Privacy Policy

This page is the Privacy Policy as partially revised on October 21, 2026, before the partial revision of October 22, 2026. For the current text, see here; for the text before the partial revision of October 21, 2026 (the version effective October 20, 2026), see here; for the version that applied until October 19, 2026, see here.

Notice: This is a reference translation provided for convenience. The Japanese version is the authoritative text. In case of any discrepancy between this translation and the Japanese version, the Japanese version shall prevail.

Chapter 1. General Provisions

Article 1 (Purpose)

VorEdge Inc. (the “Company”) establishes this Privacy Policy (this “Policy”) in compliance with the Act on the Protection of Personal Information (the “APPI”) and other applicable laws and regulations, in order to appropriately handle the personal information of users in connection with the service “BotShade” (the “Service”) provided by the Company.

Article 2 (Definitions)

Unless otherwise defined, terms used in this Policy shall have the meanings ascribed to them in the Terms of Service of the Service. Terms such as “personal information,” “personal data,” “retained personal data,” and “sensitive personal information” used in this Policy shall have the meanings ascribed to them under the APPI.

Article 3 (Scope of Application)

1. This Policy applies to the handling of personal information obtained by the Company through the Service.
2. As provided in Chapter 12, Article 7 of the Terms of Service, the Service is, in principle, provided to individuals residing in Japan or business operators having their principal offices in Japan. With respect to use by residents outside Japan, the Company does not warrant that it has complied with all additional protection requirements imposed by the personal information protection laws of such country or region (the EU General Data Protection Regulation, the UK Data Protection Act, the California Consumer Privacy Act of the United States, the Personal Information Protection Law of the People’s Republic of China, and other laws).

Chapter 2. Business Operator Information and Personal Information Protection Manager

Article 1 (Personal Information Handling Business Operator)

• Corporate Name: VorEdge Inc.
• Address: Nishi-Shinjuku Mizuma Bldg. 2F, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan
• Representative: Shun Watanabe

Article 2 (Personal Information Protection Manager)

The Company appoints a personal information protection manager to ensure the appropriate handling of personal information. Inquiries should be directed to the inquiry contact in Chapter 16 of this Policy.

Chapter 3. Items of Personal Information Collected

Article 1 (Information Directly Provided by Users)

The Company collects the following information from Users in the contexts of user registration for the Service, inquiries, subscription to Paid Plans, and the like.

• Email address
• Authentication information (public key information and credential identifier for passkey authentication based on the WebAuthn / FIDO2 standards, identifiers obtained from social login providers (Discord, Google, GitHub), and the like. The Company does not collect or store User passwords)
• Discord account information (username, user ID, avatar image, server membership information, and the like)
• Information provided at the time of inquiries (name, email address, content of inquiry, and the like)
• Configuration information created and registered by the User within the Service (Bot settings, commands, response templates, distribution messages, and the like)
• Prompts, contextual information, reference materials, and the like that the User voluntarily sends to BotShader or other AI features (meaning the “AI Input Data” defined in Chapter 1, Article 2 of the Terms of Service)
• Information of Discord servers registered on the Server Board (server name, description, invitation link, tags, and the like. Such information is disclosed to the general public)
• Records of consent to the Terms of Service and the Privacy Policy (the version of the document consented to, the date and time of consent, and the IP address and browser information at the time of consent)
• Records of consent to, and withdrawal of consent to, the sending of advertising and promotional emails (the date, time, and method of such consent or withdrawal)
• Country or region of residence (declared at the time of user registration or upon the Company’s request, pursuant to Chapter 12, Article 7 of the Terms of Service)
• The name, description, images such as screenshots, flow structure, and publisher display name of Published Commands published on the Command Market (as defined in Chapter 5, Article 8-2 of the Terms of Service) (such information is displayed to other Users)

Article 2 (Information Automatically Collected)

The Company automatically collects the following information in connection with the use of the Service.

• IP address, browser information, device information, OS information, referrer
• Access logs, operation logs, error logs
• Identifiers, session information, and the like obtained through Cookies and similar technologies
• Bot operation logs in the Service (the type of command executed, the date and time of execution, result codes, and the like. Message bodies are not included. The handling of transcripts of the ticket feature is provided in Chapter 9-2, Article 2)
• Records of registration, update, and bump operations on the Server Board (the Discord user ID that performed the operation and the date and time thereof. These are not disclosed to the public)
• Where registration is made via a referral link, the identifier of the referrer

Article 3 (Information Obtained from Third Parties)

The Company may obtain personal information from third parties in the following cases.

