Privacy Policy

1. Information we collect

The Company may collect the following information.

• The name, email address, and message you enter in the contact form
• Account registration details (name, email address, password, and the workspaces you belong to)
• Billing information, where you subscribe to a paid plan
• Information you register or enter in the Service (boards, cards, comments, chat messages, attachments, custom field values, and the like)
• Access logs, activity logs, login history, cookies, and information about your browsing environment

2. Information inside a workspace

Information registered in a workspace belongs to the company or individual that uses that workspace (the "Customer"). The Company handles it as a processor entrusted by the Customer with its storage and processing.

The Company handles that information only as far as needed to provide, maintain, and troubleshoot the Service, and does not use it for any other purpose without the instruction of the Customer.

Data cannot be read across workspaces. The Service is designed so that information in a workspace you do not belong to is unreachable, even if the URL is entered directly.

3. How we use information

The Company uses the information it collects for the following purposes.

• Answering enquiries, discussing adoption, and providing quotations
• Providing the Service, issuing accounts, billing, and support
• Sending notification email for invitations, mentions, assignments, and due dates
• Improving the Service, investigating defects, and preventing misuse
• Sending announcements from the Company (you can stop these at any time)

4. Cookies and analytics

The Service uses cookies to keep you signed in and to remember the language you chose. You can disable cookies in your browser, but then features that require signing in will not work.

On our marketing pages (the pages before you sign in) we use the following analytics tools to understand how the site is used. They are not used on the pages behind sign-in.

• Google Analytics (Google LLC): pages viewed, where visitors came from, and the kind of browser and device. No information that identifies an individual is sent.
• Microsoft Clarity (Microsoft Corporation): how the page is used, including scrolling, clicks, and session recordings, so we can find what is hard to use. Input fields are configured not to be recorded.
• Cloudflare Web Analytics (Cloudflare, Inc.): page view counts. It uses no cookies.

5. Visitors from the EEA, the UK, and Switzerland

If you visit from the European Economic Area, the United Kingdom, or Switzerland, the analytics tools that use cookies (Google Analytics and Microsoft Clarity) are not loaded at all. Only Cloudflare Web Analytics, which uses no cookies, runs.

6. Disclosure to third parties and processors

The Company does not provide personal information to third parties except where required by law or where you have consented.

To run the Service the Company entrusts part of its work to the vendors below, and lets them handle personal data only as far as that work requires. Each is bound by contract to a limited scope and to appropriate security measures.

• XSERVER Inc. (Japan): servers. The runtime and database of the Service are located in Japan.
• BunnyWay d.o.o. (Slovenia): storage, transcoding, and delivery of meeting video.
• Cloudflare, Inc. (United States): storage of attachments such as images and PDFs, content delivery, and page view counts.
• Groq, Inc. (United States): transcription of meeting video and audio. Groq does not use the inputs or outputs it receives to train its machine learning models, and does not retain them by default.
• Google LLC (United States): cleaning up transcribed text via the Gemini API. The Company uses the paid tier, so what is sent is not used to improve Google models.
• SocketLabs, Inc. (United States): sending notification email.
• Stripe, Inc. (United States): credit card payments. Card numbers are handled by Stripe and are never held by the Company.
• Google LLC (United States) and Microsoft Corporation (United States): the marketing page analytics listed in section 4.

Slovenia is recognised under Japanese law as having a level of protection equivalent to Japan. Where personal data goes to a vendor in the United States, the Company treats it as a transfer to a party that maintains the arrangements required by the rules of the Personal Information Protection Commission. In practice, each contract limits the scope of handling and requires security measures, control over sub-processing, notice of incidents, and the provision of information, and the Company checks how those are carried out on a regular basis.

If you would like details of the measures any of these vendors take, please ask using the contact details below.

Speaker identification is performed on equipment the Company operates in Japan and is not sent outside the Company.

If you connect an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) to the Service, the information that assistant requests on your instruction (such as the contents of boards, lists, and cards) is sent to that provider at your direction. How the provider handles it is governed by its own privacy policy. You can stop the connection at any time under API tokens in your workspace settings.

7. Security and where data is held

The runtime and database of the Service are located in Japan. Attachments are held in storage operated by Cloudflare, Inc. (United States) and meeting video in storage operated by BunnyWay d.o.o. (Slovenia).

To prevent leakage, loss, or damage of personal information, the Company encrypts communications, manages access rights, separates data by workspace, records activity logs, takes regular backups, and applies other appropriate security measures.

8. How long we keep information

The Company deletes personal data without undue delay once it is no longer needed. The rough guide is as follows.

• Workspace data (boards, cards, attachments, video): deleted from production 30 days after cancellation. Those 30 days are there so you can export what you need.
• Backups: after deletion from production, a copy may remain in backups held in Japan for up to 180 days for disaster recovery, and then disappears as generations roll over. During that time it is not used for any purpose other than recovery.
• Access logs, activity logs, and login history: one year.
• Billing and accounting records: seven years, as required by law.

9. Disclosure, correction, deletion, and complaints

The Company responds to requests from an individual to disclose, correct, add to, delete, stop using, or stop sharing their personal information, in accordance with the law and after confirming their identity. There is no charge for this.

Complaints about how personal information is handled are received at the same contact point below.

10. Revisions

This policy may be revised in response to changes in the law or to the Service. A revised policy takes effect when it is posted on this page.

11. Contact

LIFE SCAPE, K.K. (株式会社ライフスケープ)

Hisashi Hirajo, Representative Director

1-5-1 Tsukishima, Chuo-ku, Tokyo, Japan

Please get in touch using the contact form.