Privacy Policy

Last updated: 2026-10-30

This is an English translation. If it differs from the Japanese version, the Japanese version prevails.

Kyotani Inc (Kyotani Inc., "we") handles user information as follows in providing SNS TOWN (the "Service"). We are the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Information we hold

• At sign-up: email address, password (stored only as a hash; the original is never stored), company name and language.
• When you connect a social account: the access token issued by each network (X, Threads, Facebook Pages, Instagram, LinkedIn, YouTube, TikTok), the account's ID, display name, username and profile image URL, and the network ID of the person who connected it. We never hold your social passwords. Access tokens are stored encrypted.
• While you use the Service: company profile and key messages, images, videos and documents in the asset library (including those imported from Google Drive), text and images you create, schedule and post, posting-cycle settings, credit balance changes, and engagement read back from the networks.
• When you pay: what you ordered, the amount, and the payment ID and status. Card numbers are handled by our payment processor KOMOJU and never reach us.
• When you turn on browser notifications: your browser's push service address and the keys used to encrypt notifications.
• Recorded automatically: logs such as access time, IP address and browser type, and sign-in records (device and country). Cookies and browser storage are described in the Cookie policy (analytics and referral tracking only if you allow them).

2. Why we use it, and legal basis

• To post to your connected social accounts on your instructions, and to read back post status and engagement (performance of contract).
• To create AI drafts and images from your company profile and assets (performance of contract).
• To manage plans and credits, accept orders and payments, and show usage (performance of contract; legal obligations for accounting).
• To verify identity (email confirmation), prevent abuse and bots, and investigate faults (legitimate interests).
• To contact you and send notifications about the Service by email, Slack or browser notification (performance of contract; you choose how you receive them).
• For analytics and referral tracking (consent, which you can withdraw at any time).

We never use your information to train AI or for advertising.

3. Who we share it with

We send information only to the following providers, and only as needed for these purposes. We never sell or provide personal information to any other third party.

• X Corp. (X API) and Meta Platforms, Inc. (Threads API, Graph API for Facebook Pages and Instagram): the text, images and videos of posts, auto-replies and DMs, and the access tokens of connected accounts. We use only their official APIs and follow their terms and developer policies.
• LinkedIn Corporation (Share on LinkedIn) and TikTok Pte. Ltd. (Content Posting API): likewise, post text, images and videos, and the access tokens of connected accounts.
• Google LLC (YouTube API Services): if you connect a YouTube channel, the videos, titles, descriptions and visibility you upload, and that channel's access token.
• Anthropic, PBC and OpenAI, L.L.C.: your company profile, key messages and asset contents, to create AI drafts and images. We use both under terms that do not allow content sent through the API to be used for training.
• Google LLC (Gmail): recipient email addresses and message content, to send sign-up confirmation, password reset and notification emails.
• Slack Technologies, LLC: if you set notifications to go to Slack, the notification text.
• Google LLC: if you connect a Google Drive folder, the files in the folder you chose. We access no folder other than the one picked in the Picker.
• DEGICA Co., Ltd. (KOMOJU): your order, amount and email address, to take payment.
• Browser push services (Google, Mozilla, Apple, Microsoft): if you turn on browser notifications, the encrypted notifications. The push service cannot read their content.
• Cloudflare, Inc.: as the platform for the Service's servers, database, file storage and bot protection (Turnstile), and for analytics (Web Analytics) only if you allow it.

4. International transfers

The Service's database and servers run on Cloudflare's network, mainly in the United States, and many of the providers above are in the United States. Personal data transferred from the EU or UK is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Japan has an adequacy decision from the European Commission.

5. YouTube and Google data

• The Service uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of information is set out in the Google Privacy Policy.
• From YouTube we receive only the channel ID, name and icon URL, and the IDs and status of videos uploaded. We use these only to post videos on your instructions and show their status, never for advertising, AI training or sale to third parties.
• The Service's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• You can disconnect on the Service's social accounts screen, or revoke access in your Google Account security settings. When access is disconnected or revoked, we delete the access token and channel information we hold.

6. Retention and deletion

• We keep information for as long as your account exists. Payment records are kept for the period required by accounting law (7 years in Japan).
• When you disconnect a social account, we delete its access token immediately. If you revoke the app on the network's side, we delete it in the same way on receiving the network's notice.
• Owners can export or delete a company/brand from its settings screen. To delete your account, contact us at the address below.
• If you request data deletion from Meta's app settings, we issue a confirmation code and you can check progress at /meta/deleted.

7. Your rights

You can ask for access to, correction or deletion of, restriction of or objection to the processing of your personal information, and for a copy to take elsewhere (export). You can withdraw consent at any time (cookie choices can be changed on the Cookie policy page). Contact us at the address below and we will respond within one month after confirming your identity. If you live in the EU or UK, you may also complain to your local data protection authority. For California residents: we do not sell or share personal information (for cross-context behavioural advertising).

8. Security

All traffic is encrypted with TLS, and access tokens are stored encrypted. Passwords are hashed, login attempts are rate-limited and two-step verification is available. Servers run on Cloudflare's network with WAF, rate limiting and bot protection enabled.

9. Your posts

Content posted to a network through the Service is published on that network under its terms. You can delete posts from the Service's screens or on each network (Instagram and TikTok do not support deletion via API, so delete those in their apps).

10. Age

The Service is intended for businesses and may not be used by anyone under 16.

11. Changes

We will announce changes to this policy on this page, and notify significant changes to your registered email address.

12. Contact

Kyotani Inc., 99-1 Kasuga, Taishi-cho, Minamikawachi-gun, Osaka 583-0991, Japan
Email: regi@sns.town