We, Chaf Corporation (“Chaf,” “we,” “us,” or “our”), will collect information related to individuals (“Personal Data”) in providing our Chaf communication app (“Chaf App”) and all products, apps, services and websites related to the Chaf App (collectively, the “Services”).
2.Applicable scope of this Policy
This Policy applies to all Personal Data that is collected in relation to our Services regardless of the country or region where our Services are being used.
2.a.Target services and service provider
This Policy applies to all Personal Data that is collected in relation to our Services.
In connection with the application of this Policy, Chaf is the controller of the processing of Personal Data.
3.Personal Data to be collected
We will collect the following Personal Data:
● Information that you provide to us such as your phone number that you register at the time of creating an account, and profile information that you set at the time of using our Services
● Information related to your status of use of our Services such as the text, image, video and other contents that you post, and your access log
● In cases where you create a Chaf account using an external SNS account, information collected from a third party such as the identifier of the external SNS account that we will collect from that third party
● Information related to you which is posted by other users such as an image of your face photo posted by your friend
● Information collected externally such as information to be collected via a Chaf App plug-in installed in a third-party app, such as “Like”
● Public information containing Personal Data such as onChaf news published on the internet
We will collect the following types of Personal Data in providing our Services. If you do not provide certain types of information such as your phone number which needs to be registered for using our Services, you may not be able to use all or a part of our Services.
3.a.Personal Data to be provided by you
3.a.i.Information to be registered at the time of creating an account
Before you start using our Services, we may ask you to provide your contact information for creating a Chaf account (“Account”).
● In order to create an Account, you need to register your phone number or Google or AppleID. If you choose to register your Google or AppleID, while Google or Applemay ask you to enter your Google or Applepassword, we will not collect or store such password.
Please note that we assign an internal identification code (“Internal Identifier”) to each Account created by our users.
3.a.ii.Information to be registered for accessing your Account from multiple devices or transferring your Account from one device to another
If you wish to access your Account from multiple devices, or wish to transfer your Account from one device to another, you may need to register your phone number or email address in addition to the information that you registered at the time that you created your Account.
3.a.iii.Information required for communication and transaction
When you wish to use a specific service to purchase a product, make an inquiry or participate in a promotional event or survey, we may ask you to provide information required for communicating with you and conducting transactions with you depending on the nature of the transaction, and collect and store such information.
● In order for us to answer any requests or questions that you send to our customer support, we may ask you to provide information required for identifying and investigating the event or resolving the problem, such as your contact information including your phone number or email address, and details of the trouble that you have encountered.
● If you choose to participate in surveys or promotional events, we may ask you to provide information such as your name, address, phone number, email address, gender, and date of birth in order to verify your identity, enable you to participate in a drawing, and to deliver any prizes you may win.
● If you purchase a product or a service, you will be required to provide information for making the payment of such product or service. Since credit card settlements are processed by appropriate third-party payment agencies, we will not retain your credit card number or security code.
3.a.iiii.Profile and information related to your friend relationship
When you use our Services, we will collect the profile that you set, and information related to your friend relationship.
Profile information includes information such as the icon image, display name, status message, search ID (“Chaf ID”) and birthday that you set or disclose in order to connect to other users. Profile information (excluding information that you set as “private”) will be disclosed and made available to other users and third parties such as companies operating an official account. A Chaf ID is an identification name set in your Account to make it easier for your friends to find you in our Services, and your friends can find you through your Chaf ID. You may also choose not to allow other users to contact you using your Chaf ID.
We offer an “Auto Add Friends” feature which automatically adds other users as your friends in our Services when you upload information of your friend in your address book on your device. We will access only the phone numbers registered in your mobile device’s address book only when you have enabled this feature.
We will use the phone numbers in your address book only for automatically adding your friends, recommending possible friends, and preventing unauthorized use.
3.b.Personal Data to be collected in connection with your use of our Services
3.b.i.Status of use of our Services
We automatically collect information related to when and how you used our Services. The collected information includes the status of use of various features such as the date and time that you activated our individual apps, length of time that you used our individual services, results of searches conducted in the apps, additional services that were purchased, and contents and ads that were viewed or tapped.
Posts and reactions to posts
In distributing your posts to other users, the contents that you posted are sent via our server.
For example, standard contents such as emoji, stickers and location information and non-standard contents such as text, image, video and audio that you post are all sent via our server. In addition, external information such as the recipient of the contents, data format, date and time of the posting, and other information on how you are interacting with your counterparty is also recorded in the server. URL information that you tapped or clicked in our Services is also recorded in the server.
