Privacy Policy

Article 1Basic principles

We comply with the Act on the Protection of Personal Information and other relevant laws and regulations, and handle the personal information entrusted to us appropriately.

We keep what we hold to a minimum. Pawapo ai does not store passwords, and does not send the content of the text in your decks to any outside generative AI.

Article 2Information we collect

We collect the following information.

• Registration information: email address, name (optional), organization name, whether you are an individual or a company, and your role in the organization
• Sign-in records: the date and time you signed in
• Usage records: which member performed which operation (creating, editing, exporting, etc.), when, and how much. These are the basis for calculating fees
• The deck and page you have open: used to show members of the same organization who is viewing right now. This disappears shortly after you stop viewing
• Connection key information: the key's name, the date it was connected, the date it was last used, and the name the connected AI agent reported for itself
• Content you entrust to us: the text and structure of decks, brand kits, logo images, and PDF and PowerPoint files you send us for import
• Access records: IP address and browser type (kept for investigating failures and for security)
• Inquiry details: the company name, name, email address, phone number, expected number of users and inquiry details you enter in the enterprise inquiry form. These are only delivered by email to our contact desk and are not saved in the Service's database

Article 3Information we do not collect

• Passwords (the Service does not store passwords. You sign in with an email link or a Google account)
• Credit card numbers (handled by our payment processor; we do not store them)
• Your conversation history with AI agents (we receive only the text and structure sent to create or edit decks)
• Behavioral history for advertising (we do not track you for advertising purposes)

Article 4Purposes of use

We use the information we collect for the following purposes.

• Providing the Service, verifying identity, and managing organizations
• Calculating and billing fees
• Investigating failures, preventing unauthorized use, and ensuring security
• Responding to inquiries
• Improving the Service (used as statistics processed so that individuals cannot be identified)
• Sending important notices (changes to the Terms or fees, and notices of failures)

Article 5Use of cookies

We use cookies to keep you signed in. These cookies contain only a signed identifier of the user.

Where analytics is enabled, we use Google Analytics cookies only after you have given permission. You can use the Service without giving permission. You can change this at any time from "Analytics settings" at the bottom of the page, or from "Settings" in the dashboard.

We do not track you for advertising purposes.

Article 6Analytics and transmission of information to outside parties

To improve the Service and to understand where people get stuck before they start using it, we send the following information about people who have consented to Google LLC: the category of pages viewed, the type of operation, the type of AI connected (a category such as Claude or ChatGPT), identifiers stored in cookies, and information about the device and browser. Your IP address is also passed to Google as part of the communication.

We do not send email addresses, names, organization names, the text or titles of decks, connection keys or authentication tokens to Google Analytics. We remove the query string and fragment from the URLs in the page information we send.

Analytics information is handled on Google's facilities and is not stored only in the Tokyo region. For how Google handles data, see https://policies.google.com/privacy.

Article 7Provision to third parties

We do not provide personal information entrusted to us to third parties, except in the following cases.

• With the consent of the person concerned
• When disclosure is required under laws and regulations
• When it is necessary to protect a person's life, body or property and it is difficult to obtain the consent of the person concerned

Article 8Outsourcing

To the extent necessary to provide the Service, we outsource the handling of information to the following companies. We have contracts with them and supervise them appropriately.

• Google LLC (Google Cloud Run: the environment the Service runs on. Tokyo region)
• Supabase Inc. (database, file storage and sign-in platform. Tokyo region)

Article 9Storage location and retention period

Decks, usage records and registration information are stored in data centers in Tokyo. PDF and PowerPoint files are kept in private storage and delivered through URLs that only signed-in users can open. Knowing the URL alone is not enough to open them.

We keep personal information for as long as necessary for the purposes of use and for the period required by law. When you delete your organization ("Settings → Delete organization" in the dashboard), we immediately delete the organization's decks, brand kits, connection keys and member information. Usage records and billing records are kept for the period required by law.

Article 10Security measures

• All communication is encrypted (TLS).
• Connection keys are not stored in their original form.
• Data cannot be read across organizations. If our operators access anything outside their own organization for maintenance, a record of it is kept.
• We limit the staff who handle information, and separate their permissions.

Article 11Requests for disclosure, correction and deletion

When the person concerned requests disclosure, correction, addition, deletion or suspension of use of their personal information, we will confirm their identity and respond without delay in accordance with the law.

Please send requests to the following contact.

• STELLA Inc. — Personal information contact: Masayuki Fukuyoshi
• Email: masayuki-fukuyoshi@stellajp.net

Article 12Revisions to this policy

We may revise this policy in response to changes in laws or in the content of the Service. When we do, we will show it on the Service.

For important changes, we will show them at least 30 days before they take effect.

Supplementary provisions

Established and effective September 9, 2026.