• Discord account information provided through Discord’s OAuth or the like
• Payment processing results provided by the payment service provider (Stripe) (the Company does not obtain credit card numbers themselves)

Article 4 (Non-Collection of Sensitive Personal Information)

The Company does not intend to obtain sensitive personal information (race, creed, social status, medical history, criminal record, history of being a crime victim, or other personal information requiring special care) in providing the Service. Users are requested not to include sensitive personal information in the input fields of the Service, inquiries, AI Input Data, or otherwise.

Chapter 4. Methods of Collection

Pursuant to Chapter 12, Article 7 of the Terms of Service, the Company provides the Service, in principle, to Users in Japan, and the handling of personal information under this Policy is conducted in accordance with the APPI of Japan. The Company collects personal information by one of the following methods.

• Direct provision by Users through registration, input, upload, and the like to the Service
• Collection through Cookies and other automatic collection technologies
• Provision from third-party services (Discord, Stripe, and the like) based on User consent

Chapter 5. Purpose of Use

The Company uses the collected personal information within the scope of the following purposes.

• For the provision, operation, maintenance, and improvement of the Service
• For user registration, identity verification, confirmation of the country or region of residence (the countries and regions to which the Service is provided), authentication, and access management to the Service
• For response generation and processing based on input in the AI features (BotShader and the AI Response Feature)
• For billing of fees and other consideration and payment processing
• For responding to User inquiries, requests, and support requests
• For communicating about maintenance, important notices, notices of revisions to the terms, and the like related to the Service
• For providing information about new features, updates, and related services of the Service (including the Company’s advertising and promotional emails)
• For detection, investigation, and response to Users who violate the Terms of Service or to unauthorized use
• For the creation of statistical data (after processing into a form from which no specific individual can be identified) and use thereof for improvement of the Service and development of new services
• For evidencing the fact of consent to the Terms of Service and the like
• For the operation of the referral program (measurement of referral results and calculation of rewards)
• For the operation of the Server Board (including disclosure to the general public of information of Discord servers registered on the Server Board and provision thereof through search engines and APIs)
• For the operation of the Command Market (including display of Published Commands and publisher display names to other Users)
• For responding to claims of rights infringement from third parties and for disclosure of sender information under laws and regulations
• For responses to laws and regulations, court orders, or requests from administrative agencies and the like
• For purposes incidental to the foregoing purposes of use

Advertising and promotional emails are sent only where the User has consented in advance to such sending by the method prescribed by the Company, and the Company retains records of such consent pursuant to the Act on Specified Commercial Transactions and the Act on Regulation of Transmission of Specified Electronic Mail. Users may at any time withdraw such consent and stop receiving advertising and promotional emails through the settings screen within the Service, the inquiry contact, or the procedures provided within the distributed emails.

Chapter 6. Provision to Third Parties

Article 1 (Restriction on Provision to Third Parties)

The Company shall not provide personal information to third parties without obtaining the prior consent of Users, except where any of the following applies.

• Where required by laws and regulations
• Where necessary for the protection of human life, body, or property, and obtaining the consent of the person is difficult
• Where particularly necessary for improving public health or promoting the sound development of children, and obtaining the consent of the person is difficult
• Where it is necessary to cooperate with a national or local government agency or a person entrusted by such agency in carrying out matters prescribed by laws, and obtaining the consent of the person may impede the performance of such matters
• Where personal data is provided in connection with the Company’s business succession (merger, corporate division, business transfer, and the like) (where the transferee falls under a third party located in a foreign country, the provision of personal data shall be governed by Chapter 8 and Chapter 15, Article 2, Paragraph 2)

Article 2 (Provision to Outsourcing Parties)

The Company may outsource all or part of the handling of personal data to outsourcing parties within the scope necessary for achieving the purpose of use. Provision to outsourcing parties does not constitute provision to third parties under the APPI. For details of outsourcing parties, please refer to Chapter 7 and Chapter 8.

Chapter 7. Outsourcing Parties

Article 1 (List of Outsourcing Parties)

The Company outsources the handling of personal data to the following entities for the provision of the Service.

Outsourcing parties may change as necessary for the operation of the Service. In the event of a material change, the Company will give notice by revising this Policy.

Article 2 (Supervision of Outsourcing Parties)

The Company exercises necessary and appropriate supervision over outsourcing parties, through contracts and other appropriate methods, to ensure that they manage personal data safely.

