Privacy Policy

Tsucrea Co., Ltd. ("we," "us," or "our") operates the cloud service "Canopy" ("Service"). We recognize the protection of users' personal information as a fundamental responsibility and establish this Privacy Policy ("Policy") as set out below.

Article 1 — Definition of Personal Information

"Personal information" in this Policy refers to "personal information" as defined under Japan's Act on the Protection of Personal Information (Act No. 57 of 2003): information about a living individual that can identify a specific individual by name, email address, or other descriptor contained in the information (including information that can be readily cross-referenced with other information to identify a specific individual).

Article 2 — Types of Information We Collect

We collect the following information in connection with providing the Service.

(i) Information you provide directly: name (first and last), email address, company / organization name, job title, inquiry content and messages.

(ii) Information generated automatically through your use of the Service: login timestamps, operation logs, and access history; feature usage and frequency data; IP address, browser type, and OS version; session IDs and cookie data.

(iii) Content you enter or generate while using the Service: program goals, progress notes, and feedback within mentoring / coaching programs; task, KPI, and milestone data; text input to AI features (proposals, analysis requests, etc.).

Article 3 — Purposes of Use

We use the personal information we collect for the following purposes:

(i) To provide, operate, and improve the Service

(ii) To manage and authenticate user accounts

(iii) To respond to inquiries about the Service

(iv) To process billing and payments

(v) To handle incidents and maintain security

(vi) To develop new features and services, and for research and analysis

(vii) To send Service-related announcements and updates

(viii) To investigate and respond to violations of our Terms of Service

(ix) To fulfill legal obligations

Article 4 — Management and Protection of Personal Information

We implement appropriate technical and organizational security measures to prevent unauthorized access, loss, destruction, or alteration of personal information. These measures include access controls, encrypted communications (TLS), encryption of stored data and backups, continuous vulnerability scanning, regular security audits and access reviews, and regular training and supervision of personnel who handle personal information.

Article 5 — Third-Party Disclosure

We will not provide personal information to third parties except in the following circumstances:

(i) Where the user has given prior consent

(ii) Where required by law

(iii) Where disclosure is necessary to protect the life, body, or property of a person, and it is difficult to obtain the user's consent

(iv) Where disclosure is particularly necessary for improving public health or promoting the sound development of children, and it is difficult to obtain the user's consent

(v) Where disclosure is necessary to cooperate with a national or local government body or its delegate in performing duties prescribed by law

(vi) Where personal information is transferred as part of a business succession (merger, split, assignment, etc.)

Article 6 — Outsourcing

We may engage third-party service providers to handle personal information to the extent necessary for operating the Service. We enter into data protection agreements with such providers and maintain appropriate oversight.

Article 7 — Provision to Third Parties Located Outside Japan

To provide the Service, we entrust the handling of personal information to the following providers located outside Japan, and personal information is accordingly transferred overseas (primarily to the United States).

(i) AI text generation and analysis (USA): We send text and attachments entered or generated by users for processing. These providers state that they do not use the submitted data to train or improve their AI models, and that they retain it only for a limited period (e.g., for abuse detection) before deletion.

(ii) Company search (USA): We send search keywords generated by AI. We do not send the text entered by users itself.

(iii) Email delivery (USA): We send the recipient's name, email address, and the message body of notification emails.

(iv) Error monitoring (USA): To detect and investigate failures, we send error details, the page where the error occurred, and an identifier of the user (a random string). Email addresses and similar data are removed before sending.

(v) Abuse prevention (USA): To prevent abuse of the sign-up form, we send IP addresses and browser information.

(vi) Handling of inquiries (USA): We send the name, email address, company name, and inquiry entered in the contact form on our website.

(vii) Analytics (USA): To understand how the website and the Service are used, we send cookie identifiers, pages viewed, and similar information (see Article 9).

(viii) Hosting and cloud infrastructure (USA and Singapore): Our database and files are stored within Japan (Tokyo region).

