kubario Privacy Policy

HOMUTA HOLDINGS INC. ("we") provides the SNS management service "kubario" at https://www.kubario.com and the web app https://app.kubario.com. This Privacy Policy explains how we collect, use, share, protect, retain, and delete personal information and connected platform data.

Article 1 (Information we collect)

We may collect the following:

• Registration data such as name, email address, company name, and billing-related information
• OAuth tokens and account metadata when you connect Google / YouTube, X (Twitter), Meta (Facebook / Instagram / Threads), TikTok, or LINE Official Accounts (access/refresh tokens, account/channel/page IDs, display names, usernames, profile image URLs)
• Content you create or manage through the Service (captions, media filenames, schedules, destinations, delivery results, error logs)
• TikTok video metadata, publish time, and cover images used only to detect new posts and trigger announcement delivery; we do not upload your media to TikTok through this feature
• LINE Official Account identifiers and Messaging API delivery settings used to send messages and review delivery results
• Usage logs such as IP address, browser/device data, cookies, and session information
• Information you provide when contacting support or requesting deletion

Article 2 (How we use information)

We use collected information to:

• Provide, maintain, and improve the Service, authentication, account management, and support
• Connect SNS accounts and enable posting, scheduling, delivery, and history features
• Detect newly published TikTok content and run announcement delivery triggers
• Send messages via the LINE Official Account Messaging API
• Prevent abuse, secure the Service, respond to incidents, and perform audits
• Process billing, send important notices, and comply with law

Article 3 (External SNS and Google user data)

The Service uses APIs including Google APIs. Google user data is handled per the Google Privacy Policy and this Policy.

Google user data obtained via Google / YouTube is used only to provide, maintain, and improve user-facing features of the Service on www.kubario.com and app.kubario.com, within the scopes you authorize. We comply with the Google API Services User Data Policy, including Limited Use requirements.

We do not sell Google user data. We do not use Google user data for advertising, data brokers, creditworthiness or lending decisions, or to train generalized AI / machine-learning models.

Data from X, Meta (Facebook / Instagram), TikTok, LINE Official Accounts, and other platforms is handled only within permissions you grant and under each platform's terms, developer policies, and privacy policies.

Article 4 (Sharing with third parties)

We do not sell personal information, including Google user data. We disclose data only with consent, when required by law, to protect safety, or to processors (cloud, monitoring, payments, support) under appropriate safeguards.

Article 5 (Security)

We implement technical and organizational measures including encryption of SNS access tokens, access controls, least-privilege practices, and logging.

Article 6 (Retention, deletion, and Meta data deletion)

We retain data as needed for the purposes above or as required by law. After account deletion, disconnection, or a deletion request, we delete or anonymize related data within a reasonable period (except where law requires retention or short-lived backups/audit logs remain). If you remove our app in Facebook/Instagram or want Meta connection data deleted, contact [email protected]. The same channel accepts deletion requests for Google, TikTok, LINE Official, and other connected data.

Article 7 (Your rights)

You may request access, correction, or deletion, and disconnect SNS accounts from Connections in the dashboard. For deletion and privacy requests, email [email protected].

Article 8 (Cookies)

We may use cookies and session data to improve the Service. Disabling cookies may limit some features.

Article 9 (Changes)

We may update this Policy and will notify users of material changes on the Service.

Article 10 (Third-party trademarks and logos)

Our website, app, and marketing materials may display trademarks, service names, and logos of external SNS providers such as X, YouTube, Instagram, Facebook, Threads, and LINE ("Third-Party Marks").

Third-Party Marks are used solely to indicate that the Service integrates with those platforms. They do not imply endorsement, partnership, or sponsorship. We display Third-Party Marks in accordance with each provider's brand guidelines and trademark rules. All rights remain with the respective owners.

Article 11 (Contact)

Additional information for users in the EEA, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP)

If you are located in the EEA, the United Kingdom, or Switzerland, we act as the controller of your personal data. Our identity and contact details are set out under Contact above.

Legal bases for processing

• Performance of a contract (GDPR Art. 6(1)(b)) — creating and maintaining your account, delivering posts, running schedules, and billing
• Legitimate interests (Art. 6(1)(f)) — preventing abuse and impersonation, securing the Service, responding to incidents, keeping audit logs, and improving the Service. We balance these against your rights and freedoms
• Consent (Art. 6(1)(a)) — analytics cookies, optional email, and sending your content to an AI provider when you use AI features. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Legal obligation (Art. 6(1)(c)) — retaining tax and accounting records

Your rights

• Access (Art. 15), rectification (Art. 16), and erasure (Art. 17)
• Restriction of processing (Art. 18) and objection to processing (Art. 21)
• Data portability (Art. 20) — provided in a machine-readable format
• Withdrawal of consent (Art. 7(3))
• Lodging a complaint with a supervisory authority (Art. 77)

To exercise any of these rights, email the address under Contact. We respond within one month of receipt, and may extend by up to two further months for complex requests (we will tell you if we do). We may ask for additional information to verify your identity.

If you are not satisfied with our response, you may lodge a complaint with the data protection authority in your country of residence or work, or where the alleged infringement took place. In the United Kingdom this is the Information Commissioner's Office (ICO); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

International transfers

Our servers are in Japan (AWS Tokyo region) and personal data is stored and processed there. Japan holds an adequacy decision from the European Commission (Implementing Decision (EU) 2019/419), and the United Kingdom maintains an equivalent finding. Transfers from the EEA and the UK to Japan therefore require no additional transfer mechanism. Where we use processors located outside Japan (such as CDN, payment, email delivery, analytics, or AI providers), transfers rely on the European Commission's Standard Contractual Clauses or on an adequacy decision covering that country.

Categories of recipients

• Cloud infrastructure and CDN (hosting, delivery, logs)
• Payment processors (billing and payment handling)
• Email delivery (notifications and verification)
• Analytics (only where you have consented)
• The SNS platforms you connect, to the extent needed to deliver your posts
• AI providers — only the content you submit, and only when you use AI features

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. AI features generate draft text; whether to publish is always your decision.

Additional information for California residents (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the CPRA, we disclose the following. The categories of personal information we collected in the preceding 12 months, the purposes, and the recipients are set out in Articles 1, 2, and 4 of this Policy and under Categories of recipients above.

Categories of personal information we collect

• Identifiers (name, email address, account IDs, IP address)
• Commercial information (plan, billing and payment records)
• Internet activity (usage logs, cookies, interaction records)
• Content you create (text, images, delivery settings, delivery results)
• Account access information (access tokens for the accounts you connect) — used only to provide the Service and stored encrypted

Your rights

• The right to know and to access what we collect, use, and disclose
• The right to request deletion
• The right to correct inaccurate personal information
• The right to opt out of sale or sharing — we do not sell personal information and do not share it for cross-context behavioral advertising
• The right to limit use of sensitive personal information — we use access information for connected accounts only to provide the Service you requested
• The right not to be discriminated against for exercising these rights

To exercise these rights, email the address under Contact. We will verify that the request comes from you or from an agent you have authorized before we act on it.