Privacy Policy

Blue Office Inc. (hereinafter the "Company") establishes this Privacy Policy (hereinafter this "Policy") regarding the handling of the personal information of users (hereinafter "Users") of the service "PasteSync" provided by the Company (including the web application, the iOS application and keyboard extension, the desktop applications (Mac/Windows), and the Chrome browser extension; hereinafter the "Service"). This Policy complies with the Act on the Protection of Personal Information of Japan and other related laws and regulations.

Article 1 (Information We Collect)

The Company collects the following information in providing the Service.

• Account information: Email address, display name, profile image or icon, and authentication provider identifiers. Users can register and log in with an email/password, a Google account, or an Apple ID.
• Content created and saved by Users: Information registered by Users on the Service, such as boards, text/image/PDF templates, folders, tags, organization/department/team structures, and sharing settings.
• Payment-related information: The purchased plan and subscription status for Users of paid plans. Payment information such as credit card numbers is collected and processed directly by the payment processor (Stripe, Inc.), and the Company does not retain card numbers themselves.
• Usage and device information: Usage history of the Service (including usage analytics such as the number of times templates are copied), access logs, IP addresses, device and browser types, and information collected through cookies and similar technologies.
• Inquiry information: The name, email address, and inquiry details provided by Users through the contact form or similar means.

Article 2 (Purposes of Use)

The Company uses the collected information for the following purposes.

• Provision, operation, and maintenance of the Service, user authentication, and data synchronization
• Responding to inquiries from Users
• Improvement of the Service, development of new features, and analysis of usage
• Billing of fees and payment processing
• Delivery of important notices regarding the Service
• Prevention of unauthorized use, ensuring security, and responding to acts that violate the Terms of Service
• Measurement of advertising effectiveness (see Article 5)
• Creation of statistical data processed into a form that cannot identify individuals

Article 3 (Provision to Third Parties)

The Company will not provide personal information to third parties without the prior consent of the User, except in the following cases.

• When required by laws and regulations
• When necessary for the protection of the life, body, or property of a person and it is difficult to obtain the consent of the individual
• When particularly necessary for the improvement of public health or the sound development of children and it is difficult to obtain the consent of the individual
• When it is necessary to cooperate with a national government organ, a local government, or a person entrusted by them in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the performance of such affairs
• When providing information to subcontractors to the extent necessary to achieve the purposes of use (Article 4)
• When providing information in connection with a succession of business due to a merger, company split, business transfer, or other reasons

Article 4 (Subcontractors and External Services Used)

The Company uses the following external services to provide the Service. The handling of information by each company is governed by that company's privacy policy.

• Google Cloud / Firebase (Google LLC): Provision of authentication, database, file storage, and server functions. Stores Users' account information and created content (storage region: Tokyo / asia-northeast1).
• Stripe, Inc.: Payment processing. Email addresses, user identifiers, purchase details, and the like are transmitted.
• SendGrid (Twilio Inc.): Sending of emails such as confirmation emails, password resets, and organization invitations. Recipient email addresses and the like are transmitted (we do not track email opens or clicks).
• Vercel Inc.: Website hosting and access analytics (Article 5).
• Meta Platforms, Inc.: Measurement of advertising effectiveness (Article 5).
• Google (Google Sign-In) / Apple (Sign in with Apple): Login authentication. When a User logs in by these methods, the email address, name, and the like are shared.

Article 5 (Cookies, Access Analytics, and Advertising Technologies)

The Service uses cookies and similar technologies to improve the user experience and to improve the Service.

• Functional cookies: Used for purposes necessary for the operation of the Service, such as retaining display settings.
• Access analytics (Vercel Analytics): Measures page views, display speed, and the like. Uses a cookie-free method and does not directly identify individuals.
• Advertising measurement (Meta Pixel): Browsing information may be sent to Meta Platforms, Inc. for the purpose of measuring the effectiveness of advertising. Users can disable this by rejecting cookies in their browser settings or through Meta's ad preferences (https://www.facebook.com/adpreferences) and similar means.