(ix) We enter into agreements (including data processing terms / DPAs) with these providers, regularly review their handling of personal information, and exercise necessary and appropriate supervision so that protections equivalent to Japan's Act on the Protection of Personal Information are continuously maintained. Information on the names of the providers, the destination country, its data protection regime, and the measures taken by each provider is available upon request via the contact in Article 15.

(x) For users located in the European Economic Area (EEA) or Switzerland, we carry out transfers based on appropriate mechanisms such as Standard Contractual Clauses (SCCs), in compliance with the GDPR and other applicable European data protection laws.

Article 8 — Data Retention

We retain personal information for the following periods:

(i) Active accounts — until the user requests account deletion

(ii) Free trial accounts (not converted to paid) — data is kept for 90 days after trial expiry so that the user can resume by subscribing, and the data, including account information, is deleted within 120 days after trial expiry

(iii) After service cancellation — access ends on the cancellation date, and the data is deleted within 30 days from the cancellation date

(iv) Backups — our backups are kept for 60 days and then deleted automatically. Information deleted under (ii) or (iii) therefore remains in backups for up to 60 days after deletion (for cancellations, it is erased, including from backups, within 90 days from the cancellation date). We cannot erase specific information from a backup individually

(v) Retention by providers — providers listed in Article 7 delete data after the period each of them defines (for AI processing, generally within 30 days)

(vi) Information subject to statutory retention obligations — for the period prescribed by the applicable law

(vii) Security records — to prevent and investigate unauthorized access, we keep records of access to and operations on the Service (including the email address of the user who performed the operation) separately from the above, for one year from the date of recording, after which they are deleted automatically. These records are kept until the end of that period even after an account is deleted or the subscription is cancelled. The content that users enter or generate is not within the scope of these records. These records cannot be individually deleted during the retention period.

Article 9 — Cookies and Analytics

We use cookies on the Service and website. Cookies are used to improve convenience, for access analytics, and to improve service quality. You may disable cookies through your browser settings, but some features of the Service may become unavailable.

(2) To opt out of data collection by analytics tools, please use your browser settings or the opt-out mechanism provided by the relevant tool.

Article 10 — Disclosure of Personal Information

Users may request disclosure of their own personal information held by us. Please contact us through the inquiry channel in Article 15. We may decline disclosure in whole or in part in the following cases:

(i) Where disclosure would risk harm to the user's or a third party's life, body, property, or other rights and interests

(ii) Where disclosure would significantly impede the proper execution of our business operations

(iii) Where disclosure would violate applicable law

Article 11 — Correction and Deletion

If personal information we hold about a user is inaccurate, the user may request correction or deletion through the inquiry channel in Article 15. Following identity verification, we will respond within a reasonable period and notify the user of the outcome. However, the security records in Article 8 (vii) cannot be corrected or deleted until the end of their retention period. In that case, we will not use those records for any purpose other than the one stated in that item, and we will limit the persons who handle them.

Article 12 — Suspension of Use

Users may request suspension of use or erasure of their personal information in the following cases:

(i) Personal information is being used beyond the stated purposes

(ii) Personal information was obtained through improper means

(iii) Personal information has been provided to third parties in violation of this Policy

(iv) Suspension or erasure is otherwise permitted under applicable law

However, the security records in Article 8 (vii) cannot be suspended or erased until the end of their retention period. In that case, we will not use those records for any purpose other than the one stated in that item, and we will limit the persons who handle them.

Article 13 — Changes to This Policy

We may revise this Policy in response to changes in law or the Service. For material changes, we will notify users in advance through the Service or by email to registered addresses. Revised policies take effect from the date announced through the prescribed method or posted on this website.

Article 14 — Compliance with Laws and Regulations

We comply with Japan's Act on the Protection of Personal Information and other applicable laws and regulations relating to personal information, and we continuously work to improve this Policy.

Article 15 — Contact

For inquiries about this Policy, or to request disclosure, correction, deletion, or suspension of use of personal information, please contact us at:

Tsucrea Co., Ltd. (operator of the Canopy service)
Email: hello@canopyhq.ai
Website: https://canopyhq.ai

This Policy is provided in both Japanese and English. In the event of any conflict or inconsistency between the Japanese and English versions, the Japanese version shall prevail.