Privacy Policy

This Privacy Policy (this “Policy”) explains how ZEONE Inc. (“ZEONE,” “we,” or “us”) handles personal information and personal data in ShopIndex (the “Service”). In this Policy, “you” means a user of the Service, and “customers” means the customers of your store. Unless otherwise defined in this Policy, capitalized terms have the meanings given in the ShopIndex Terms of Service (the “Terms”).

1. Company information

• Company name: ZEONE Inc.
• Address: 1-7-503 Mihama, Urayasu City, Chiba 279-0011, Japan
• Representative: Taijiro Iino
• Contact: info@zeone.co.jp

2. Information we collect

(1) Information you provide when you register an account

Your email address and password.

(2) Information you enter when using the Service

What you enter in chats and the Output generated from it. This information may include personal information to the extent you enter it.

(3) Payment information

The Service is provided free of charge, and we do not collect payment information.

(4) Information collected from Connected Services

If you connect Shopify or another Connected Service to the Service, we collect, to the extent you authorize, information about orders (order number, date and time, payment and fulfillment status, and amount) and products, as well as basic information about your store. We do not collect customers’ names, contact details, or other information that directly identifies customers. For how we handle information about your store’s customers (Customer Data), see “5. How we handle Customer Data” below.

(5) Information collected automatically when you use the Service

IP address, cookies, device identifiers, browser type and version, operating system, language settings, referring URL, pages viewed, date and time of access, login history, and feature usage history.

(6) Information collected about External Sites

To analyze Registered Stores and External Sites, we collect information from publicly available websites. This is generally information about businesses, and we do not collect it for the purpose of obtaining personal information.

(7) When you must provide information

To register an account, you must provide the items marked as required on the registration screen. If you do not provide them, we cannot register your account or provide the Service to you. Connecting Connected Services as described in (4) above is optional. You can use the Service without connecting, although some features may not be available.

3. How we use information

We use the personal information we collect for the following purposes:

• Account registration, identity verification, and login authentication
• Providing the Service, including answering chats, analysis, and creating deliverables
• Sending important notices about the Service
• Export control and sanctions screening, and determining the countries and regions where the Service is available (including determinations based on the IP address you access from)
• Responding to inquiries and providing support
• Preventing misuse, investigating use that violates the Terms, and maintaining security
• Improving the Service (including creating statistical data processed so that individuals cannot be identified)
• Sending information about new features, updates, campaigns, and similar news

We do not use what you enter in chats, Output, Store Context, or Integration Data to train AI models. Our personnel view this information only when necessary to provide the Service, such as to respond to inquiries, investigate problems, or prevent misuse.

You can stop receiving marketing emails about new features, updates, and campaigns at any time by using the unsubscribe link in the email or another method we specify.

4. Data we send to AI Model Providers

1. The Service uses AI models from AI Model Providers to generate Output. For this reason, we send what you enter in chats, Integration Data, and other information needed to generate Output to AI Model Providers. Any personal information you include in chats is sent to AI Model Providers as is.

2. Our contracts with AI Model Providers do not allow them to use the information we send to train AI models. To keep your chat history, the information we send is also stored by AI Model Providers until you delete the chat (or, if you delete your account, until the period set out in the Terms has passed). AI Model Providers may also store it for the period they specify (currently up to 30 days) to monitor for misuse, and then delete it.

3. We send Customer Data only after aggregating or otherwise processing it to the extent necessary to generate Output, and we do not send information that directly identifies customers.

4. The names and countries of AI Model Providers are listed in “7. Service providers” and “8. International transfers” below.

5. How we handle Customer Data

1. When you connect a Connected Service, we handle the information we collect about your store’s customers (Customer Data) on your behalf, as a service provider entrusted by you (the store operator) under the Act on the Protection of Personal Information of Japan (the “APPI”). The terms for how we handle Customer Data for you are set out in the Terms and in our separately published Data Processing Agreement (DPA).

2. We use Customer Data only to provide the Service to you and do not use it for our own purposes (including our own advertising and marketing, or providing services to other Users). We do not sell Customer Data.

3. In the following cases, we delete the relevant Customer Data within 30 days (excluding Customer Data contained in your chat history and Output).

• You disconnect the Service from a Connected Service or uninstall the Service on the Connected Service
• You close your account for the Service
• We receive a request through a Connected Service to delete data about a customer or a store

4. If a customer of a store wants to request disclosure, correction, deletion, or other action regarding their personal information, please contact the operator of that store. We will assist the store operator at its request. If a customer contacts us directly, we will forward the request to the store operator. Because we do not hold customers’ names or contact details, we may not be able to identify the customer.

6. Sharing with third parties

We do not disclose personal data to third parties without the individual’s prior consent, except in the following cases. We do not sell personal data.

• When required by law
• When necessary to protect a person’s life, body, or property, and it is difficult to obtain the individual’s consent
• When especially necessary for improving public hygiene or promoting the sound growth of children, and it is difficult to obtain the individual’s consent
• When necessary to cooperate with a national government agency, a local government, or a party entrusted by either of them in performing duties prescribed by law, and obtaining the individual’s consent is likely to interfere with those duties
• When personal data is provided as part of the succession of a business due to a merger, company split, business transfer, or other reason

7. Service providers

We may entrust all or part of the handling of personal data to outside service providers to the extent necessary to achieve the purposes of use. In that case, we enter into the contracts required by law with those service providers and supervise them as necessary and appropriate.

8. International transfers

We are located in Japan, and personal data is processed in Japan and the United States. As a result of the entrustment and other arrangements described in 7. above, we may transfer personal data to third parties outside Japan.