Article 3 (Regarding Technical Infrastructure)

1. The Company operates its database infrastructure and the Bot execution environment under its own control on the server infrastructure listed in the table in Article 1 of this Chapter (XServer Inc. and Contabo GmbH). The Company does not ask these operators to perform any work that involves using the content of personal data. However, because these operators manage the server facilities, they may come into contact with the data on the Company’s servers; for example, they may copy such data in order to deal with equipment failures or other incidents, or may be technically able to view such data. For this reason, the Company treats these operators as outsourcing parties for the handling of personal data and supervises them in accordance with Article 2 of this Chapter.
2. The Bot execution environment and the database infrastructure of the Service run on servers located in Japan (Tokyo). Backups of the database and of the file storage (meaning the area in which files uploaded by Users, such as images, are stored; the same applies hereinafter) are encrypted with keys managed by the Company and stored in the object storage of Cloudflare, Inc. The storage region is the Asia-Pacific region; because Cloudflare does not disclose the country within that region, the Company cannot identify the country in which the backups are stored. If the Company adds servers located outside Japan as the Bot execution environment or the database infrastructure, the Company will revise this Paragraph and give notice in accordance with the provisions of Chapter 15.

Article 4 (Linked Platform)

The Service operates on the Discord platform operated by Discord, Inc. (United States). Discord is not an outsourcing party of the Company, but a platform used based on the agreement between the User and Discord. The Company obtains Discord account information from Discord based on the User’s OAuth authorization (Chapter 3, Article 3), and sends messages on Discord in accordance with the User’s Bot settings. The handling of data on Discord is governed by Discord’s privacy policy. Information sent on Discord based on the User’s Bot settings is treated as provision based on the User’s instructions and consent.

Article 5 (Transmission to Destinations Designated by Users)

1. Custom commands and the like of the Service include a function to send data to external Web APIs, webhooks, or other destinations designated by the User in the Bot Logic (as defined in Chapter 5, Article 4, Paragraph 1 of the Terms of Service) (the “User-Designated Destinations”). Information sent to User-Designated Destinations in accordance with the Bot Logic (which may include information concerning Discord End Users) is treated as provision based on the User’s instructions.
2. The Company is not involved in the selection of User-Designated Destinations or the determination of the scope of information to be sent. The handling of information at User-Designated Destinations is governed by the terms and privacy policies of the operators of such destinations.
3. Where a User sends information concerning Discord End Users to a User-Designated Destination, the User shall itself ensure the lawfulness of such transmission (including satisfaction of the requirements of Article 28 of the APPI where the User-Designated Destination is located in a foreign country) pursuant to Chapter 5, Article 4 and Article 7, Paragraph 1 of the same Chapter of the Terms of Service.

Chapter 8. Provision of Personal Data to Third Parties Located in Foreign Countries

Article 1 (Consent to Cross-Border Transfers)

As stated in Chapter 7, the Company’s outsourcing parties include entities located in foreign countries. By using the Service and agreeing to this Policy, Users consent to the Company’s provision of personal data to third parties located in the following countries. The consent under this Article relates to the User’s own personal data. The provision of personal data of Discord End Users to third parties located in foreign countries is governed by Chapter 9-2, Article 5. Listing Information on the Server Board is governed by Article 10 of the same Chapter.

Article 2 (Countries of Destination and Personal Information Protection Systems Therein)

Article 3 (Ensuring Compliant Frameworks)

In providing personal data to third parties located in foreign countries, the Company ensures, through contracts with such third parties or by other methods, that measures equivalent to the safety management measures under the APPI and other applicable laws and regulations are implemented. The Company continuously confirms the status of implementation of such measures and, upon the request of the person concerned, provides the information prescribed in Article 28, Paragraph 3 of the APPI.

Chapter 9. Handling of Personal Data in the AI Features (BotShader and the AI Response Feature)

Article 1 (Overview of BotShader)

“BotShader” is an AI assistant feature, including AI chat functionality, provided within the Service. When a User uses BotShader, the prompts, contextual information, reference materials, and the like voluntarily input by the User (the AI Input Data) are sent to third-party AI providers selected by the Company.

Article 2 (AI Providers and Their Locations)

The Company outsources the inference processing of BotShader and the AI Response Feature to the following AI providers. The parties to which the Company provides AI Input Data are limited to the providers listed below.

Article 3 (AI Models Used)

On each AI provider’s infrastructure, multiple AI models are used depending on the purpose. These models include those whose developers are entities located outside Japan (in the United States, the People’s Republic of China, and the like). As specific examples, on DeepInfra the Company uses certain models developed by DeepSeek (DeepSeek Inc., People’s Republic of China) and Kimi (Moonshot AI, People’s Republic of China). On OpenAI the Company uses the GPT series, and on Anthropic the Claude series.

