Privacy Policy

In providing the Service, we may collect the following information:

• account information (email address, nickname, authentication provider ID, etc.);
• content that you create or submit within the Service (game definitions, character settings, prompts, chat history, uploaded or generated images and audio, etc.; "User Content");
• billing and payment information (transaction data, point balance, and, where you use the saved-card feature, card number, expiry, and cardholder name). Where you use the saved-card feature, the card number is encrypted and securely managed on our servers and transmitted to a payment processor at the time of payment;
• access logs, IP address, device information (OS, browser, device type), and identifiers stored in cookies and local storage; and
• information you provide when contacting us or receiving support.

We use the collected information for the following purposes:

• providing, maintaining, operating, and improving the Service;
• user authentication and the detection and prevention of misuse and violations of the Terms;
• processing charges and payments and managing point balances;
• responding to inquiries and sending important notices;
• analyzing usage, improving quality, and developing new features; and
• creating and publishing statistical data processed and aggregated so as not to identify individuals.

The Service sends the prompts and game definitions you enter to AI inference providers we select in order to generate responses.

• We do not use the individual User Content you enter into the Service as training data for AI models that we or third parties make publicly available.
• We may access User Content internally, to the minimum extent necessary, for defect analysis, quality improvement, safety, and detection of violations of the Terms.
• We may use aggregated and anonymized data that cannot identify individuals for service improvement, statistics, research, and publication.
• The handling of input data by AI inference providers follows each provider's terms and privacy policy. Under our commercial agreements, we endeavor to select services under which such data is, in principle, not used to train the provider's models.

Except as required by law and in the following cases, we do not provide personal information to third parties without your consent:

• provision to service providers (payment processors, hosting and cloud providers, AI inference providers, image- and audio-generation providers, analytics, error monitoring, etc.) to the extent necessary to achieve the purposes of use;
• where business is succeeded due to a merger, business transfer, or other cause (this Policy continues to apply after succession);
• where necessary to protect a person's life, body, or property and it is difficult to obtain your consent; and
• where responding to a lawful disclosure request from a court, the police, or other public authority.

The Service uses cloud and AI-related providers based abroad, including in the United States. As a result, your personal information may be handled by third parties located outside your country.

• Principal destination countries: the United States, Europe (EEA), the United Kingdom, and other countries where our providers are located.
• Basis for transfer: under Article 28 of the Act on the Protection of Personal Information, we provide the data after confirming that the third party continuously implements security measures equivalent to ours.
• Details of the personal data protection regimes in the destination countries are available upon request through our contact point.

The Service uses cookies and browser local storage to improve the user experience, maintain login state, record age verification, and detect misuse. You can disable these through your browser settings, but some features of the Service may then become unavailable.

We implement necessary and appropriate security measures to prevent unauthorized access to, and the leakage, alteration, or loss of, the personal information we collect.

If a leakage, loss, damage, or other event affecting the security of personal information occurs, we will investigate the scope of impact, determine the cause, and implement measures to prevent recurrence, in accordance with the Act on the Protection of Personal Information and related guidelines, and will report to the Personal Information Protection Commission and notify affected individuals where necessary.

We retain personal information only to the extent necessary to achieve the purposes of use.

• Account information and User Content: during the account's validity and, after withdrawal, for a reasonable period necessary for misuse investigation and dispute resolution.
• Billing and transaction data: the retention period required by law (Electronic Books Maintenance Act, tax laws, etc.).
• Access and operation logs: deleted or anonymized after approximately 12 months.

Upon a deletion request, we will promptly delete or anonymize the data in accordance with Section 9, except to the extent a statutory retention obligation applies.

You may request disclosure, correction, addition, suspension of use, deletion, and disclosure of third-party provision records of your personal information that we hold.

• How to request: contact support@meltchat.jp.
• Identity verification: we may ask you to provide information necessary to confirm that you are the individual or an authorized representative.
• Fees: we generally respond free of charge.
• Where to complain: if you are dissatisfied with our response, you may complain to the Personal Information Protection Commission (https://www.ppc.go.jp/).

The Service is intended for persons aged 18 and over, and we strictly refuse use by, and the collection of personal information from, persons under 18. If we learn that we have collected information from a person under 18, we will promptly delete it.

We may change this Policy due to amendments to applicable law, changes in operational practice, or our business decisions. When we change this Policy, we post the amended content on the Service. For changes that materially and adversely affect users, we give notice at least 30 days before the effective date, by posting on the Service or by email or similar means.

If you are located in the EU, the EEA, or the UK, the following applies under the General Data Protection Regulation (GDPR) and the UK GDPR.

• Controller: The controller of personal data in connection with the Service is the entity identified in the "Company Information" section of this Policy.
• Legal bases for processing: (a) performance of a contract (providing the Service); (b) our legitimate interests (fraud prevention, safety, and service improvement); (c) your consent, where applicable; and (d) compliance with legal obligations.
• Your rights: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, withdrawal of consent, and the right not to be subject to solely automated decision-making, including profiling. To exercise these rights, contact support@meltchat.jp.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• International transfers: Transfers outside the EU/EEA/UK are made under an appropriate safeguard, such as the Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement/Addendum, or an adequacy decision.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (an EU Data Protection Authority, or, in the UK, the Information Commissioner's Office (ICO)).
• Representative and DPO: Where we appoint an Article 27 EU/UK representative and an Article 37 Data Protection Officer, we will provide their contact details in this Policy or through our contact point.

Questions about this Policy may be directed to support@meltchat.jp.