro plan and AI used with Coins. Input is not transmitted to an external AI provider when using BASIC AI included in the Basic plan or Pro plan. 【Processing methods】Depending on the plan and selected AI model, entered content is processed by one of the following two methods. • (A) Processing by transmission to an external AI provider: Entered content is transmitted to an API provided by one of the following four U.S. providers: OpenAI OpCo, LLC, Anthropic, PBC, Google LLC, or SpaceXAI LLC (xAI). This method applies to AI included in the Pro plan and AI models used with Coins, including when a Coin-based AI model is used by a user who otherwise uses the Service free of charge. • (B) Processing on our servers: Content is processed by AI models that we operate on rented servers in the United States and France. Under this method, entered content is not transmitted to an external AI provider. BASIC AI included in the Basic plan and Pro plan uses this method. 【Content transmitted】Under method (A), only content entered by the customer, including text and images, and instructions necessary for the feature to operate are transmitted. We do not add registered information such as names or email addresses. However, if entered text or images themselves contain personal information, that information is also transmitted. 【Storage by us】For AI features, we retain on our servers only the following: (1) records such as usage date and time, AI model, approximate character count, and Coins consumed; and (2) up to the first 50 characters of a question entered in AI chat, which are retained in server logs for a limited period to investigate malfunctions and which we endeavor to delete when no longer needed for investigation. Other entered content and AI responses are not stored on our servers. AI chat history is stored on the customer’s device in the browser and is not held by us. 【Use for AI training】The API terms of the four providers under method (A) state that submitted input and generated results are not used to train their AI models unless we permit such use. We do not grant that permission. 【Storage by providers】The four providers under method (A) may retain transmitted content for a limited period to monitor improper use and for similar purposes. According to information published by the providers and reviewed by us on October 7, 2026, OpenAI retains it for up to 30 days; Anthropic for no more than 30 days, except content flagged as potentially violating its usage policy, which may be retained for up to two years; Google for 55 days; and xAI for 30 days. Information may be retained longer where required by law or in similar circumstances. Provider terms may change. 【News search】To answer questions about news in AI chat, search terms generated from the question may be transmitted to Google LLC’s news search service in the United States to retrieve article headlines. 【Voice input】Voice input uses the browser’s speech-recognition feature. Voice may be converted to text by a service operated by the browser provider, such as Google or Apple. We do not receive the audio itself. 【Information that must not be entered】Do not enter the following information into AI features: • Information that can identify you or another person, such as a name, address, telephone number, or email address • Information requiring special care, such as medical history, health condition, or beliefs • Information that must not become known to others, such as passwords, credit card numbers, or business secrets When a feature accepts images, do not enter images in which a person can be identified or in which any of the information above appears. 【Consent to transmission outside Japan】Under method (A) and the news-search function described above, entered content is transmitted to providers outside Japan. Because the recipients are located in a foreign country, we obtain customers’ consent even where the transfer constitutes outsourcing. • Destination country: United States of America • U.S. legal system: See 【Handling outside Japan】 in section 3. • News search (Google LLC): Only search terms generated from the question are transmitted. Google LLC handles them under its Privacy Policy. Items (1) through (4) below concern the four providers under method (A). • Measures taken by the four providers under method (A): Based on the providers’ published API and data-processing terms, we confirmed the following measures: (1) transmitted content is handled only to the extent necessary to generate AI responses, monitor improper use, and perform similar functions; (2) content is not used for AI training unless we permit it; (3) security measures are implemented; and (4) content is deleted according to the periods described under 【Storage by providers】 above. Please review each provider’s published Privacy Policy for details. Consent is obtained in the consent field on the payment screen when applying for the Pro plan, including its news-search function, and when purchasing Coins for Coin-based AI. If you do not consent, you cannot apply for the Pro plan or purchase Coins. Features that do not transmit input to an external AI provider, including BASIC AI, remain available. Please review each provider’s Privacy Policy for details of its handling of data. • OpenAI: https://openai.com/policies/privacy-policy • Anthropic: https://www.anthropic.com/legal/privacy • Google: https://policies.google.com/privacy • xAI: https://x.ai/legal/privacy-policy

7. Disclosure, Correction, and Deletion of Personal Information

Users may request disclosure, correction, or deletion of their personal information held by us. Requests are accepted by email at [email protected].

8. Changes to this Policy

We may change this Policy as necessary. A changed Policy takes effect when posted on our website. Before making a change to the purposes of use or another material change, we will provide notice by email or within the Service in addition to posting it. Where consent to a change is required by law, we will obtain consent again.

9. Contact

【Business handling personal information】 Trade name: Lab2Aid Name and address of the business operator: As stated on the “Specified Commercial Transactions Act” page. 【Contact and complaints】 For inquiries or complaints concerning this Policy or our handling of personal information, please contact: Lab2Aid Email: [email protected]

Last Updated: 2026-10-14