However, the parties to which the Company provides AI Input Data are limited to the AI providers prescribed in the preceding Article, and the Company does not provide AI Input Data directly to the entities that develop the models. The location of the infrastructure used by each AI provider to execute inference is determined by such provider and is not designated by the Company. The Company has established, through its agreements with each AI provider, a system conforming to the standards prescribed in Article 28, Paragraph 1 of the APPI.

The AI models used and the allocation among them may change from time to time in light of improvements to the features of the Service, the availability of models, the balance of performance and cost, and the like.

Article 4 (Scope of Use of AI Input Data)

1. The Company and each AI provider shall not use AI Input Data beyond the scope necessary for the processing requested by the User (such as response generation). The foregoing shall not apply where an AI provider handles AI Input Data, based on the terms of use it establishes (terms of service, usage policies, and the like), to the extent necessary for the detection and prevention of unauthorized use, for the enforcement of such terms of use, or for responding to laws and regulations, court orders, or requests from administrative agencies and the like.
2. The Company and each AI provider shall not use AI Input Data as training data for any AI model of the Company or any third party. The Company selects, as AI providers, entities that expressly state a policy of not using inputs submitted via API for training.
3. Conversation history that a User has on BotShader is stored on the Company’s servers for the purpose of allowing the User to refer to, search, and delete it again. Users may delete their own conversation history through operations on the dashboard. Where a User has enabled the Agent Workspace feature (as defined in Chapter 9-2, Article 2), messages posted in the relevant channel and the AI’s responses are stored on the Company’s servers for the provision of such feature until the User deletes the relevant workspace. Merely closing the workspace does not erase the records.
4. Each AI provider does not use inference data for training purposes or store it for a long period. However, providers may temporarily retain processing data as a short-term cache or short-term retention for the purpose of optimizing inference performance (such as fast response to identical or similar requests) or for anti-abuse purposes (such as short-term retention for the detection of, and subsequent response to, unauthorized use). In addition, where retention is required by laws and regulations, court orders, or requests from administrative agencies and the like, or where an AI provider determines that there is a suspicion of a violation of the terms of use it establishes, processing data may be retained for the period prescribed by such AI provider.

Article 5 (User Responsibility)

Users are requested not to include the following information in AI Input Data.

• Personal information of third parties, confidential information, intellectual property rights, or other information that may affect the rights or interests of third parties
• Sensitive personal information
• Information whose handling is restricted by laws and regulations

If a User includes any of the foregoing information in AI Input Data, the responsibility for the handling of such information shall be borne by the User. The Company’s liability shall be governed by the provisions of Chapter 10 of the Terms of Service.

Chapter 9-2. Personal Information of Discord End Users

Article 1 (Scope of Application of This Chapter)

This Chapter provides for the handling of personal information of Discord users who interact with a Discord Bot operated by a User through the Service on a Discord server into which such Bot has been introduced (the “Discord End Users”).

Article 2 (Information Collected)

The Company collects the following information concerning Discord End Users in connection with the operation of a User’s Bot.

• Discord user ID, username, display name, avatar image
• Commands sent to the Bot and their arguments (excluding those processed as input to the AI Response Feature)
• Where the AI Response Feature (as defined in Chapter 7, Article 3, Paragraph 4 of the Terms of Service) is enabled, the body of messages processed by such feature (including those input as arguments of commands. Such bodies are processed temporarily for the generation of responses and temporarily retained, up to the most recent 20 messages, for 30 minutes from the last utterance in order to maintain the conversational context, after which they are erased without further use, and are not permanently stored on the Company’s servers. The foregoing does not apply to those pertaining to the Agent Workspace feature in the following item)
• Where the Agent Workspace feature among the AI Response Feature (meaning a feature in which an AI continuously converses with participants in a Discord channel enabled by the User) is enabled, then notwithstanding the preceding item, the body of messages posted in such channel, the Discord user ID of the poster, the date and time of posting, and the AI’s responses (such information is stored on the Company’s servers for the provision of such feature until the User operating the relevant Bot deletes the relevant workspace. Even where a poster is a User of the Service, such information is not erased by reason of that poster’s own withdrawal)
• Where the ticket feature is enabled, the transcript generated when a ticket is closed (including the body of messages posted in the relevant ticket channel, the Discord user ID and display name of the poster, and the date and time of posting. Such transcript is processed temporarily in memory for the purpose of sending it to the Discord channel designated by the User (the log channel) and is not stored on the Company’s servers. If no log channel is designated, no transcript is generated)
• Logs concerning the operation of the Bot (the date and time of execution of responses, results, and the like)
• Information stored in association with a Discord user ID in connection with the operation of modules enabled by the User (leveling, economy system, and the like) or commands configured by the User (cumulative message counts, experience points, balances and transaction records in the economy system, role assignment history, values of Bot variables stored on a per-user basis, and the like)