Users may refuse to accept cookies through their browser settings; however, in that case, some features of the Service may become unavailable.

Article 6 (Handling of Data in the Keyboard Extension, Desktop Apps, and Browser Extension)

The Service provides an iOS keyboard extension, desktop applications (Mac/Windows), and a Chrome browser extension. The handling of data in these is set forth as follows.

6-1. iOS Keyboard Extension

The keyboard extension is a feature for quickly entering templates that the User has registered in advance. The "Full Access" permission is used only for network access to synchronize templates stored in the cloud.

• Data collected and used: The contents of templates registered by the User in the Service (cached in a local database on the device and in the app shared container), and authentication credentials
• Data not collected: Keystroke contents, information about the app being typed into, the contents of other apps' clipboards (except for template paste operations), and location information
• The keyboard extension does not perform network communication for any purpose other than template synchronization
• Even when Full Access is disabled, templates already cached on the device remain available

6-2. Desktop Apps (Mac/Windows)

The desktop apps are a feature for invoking registered templates with a global shortcut and pasting them into the previously used application.

• Data collected and used: The contents of templates registered by the User in the Service (cached on the device), authentication credentials, and usage analytics such as the number of times templates are copied
• Data not collected: Keystroke contents, information about the app being typed into, clipboard contents other than template paste operations, browsing history, and location information
• Auto-paste sends key events only to paste the template selected by the User into the previously used application (accessibility permission is required on macOS)
• The desktop apps do not perform network communication for any purpose other than template synchronization and usage analytics

6-3. Chrome Browser Extension

The browser extension is a feature for quickly copying registered templates in the browser.

• Data collected and used: The contents of templates registered by the User in the Service (cached in the browser's local storage), authentication credentials, and usage analytics such as the number of times templates are copied
• Data not collected: Browsing history, page contents, form input contents, and cookies
• The browser extension has permission to run on all pages, but this is for displaying the operation panel, and it does not read page information for any purpose other than the above

Article 7 (Data Storage Location and Retention Period)

The Company stores Users' personal information primarily in Google Cloud (Tokyo region). In connection with the use of some subcontractors (Stripe, Meta, etc.), information may be processed on servers outside Japan. The Company retains personal information for the period necessary to achieve the purposes of use, and where retention is required by laws and regulations, for the period prescribed by such laws and regulations. After the retention period has elapsed, the information will be deleted or anonymized without delay.

Article 8 (Security Control Measures)

The Company takes appropriate technical and organizational security control measures, such as encryption of communications and access controls, to prevent the leakage, loss, or damage of personal information. However, the Company cannot guarantee the complete security of communications over the Internet.

Article 9 (Users' Rights)

Users have the right to request disclosure, correction, addition, or deletion of, suspension of use of, and suspension of provision to third parties of their own personal information held by the Company.

• Users can delete their account from the account settings screen of the Service, and upon deletion, the account information and created content stored by the Company will be erased (excluding transaction records and the like retained by the payment processor).
• For other requests, please contact the contact desk set forth in Article 11.

Article 10 (Children's Personal Information)

The Service is not intended for persons under 16 years of age. The Company does not knowingly collect personal information from persons under 16 years of age. If the Company becomes aware that it has collected personal information from a person under 16 years of age, it will take measures to delete it promptly.

Article 11 (Contact Desk)

For inquiries regarding this Policy and requests under the preceding Article, please contact us at the address below. The name of the operations manager, the address, and the telephone number will be disclosed without delay upon request.

Article 12 (Changes to This Policy)

The Company may change this Policy as necessary. In the case of material changes, the Company will notify Users through the Service or by email. The revised Policy shall take effect from the time it is posted on the Service.

Article 13 (Governing Law)

The interpretation and application of this Policy shall be governed by the laws of Japan.