プライバシーポリシー Privacy Policy

Operator of the Service: Keiichi Washio (trade name: Overtone, the "Operator")

This Privacy Policy sets forth the handling of personal information collected from users of the Service.

Overtone (the "Service") collects the following information to provide the Service.

1-1. Account Information

• Email address (including via Google account authentication)
• Display name (optional)
• Language preferences (UI language, native language, translation targets)

1-2. Billing Information

• Processed via Stripe. We do not store credit card numbers.
• Only Stripe Customer ID and Subscription ID are stored in Firestore

1-3. Usage Data

• Session duration (minutes)
• Session start/end times, plan tier

1-4. Meeting Audio & Translation Text (Ephemeral)

Meeting audio and translation text are held only in memory for real-time processing during the session, and immediately discarded when the session ends (Zero Data Retention policy). We do not persist this data nor use it for AI training.

• Providing, operating, and improving the Service
• User authentication, billing, and usage limit management
• Sending essential notices (service interruptions, pricing changes, terms updates)
• Sending marketing information to users who opted in
• Preventing fraud and addressing technical issues
• Compliance with applicable laws

The Operator does not share collected personal information with third parties except in the following cases:

• With the user's explicit consent
• When required by law (court orders, legitimate requests from law enforcement, etc.)
• When necessary to protect the life, body, or property of a person and obtaining the consent of the person is difficult

The Operator may outsource part or all of the handling of personal information to external service providers within the scope necessary to achieve the purposes of use. In such cases, the Operator exercises necessary and appropriate supervision over outsourcees to ensure secure handling of personal information (Article 25, Act on the Protection of Personal Information of Japan).

Principal Outsourcees

• Google LLC (Google Cloud Platform): Hosting, database, authentication (Firebase Authentication, Firestore, Cloud Run)
• Cloudflare, Inc.: DNS, CDN, DDoS protection, Web Analytics
• Stripe, Inc.: Payment processing
• Soniox, Inc.: Speech recognition and text-to-speech (meeting audio discarded immediately after processing under ZDR agreement)
• Anthropic, PBC: AI translation (Claude), with no-AI-training contract in place
• Google LLC (Gemini): AI translation assistance, configured to exclude AI training use

For the provision of the Service (cloud infrastructure, payments, AI translation, etc.), the Operator transfers users' personal data to the following overseas outsourcees (Article 28, Act on the Protection of Personal Information of Japan).

• Recipient countries: Primarily the United States (headquarters of Google, Stripe, Cloudflare, Anthropic, Soniox). Actual data processing takes place in the region selected by the Operator (e.g., Google Cloud asia-northeast1 (Tokyo), global, etc.).
• Personal data protection regimes in such countries: Please refer to the Personal Information Protection Commission's survey on overseas data protection regimes (link).
• Safeguards by outsourcees: The Operator has executed contracts (Data Processing Agreements, Standard Contractual Clauses where applicable) with each outsourcee to ensure a level of protection equivalent to Japanese law and the EU GDPR. Outsourcees hold certifications such as SOC 2 Type 2 and ISO 27001.

The Service may cause the user's device to transmit the following information to external service providers for the purposes of service operation, user experience improvement, usage analysis, and fraud prevention (Article 27-12 of the Telecommunications Business Act of Japan).

The Service currently does not use Google Analytics. This policy will be updated if it is added in the future.

• Meeting audio & translation text: Immediately discarded when the session ends (no persistence)
• Account information: Retained until account deletion. Fully deleted within 30 days of deletion request
• Billing records: Retained for the period required by law (generally 7 years under tax law)
• System logs: Retained for up to 90 days for troubleshooting and security purposes

Users may exercise the following rights regarding their personal information:

• Request disclosure of personal information held about them
• Request correction, deletion, or suspension of use of personal information
• Opt out of marketing communications (via unsubscribe link in each email, or by contacting us)
• Data portability (where applicable)

Please contact contact@overtone-translate.com for requests.

6-1. Security Measures

• Communications encrypted with TLS 1.2 or higher
• Stored data encrypted at rest with AES-256 (Google Cloud / Firestore standard)
• Access permissions restricted based on the principle of least privilege
• Access logs recorded and regularly reviewed
• Data Processing Agreements (DPAs) executed with all outsourcees
• Meeting audio and translation text are immediately discarded from memory when the session ends (Zero Data Retention)

6-2. Incident Response

In the event of a leak, loss, damage, or other incident involving personal data that meets the criteria set forth in the Act on the Protection of Personal Information of Japan, the Operator will promptly report to the Personal Information Protection Commission, notify affected users with a summary of the incident, the categories of personal data affected, and the response status, and take appropriate measures to prevent the spread of harm (Article 26, Act on the Protection of Personal Information of Japan).

For users residing in the European Economic Area (EEA) or the United Kingdom, the following additional information is provided under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

Legal Bases for Processing

• Performance of a contract (Article 6(1)(b)): Provision of the Service under the Terms of Service, billing, authentication
• Legitimate interests (Article 6(1)(f)): Service improvement, security, fraud prevention
• Consent (Article 6(1)(a)): Marketing communications (opt-in)
• Compliance with legal obligations (Article 6(1)(c)): Retention of tax records, response to legitimate law enforcement requests

Data Subject Rights

EEA / UK residents have the following rights:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure ("right to be forgotten", Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to lodge a complaint with a supervisory authority (Article 77)

International Transfers Outside the EEA

The Operator may transfer personal data outside the EEA (primarily to Japan and the United States) for the provision of the Service. Such transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent appropriate safeguards (Article 46 GDPR).

Contact

For inquiries regarding the Operator's processing of personal data, please contact contact@overtone-translate.com.

We may update this policy in response to legal changes or service improvements. Material changes will be communicated via in-service notification or email in advance.

For questions regarding this policy or requests concerning personal information, please contact:

Email: contact@overtone-translate.com