Article 3 (Capacity in Which Information Is Collected)

1. The Company handles the information in the preceding Article, in principle, as a party entrusted with such handling by the User (Chapter 5, Article 7, Paragraph 1 of the Terms of Service). In such case, the responsibility as a personal information handling business operator for the collection of such information, the specification of the purpose of use, the decision on provision to third parties, and the response to requests from Discord End Users is borne by the User operating the relevant Bot, and the Company bears, as an entrusted party, the obligations imposed on an entrusted party under the APPI, including safety management measures and supervision of employees and sub-outsourcing parties.
2. Where the User does not fall under a personal information handling business operator under the APPI, or where the entrustment relationship in the preceding Paragraph is otherwise not established, the Company handles such information as a personal information handling business operator in its own right, in accordance with the provisions of this Policy.

Article 4 (Purpose of Use)

The Company uses the information in Article 2 within the scope of the following purposes.

• For the operation of the User’s Bot (responses to commands, automatic responses, ticket handling, and the like)
• For the generation of responses in the AI Response Feature
• For the investigation of and recovery from failures, and for the detection of and response to unauthorized use
• For responses to laws and regulations, court orders, or requests from administrative agencies and the like

Article 5 (Transmission to AI Providers)

Where the AI Response Feature is enabled, among the information in Article 2, the content processed by such feature is sent, to the extent necessary for the generation of responses, to the AI providers prescribed in Chapter 9, Article 2 (all of which are located in the United States). Such transmission is made, in the case of Article 3, Paragraph 1, as sub-outsourcing based on the User’s consent under Chapter 7, Article 3, Paragraph 5 of the Terms of Service, and, in the case of Article 3, Paragraph 2, as outsourcing by the Company. The provision of personal data to third parties located in foreign countries involved in such transmission is made on the basis that the Company has established, through contracts with each AI provider, a framework conforming to the standards prescribed in Article 28, Paragraph 1 of the APPI. Upon the request of the Discord End User concerned, the Company provides the information prescribed in Paragraph 3 of the same Article. Each AI provider does not use the transmitted information as training data for AI models. Chapter 9, Article 4, Paragraph 4 applies mutatis mutandis to the information transmitted under this Article. The location of the infrastructure used by each AI provider to perform inference is as set out in Chapter 9, Article 3.

Article 6 (Retention Period)

The information in Article 2 (excluding the body of messages processed by the AI Response Feature as prescribed in the same Article) is stored during the period the User uses the Service and is erased upon the User’s withdrawal or cancellation of registration in accordance with Chapter 4, Article 3 of the Terms of Service. Logs are governed by the retention periods prescribed in Chapter 10, Article 1.

Article 7 (Requests from Discord End Users)

1. Discord End Users may make requests for disclosure, correction, suspension of use, deletion, or otherwise with respect to their own personal information, addressed to the inquiry contact in Chapter 16.
2. Where the Company handles such information as an entrusted party pursuant to Article 3, Paragraph 1, the Company will forward such request to the User operating the relevant Bot and respond in accordance with the User’s instructions. However, where the Company is required by laws and regulations to respond directly, or where the Company handles the information as a personal information handling business operator in its own right pursuant to Article 3, Paragraph 2, the Company will respond directly.
3. The Company will respond after confirming that the requester is the person concerned.

Article 8 (Notification by Bot Operators)

Pursuant to Chapter 7, Article 3, Paragraph 6 of the Terms of Service, where a User enables the AI Response Feature, the User bears the obligation to notify Discord End Users, on the Discord server into which the relevant Bot has been introduced, that the Bot’s responses are generated by AI and that the messages of Discord End Users are sent to external AI providers for the generation of responses. The Company is not in a position to confirm the implementation of such notification on individual Discord servers.

Article 9 (Sensitive Personal Information)

The Company does not intend to obtain sensitive personal information of Discord End Users and, even where the information in Article 2 includes sensitive personal information, the Company does not use it as sensitive personal information.