When we provide personal data to a third party in a foreign country, we ensure, under Article 28, Paragraph 1 of the APPI and through contracts or other means with that third party, that the third party has established a system that conforms to the standards prescribed by the rules of the Personal Information Protection Commission (PPC). In addition, under Paragraph 3 of the same Article, we take the measures necessary to ensure that the third party continuously implements equivalent measures, and we provide information about those necessary measures at the individual’s request. Our main current recipients, their countries, and the measures we take are as follows.

Google Cloud Japan G.K., our server and database provider, is a corporation located in Japan and is therefore not listed in the table above.

For details on the personal information protection systems of each country, see the PPC website (https://www.ppc.go.jp/).

9. Cookies and similar technologies

1. The Service uses only the minimum necessary cookies and similar technologies (such as browser storage) to keep you logged in, provide the Service, and maintain security.

2. We currently do not use non-essential cookies for analytics, behavioral advertising, or other purposes.

3. If we introduce analytics tools or other non-essential cookies in the future, we will update this Policy and publish the name of each tool, its provider, its purpose, and how to disable it. Where consent is required by law, we will obtain your consent before setting them.

4. You can refuse cookies through your browser settings. However, if you do, you may not be able to log in or use some features of the Service.

10. External transmission of user information

Article 27-12 of the Telecommunications Business Act requires that, when information stored on a user’s device is sent to an external party, the recipient and the content of the information sent be made public. External transmissions in the Service are as follows.

11. Security control measures

We take the following measures to prevent leaks, loss, or damage of personal data and otherwise keep it secure.

12. Retention periods

• Account information, chat history, and Output: Kept until you delete it. If you delete your account, it is deleted after the period set out in the Terms.
• Integration Data (including Customer Data): Deleted within 30 days after you disconnect, uninstall, or close your account. However, chat history and Output that use Integration Data are not deleted when you disconnect or uninstall. To have them deleted, contact us using the details in 14. below.
• Inquiry records: As long as necessary to respond to the inquiry
• Access logs: As long as necessary to maintain security

Even within the retention period, we promptly delete information that is no longer needed for the purposes of use. After the retention period ends, we delete the information without delay or process it so that it cannot be restored. Copies remaining in backups are erased within a reasonable time after that.

13. Your rights

1. You may, under the APPI, request that we notify you of the purposes of use of your retained personal data, disclose it, correct, add to, or delete its content, stop using or erase it, stop providing it to third parties, and disclose records of its provision to third parties.

2. Output from the Service is generated by AI, but we do not make decisions based solely on automated processing that have legal effects or similarly significant effects on individuals.

3. From the settings screen of the Service, you can view your account information and disconnect Connected Services. Other requests, such as deleting chat history, deleting your account, or exporting your data (Section 13 of the Terms), can be made through the contact point in 14. below.

4. To exercise your rights, please contact us using the details in “14. Contact us” below. We will respond without delay and in accordance with the law, after completing our procedures and verifying your identity. We will provide disclosure by electronic means or another method you specify, unless that method is difficult to use.

5. Requests to exercise your rights are free of charge. We will not decline a request except as permitted by law.

14. Contact us

For questions about this Policy or how we handle personal information, please contact us at:

• ZEONE Inc., Privacy Inquiries
• Address: 1-7-503 Mihama, Urayasu City, Chiba 279-0011, Japan
• Email: info@zeone.co.jp
• Hours: Weekdays 10:00–17:00 JST (UTC+9; excluding weekends, Japanese national holidays, the year-end and New Year holidays, and other days we are closed)

15. Supervisory authorities

If you have a complaint about how we handle personal data, you can file it with the following authority.

• Japan: Personal Information Protection Commission (https://www.ppc.go.jp/)
• Other countries and regions: See 16. below.

16. Residents of other countries and regions

1. We provide the means described in this Policy for exercising your rights, such as disclosure, correction, deletion, and export, to all users in the same way, regardless of the country or region where they live. If the laws of your country or region grant broader rights than this Policy, we will follow those laws.

2. United States: Some U.S. state laws give state residents rights to access, correct, delete, and port their personal information, and to opt out of its sale or sharing. We do not sell personal information or share it for behavioral advertising.

3. Other countries and regions: Residents of Canada (Personal Information Protection and Electronic Documents Act), Australia (Privacy Act), Brazil (General Data Protection Law), South Korea (Personal Information Protection Act), and other countries and regions may have rights under the laws of their country or region, including the rights to access, correct, and delete personal information, to restrict its processing, to data portability, to withdraw consent, and to lodge a complaint. We accept requests to exercise these rights in accordance with the deadlines and procedures set by those laws (or, where the laws do not set them, in line with 13. above). This Policy does not affect your right to file a complaint with the supervisory authority in your country or region.

4. To make a request under this section, please contact us at the contact point in 14. above.

17. Children’s personal information

The Service is provided for businesses and is not intended for use by anyone under 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected such information, we will delete it promptly.

18. Data breaches

If a leak, loss, or damage of personal data or any other incident affecting its security occurs, we will report it to the supervisory authority and notify affected individuals in accordance with the law. If the incident involves Customer Data, we will, in accordance with the law, notify you, as the store operator, without delay and assist you with reporting to the authority and notifying affected individuals.

19. Changes to this Policy

We may change this Policy in response to changes in laws, changes to the Service, or for other reasons. If we make material changes, we will give advance notice through an announcement in the Service, an email to your registered email address, or another appropriate method. Where the law requires an individual’s consent for a change, we will obtain that consent before making the change.

20. Language

The Japanese version of this Policy is the official version, and the English version and any other translations are provided for reference only. If there is any inconsistency between the Japanese version and a translation, the Japanese version prevails.