Privacy Policy

Koromo Inc. (“we,” “us,” or “the Company”) establishes this policy for the handling of personal information in the Terasu client work OS service (“Service”) in accordance with Japan's Act on the Protection of Personal Information and other applicable laws.

1. Personal information handling business operator

2. Definition

“Personal information” means information about a living individual that can identify that individual by name, email address, description, personal identification code, or by combination with other information.

3. Information we collect

3.1 Information you provide

• Name, email address, company, department, role, and profile image
• Messages, comments, files, and other content entered into the Service

3.2 Information collected through use

• Access logs, IP address, browser, access time, and referrer
• Page and document views, viewing duration, downloads, and operation history
• Cookies and similar identifiers

3.3 Connected services and authentication

When enabled, we receive identifiers, display names, profile images, channel information, and messages required for LINE or Slack integration. Authentication providers may supply the name and email address required to create and secure an account.

3.4 Google Calendar and Zoom integrations

These integrations are connected by each user individually and are off until a user connects them.

• Google Calendar: the email address of the connected Google account, and calendar event details (title, start and end time, attendee email addresses and display names, meeting URL, and cancellation status). We read events from one day in the past to 30 days ahead, and store only the events the user selects to sync (by default, only events that contain a meeting URL). Events outside that selection are discarded without being stored.
• Zoom: the Zoom user ID and email address of the connected account, the IDs and join URLs of meetings created through Terasu, and the text of cloud recording transcripts. We do not download audio or video recordings.

We use this data only to show your schedule on the Today page, link meetings to the matching deal room, add meetings created in Terasu to your calendar, and turn meeting transcripts into meeting notes and suggested next actions. We do not sell, rent, or transfer it to third parties, do not use it for advertising, and do not use it to train general-purpose AI models. OAuth tokens are encrypted at rest. Disconnecting an integration from My Page deletes the stored tokens and stops further syncing and transcript ingestion. Data already collected is deleted after the workspace's retention period when one is configured; if no retention period is set, it is kept until the workspace is deleted or a deletion request is made. Our use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes of use

1. Provide, operate, secure, maintain, and improve the Service.
2. Create, authenticate, support, and administer accounts and workspaces.
3. Provide engagement analytics such as document views and activity reports.
4. Provide integrations, support, billing, notices, and product updates.
5. Investigate misuse and enforce our Terms.
6. Create statistics processed so individuals cannot be identified.

5. Viewing analytics and related information

Terasu records viewing pages, duration, and download activity for content shared in a room and provides that information to authorized room managers and sales representatives. A workspace must use this data lawfully and give any notice or obtain any consent required for its visitors.

6. Cookies

We use essential cookies for authentication and security and may use analytics cookies to understand product usage. Browser settings can limit cookies, but some functions may stop working.

7. Disclosure to third parties and workspace sharing

We do not disclose personal information to third parties except with consent, when required or permitted by law, for business succession, or to processors needed to provide the Service. Information entered in a workspace or room is shared with authorized members of that workspace or room according to its access settings.

8. Service providers

We entrust hosting, authentication, payment, communication, analytics, support, and AI processing to vetted providers under appropriate contracts and supervision, including Google LLC for the Google Calendar integration, Zoom Communications, Inc. for the Zoom integration, and Anthropic PBC and OpenAI, L.L.C. for AI summarization and next-action generation. Only data necessary for the contracted purpose is shared.

9. International transfers

Some providers, including authentication, payment, collaboration, calendar, meeting, and AI providers such as Google LLC, Zoom Communications, Inc., Anthropic PBC, and OpenAI, L.L.C., may process data in the United States or other countries. We confirm applicable safeguards and provide information required by Japanese law.

10. Security measures

• Access control, least privilege, authentication, and audit logging
• Encryption in transit and appropriate encryption at rest
• Employee and processor supervision, incident response, and periodic review
• Tenant and room authorization controls for customer content

11. Security incidents

We investigate suspected loss, leakage, or unauthorized access, contain the incident, take corrective measures, and notify affected persons and the Personal Information Protection Commission when required.

12. Your rights

Subject to applicable law, you may request notice of purpose, access, correction, addition, deletion, suspension of use, erasure, or suspension of third-party provision. Contact support@koromo.io. We may verify identity and may refuse a request where the law permits.

13. LINE integration

LINE information is used only to provide the requested integration, messaging, display, and security functions. Disconnecting the integration stops future collection, subject to legal and operational retention needs.

14. Retention

We retain information only as long as needed for the Service, contracts, security, dispute resolution, and legal obligations. Retention periods vary by data type; expired data is deleted or irreversibly de-identified.

15. Changes

We may update this policy. Material changes are announced in the Service or by another reasonable method before they take effect where required.

16. Contact

Koromo Inc. Privacy Desk — support@koromo.io