Article 10 (Registrants on the Server Board)

1. Notwithstanding Article 3, Paragraph 1, Article 4, and Article 6, the Listing Information obtained by the Company in connection with registration on the Server Board (as defined in Chapter 5, Article 8 of the Terms of Service) (meaning the information prescribed in Paragraph 1 of the same Article, including the items listed in Chapter 3, Article 1), as well as the records of registration, update, and bump operations (meaning the items listed in Chapter 3, Article 2), are handled by the Company as a personal information handling business operator in its own right, within the scope of the purposes of use in Chapter 5 and in accordance with the provisions of this Policy. The same applies where the registrant (meaning the person prescribed in Chapter 5, Article 8, Paragraph 2 of the Terms of Service) is not a User of the Service.
2. Listing Information is disclosed to the general public and provided to third parties through search engines and APIs upon the registrant’s agreement to the listing conditions displayed at the time of registration. The Company discloses Listing Information through the hosting and content delivery outsourcing parties prescribed in Chapter 7, Article 1. Where such outsourcing parties are located in foreign countries, the handling thereof is governed by Chapter 8, Article 3.
3. Notwithstanding Chapter 10, Article 1, Listing Information is retained until the earlier of the time the registrant deletes the Listing Information or the time the Company deletes the Listing Information (including, in addition to cases based on Chapter 5, Article 8, Paragraph 4 of the Terms of Service, cases accompanying the withdrawal or cancellation of registration of the User that has introduced the Bot (meaning the User’s Bot under Chapter 5, Article 8, Paragraph 1 of the Terms of Service) into the Discord server pertaining to the Listing Information, or the deletion of such Bot). Where the registrant makes the listing private, or where the Company suspends the listing pursuant to Chapter 5, Article 8, Paragraph 4 of the Terms of Service, the Listing Information is not disclosed to the public but is retained until it is deleted. The retention period of the records of registration, update, and bump operations shall not exceed the longer of the retention period of the Listing Information or the retention period of operation logs prescribed in Chapter 10, Article 1.
4. Registrants may make requests for disclosure, correction, suspension of use, deletion, or otherwise with respect to Listing Information and the records of registration, update, and bump operations, in accordance with Article 7, Paragraph 1. In such case, the forwarding under Article 7, Paragraph 2 is not performed, and the Company responds directly.

Chapter 10. Retention Period and Deletion of Personal Data

Article 1 (Retention Period)

The Company retains personal data only for the period necessary to achieve the purpose of use. Approximate retention periods for specific items are as follows.

• Account information (email address, authentication information, Discord integration information, and the like): During the period the User uses the Service
• Records of devices used for login (IP address, browser information, and the like): 12 months from the record
• Information on provisional accounts for which full registration has not been completed: 30 days from creation
• Email links for login: Deleted after the expiration of their validity period
• User Content such as Bot settings, commands, and response templates: During the period the User uses the Service
• Conversation history of BotShader: During the period the User uses the Service (deletable by the User)
• Access logs and request logs accumulated on Vercel: Within 30 days from acquisition
• Operation logs, error logs, Bot operation logs (those listed in Chapter 3, Article 2 and Chapter 9-2, Article 2), and the like accumulated on the Company’s operational servers: In principle, within 12 months from acquisition
• Audit logs of administrative operations (including records of collegial decision-making), records of use restrictions and dispositions (including identifiers to the extent necessary to prevent re-registration by Users subject to such measures), records concerning responses to claims of rights infringement and to disputes, and records of inquiry and support responses: 3 years from creation (records of use restrictions and dispositions: 3 years from the termination of the effect of the relevant measure; records concerning claims of rights infringement: 3 years from the completion of the response)
• Information concerning Discord End Users (Chapter 9-2, excluding the logs concerning the operation of the Bot prescribed in Article 2 of the same Chapter): During the period the User operating the relevant Bot uses the Service (erased 14 days after such User’s withdrawal or cancellation of registration. The body of messages processed by the AI Response Feature (including those input as arguments of commands) is temporarily retained, up to the most recent 20 messages, for 30 minutes from the last utterance in order to maintain the conversational context, and is thereafter erased without further use. Those pertaining to the Agent Workspace feature are excluded)
• Conversation records of the Agent Workspace feature (Chapter 9-2, Article 2): Until the User operating the relevant Bot deletes the relevant workspace (erased 14 days after the withdrawal or cancellation of registration of the User operating the relevant Bot)
• Transcripts of the ticket feature: Processed only temporarily in memory for sending to the log channel designated by the User; not stored
• The Company’s disaster recovery backups: Automatically erased by generational rotation within a maximum of 400 days from acquisition (backups taken every 6 hours: 3 days; daily: 35 days; monthly: 400 days)
• Records of consent: After withdrawal or cancellation of registration, for the period necessary to resolve disputes concerning such consent (in principle, 5 years)
• Records of consent to the sending of advertising and promotional emails: From the date on which an advertising or promotional email was last sent, for the period prescribed by the Act on Specified Commercial Transactions, the Act on Regulation of Transmission of Specified Electronic Mail, and related laws and regulations
• Payment-related information (records concerning payments and the payment of referral rewards): After the completion of payment, for the period prescribed by tax law and other applicable laws and regulations (in principle, 7 years)
• Records concerning unperformed refunds and other monetary obligations: Until such obligation is performed or extinguished

Article 2 (Deletion after Withdrawal)

When a User withdraws from the Service, the Company shall completely erase such User’s account information, registered Bot Tokens, configuration data, and User Content after the lapse of a 14-day grace period from the date of withdrawal, in accordance with Chapter 4, Article 3 of the Terms of Service. The foregoing shall not apply to information whose retention is required by laws and regulations, information necessary for handling disputes, or information remaining in backups.

Chapter 11. Safety Management Measures

The Company shall take necessary and appropriate measures for the safety management of personal data, including prevention of leakage, loss, or damage. An overview of specific measures is as follows.

• Organizational safety management measures: Establishment of a manager responsible for the handling of personal data; establishment of systems for inspection and audit of the status of handling of personal data
• Personnel safety management measures: Training of officers and employees regarding the handling of personal data; thorough enforcement of confidentiality obligations
• Physical safety management measures: Management of areas where personal data is handled; prevention of theft or loss of equipment, electronic media, documents, and the like
• Technical safety management measures: Access control for personal data; adoption of passwordless authentication using WebAuthn / FIDO2 passkeys; encryption of communications (TLS); encrypted storage (AES-256-GCM) of Bot Tokens and of secret information stored in the per-Bot environment variables; prevention of unauthorized access; response to vulnerabilities; acquisition and monitoring of logs
• Understanding of the external environment: The Company handles personal data in the United States, the Federal Republic of Germany, and the Republic of Ireland, and implements necessary and appropriate measures for safety management after understanding the personal information protection systems of each such country. Backups of the database and of the file storage are stored in the Asia-Pacific region, and because the country of storage cannot be identified as set out in Chapter 7, Article 3, Paragraph 2, the Company encrypts them with keys it manages so that the outsourcing party cannot restore their contents. In addition, as set out in Chapter 9, Article 3, the location of the infrastructure used by the AI providers to perform inference is determined by those providers and cannot be identified by the Company

For more detailed inquiries regarding the specific content of safety management measures, please contact the inquiry contact in Chapter 16.

Chapter 12. Cookies and Similar Technologies

Article 1 (Use of Cookies)

The Service may use Cookies and similar technologies for the purpose of enhancing user convenience, maintaining authentication, analyzing usage, improving the Service, and the like.

Article 2 (Information Transmitted Externally)

The Company’s website and the Service use the services of the following entities, and upon your use, information is transmitted from your device to such entities.

With respect to Google Analytics, the Company has entered into a data processing agreement with Google and treats Google as an outsourcing party of the Company. The Company does not use Google Signals or advertising features. The use of analytics Cookies can be selected in the Cookie consent banner shown on your first visit and can be changed at any time from “Cookie settings” in the footer. If you change the setting to disable analytics Cookies, the cessation of measurement will take effect from the next page load onward. If “Necessary only” is selected, Google Analytics is not loaded. For information on how data is collected and processed, please refer to Google’s Privacy Policy.

Article 3 (Disabling Cookies)

Users may disable Cookies by changing the settings of their web browsers. However, if Cookies are disabled, some features of the Service (such as maintaining login state) may not be available.

Chapter 13. Requests for Disclosure, Correction, Deletion, etc. of Personal Information

Article 1 (Right to Request Disclosure, etc.)

1. Users may, based on the APPI, request notification of the purpose of use, disclosure (including disclosure of records of third-party provision), correction, addition, deletion, suspension of use, and suspension of third-party provision (collectively, “Disclosure, etc.”) of their own personal data held by the Company.
2. Users may, at any time, withdraw consent that they have provided to the Company under this Policy or through a separate procedure. Withdrawal of consent takes effect only prospectively and does not affect the lawfulness of any handling of personal data carried out before the withdrawal.

Article 2 (Method of Request)

1. Requests for Disclosure, etc. should be directed to the inquiry contact in Chapter 16. The Company will respond without delay in accordance with the APPI and other applicable laws and regulations, after confirming that the requester is the person concerned.
2. When making a request for disclosure, Users may designate the method of disclosure (delivery of a document, provision of an electromagnetic record, and the like). The Company will make the disclosure by the designated method, except where excessive costs would be required or where there is another reasonable ground.
3. In the case of a request made by an agent, the Company will, in addition to confirming the identity of the person concerned, confirm the authority of representation by a document evidencing such authority (a power of attorney, a document showing status as a statutory representative, and the like).
4. The Company will, in principle, respond to requests for Disclosure, etc. within 30 days from the date of receipt of the request. Where the content of the request is complex or where there is another reasonable ground, the Company may extend the response deadline, in which case the Company will notify the User of the extension of the response deadline and the reason therefor.
5. With respect to personal data contained in the Company’s disaster recovery backups, even after the data has been erased from the live systems in response to a request for deletion or suspension of use, it may be technically impossible to erase such data during the protection period intended to prevent tampering with the backups. In such case, as an alternative measure under Article 35, Paragraph 3 of the APPI, the Company will not use such backups for any purpose other than recovery, will limit the persons who may access them, and, if a restoration from a backup is performed, will erase such personal data again after the restoration. Such backups are automatically erased within a maximum of 400 days from acquisition, as prescribed in Chapter 10, Article 1.

Article 3 (Fees)

No fee is charged for requests for Disclosure, etc.

Article 4 (Non-Response to Requests)

The Company may decline to respond, in whole or in part, to a request for Disclosure, etc. where any of the following applies. In such case, the Company will notify the requester of that fact and the reason therefor without delay.

• Where there is a risk of harm to the life, body, property, or other rights or interests of the person concerned or a third party
• Where there is a risk of significant impediment to the proper execution of the Company’s business
• Where it would result in a violation of laws and regulations

Article 5 (Response in the Event of a Leakage or the Like)

Where a leakage, loss, or damage of personal data has occurred or is likely to have occurred, and such situation carries a significant risk of harm to the rights and interests of individuals, the Company will report to the Personal Information Protection Commission in accordance with the APPI and will inform the person concerned of the facts, the cause, measures to prevent secondary damage, and the like, by notice to the registered email address or by posting within the Service. With respect to personal data of Discord End Users, the Company will provide such information through the User that is the entrusting party, or by a method the Company deems appropriate.

Chapter 14. Personal Information of Minors

Article 1 (Use by Minors)

As provided in Chapter 2, Article 3 of the Terms of Service, the Service is not intended for use by persons under 13 years of age. Minors who are 13 years of age or older but under 18 years of age shall obtain the prior consent of their statutory representative (a person with parental authority or the like) before using the Service and providing personal information.

Article 2 (When Collection of Personal Information from a Minor Is Discovered)

If it becomes apparent that the Company has collected personal information from a User under 13 years of age, the Company will take measures to promptly delete such personal information.

Chapter 15. Changes to the Privacy Policy

Article 1 (Minor Changes)

With respect to changes that benefit users, or minor changes (including correction of typographical errors, clarification of expressions, changes of names accompanying organizational changes, and additions or changes of outsourcing parties (limited to those not involving provision to a new third party located in a foreign country)), the Company may cause such changes to take effect by giving notice within the Service or on its website.

Article 2 (Material Changes)

1. Where the Company makes a change that may materially affect the rights or interests of Users, such as a change to the items of information collected, the purpose of use, provision to third parties, or provision to third parties located in foreign countries (a “Material Change”), the Company will notify Users of the content of the change and its effective date, at least 30 days prior to the effective date, within the Service, by email to the registered email address, on its website, or by another appropriate method.
2. With respect to changes for which the express consent of Users is required under applicable laws and regulations, such as changes beyond the scope having relevance to the purpose of use, new provision to third parties, or new provision to third parties located in foreign countries, the Company shall obtain the express consent of such Users by the effective date, and the content of the change shall not apply to Users who do not consent.
3. With respect to Material Changes not falling under the preceding Paragraph, the Company will obtain the express consent of Users as necessary.

Article 3 (Disagreement with Changes)

If a User does not agree with the content of a Material Change, the User may cease using the Service and withdraw by the effective date. A User who continues to use the Service after the effective date shall be deemed to have agreed to the Material Change. However, the content of a change requiring express consent as prescribed in Paragraph 2 of the preceding Article shall not apply to Users who do not consent thereto.

Chapter 16. Contact and Complaints

Article 1 (Inquiry Contact)

For inquiries regarding this Policy or the handling of personal information, requests for Disclosure, etc., opinions, or complaints, please contact the following.

• Email address: help@botshade.com

Article 2 (Complaints to the Personal Information Protection Commission)

Users may also file complaints regarding the Company’s handling of personal information with the Personal Information Protection Commission. For details, please refer to the website of the Personal Information Protection Commission (https://www.ppc.go.jp/).