Furthermore, in distributing reactions or replies to the posts of other users, we collect and use information related to how you reacted to the posts of other users. This information includes the action that you took against the distribution by other users, and the time and date of such action, such as whether you viewed the text, image or video of messages that you received, and whether you clicked “Like” for the posts of users on your timeChaf.
In principle, we will not use private posts, as such messages exchanged between users, for any purpose other than distributing such posts. However, in certain countries or regions (*1) for specific services, we may use a part of such information upon obtaining your additional consent for the provision and maintenance of services, development and improvement of services, prevention of unauthorized use, and provision of optimized contents including ads. For details, please refer to “Regarding Usage of Your Information” and the terms of the individual services.
We may collect the location information of your device when you share your location information with your friends, or in order for us to provide optimized search results to you. When you do not accept sending your location information by your mobile device settings, location information will not be sent to us.
Furthermore, in certain countries or regions (*2), when we provide customized contents or ads to you, such as weather forecasts and local news near the areas where you are located, we may separately ask you to generally provide your location information. In the foregoing case, you may at any time choose not to provide your location information by your Chaf App settings.
Even when you do not accept sending your location information, we may estimate your approximate location from network information such as your IP address.
3.b.iii.Apps, browsers, devices and network information
We will collect information related to the device, browser and the app that you are using (ad identifier for identifying the device/browser, Cookie ID and device type, OS, language/time zone setting, browser type, app version, etc.), and network information (telecommunications carrier’s name, IP address, etc.).
We may also associate the collected ad identifier with the Internal Identifier.
3.c.Personal Data collected from third parties
We may collect Personal Data from third parties including our group companies (referring to our subsidiaries or affiliates, wherein the definition thereof includes domestic and overseas subsidiaries and affiliates according to the “Regulation on Terminology, Forms, and Preparation Methods of Financial Statements” of Japan; hereinafter the same).
For example, we will collect Personal Data from third parties in the following cases.
3.c.i.Personal Data collected from group companies
3.c.ii.Personal Data collected from business partners
We may collect your Personal Data from our business partners. There are cases where we collect Personal Data from a business partner operating its own service, and from a business partner operating a service that is linked to our Services such as an official account or Chaf App login. For example, when you create your Account using an external SNS account, we will collect the identifier of that external SNS account.
3.d.Personal Data uploaded by other users
There may be cases where a certain user, in using our Services, uploads information containing Personal Data such as a photo that includes a third party other than that user, and we collect such information.
3.e.Personal Data that is directly collected from third-party services
We may collect login records from plug-ins of third-party websites and apps equipped with a plug-in feature such as “Send by Chaf” or “Like”, and URL information of websites equipped with a plug-in feature that you visited while being logged onto the Chaf app on your browser by associating such login records and URL information with your Chaf Account. Such collected data will be used for understanding how you are using our Services, as well as for the maintenance and improvement, security, and prevention of unauthorized or fraudulent use or abuse, of such Services. When you are logged out of the Chaf App, the foregoing information will be used only for the purpose of security and prevention of unauthorized or fraudulent use or abuse in a form where individuals cannot be specified.
Furthermore, in certain countries or regions, when our business partner uses our Services, we may collect the following Personal Data.
● Information such as the access history (including date and time of access, URL, etc.) of the website that you accessed from your browser.
● History of service use on web app in which our business partner is the service provider.
For example, if our business partner has introduced our access analyzing service to confirm the status of use of its web app service or improve its services, we will collect your history of use of that business partner’s services, and provide your status of use in the form of statistics to the business partner.
When we directly collect Personal Data from services operated by a third party such as when our business partner uses our Services as described above, we request our business partner to take lawful and proper measures.
3.f.Collection of Personal Data from public information
We will collect public information, such as onChaf news published on the internet, for use in search services, etc.
If the collected public information contains Personal Data, we may use such information for registration in the search engine index or display of search results.
4.Purpose of use of Personal Data
We will use Personal Data for the following purposes:
● Provision and maintenance of services;
● Development and improvement of services and contents;
● Prevention of unauthorized use such as unauthorized access; and/or
● Provision of contents optimized for you.
We use Personal Data to provide our Services to users, for utilization in research and development to provide safer and better services, and to provide services that are strongly linked to users, including ads. The specific uses of Personal Data are as follows.
4.a.Provision and maintenance of services
We will use information required for providing services that you requested, answering your inquiries, and hosting promotional events.
For example, in the following cases, we will use Personal Data for the provision and maintenance of services.
● To verify your identity, through comparison with your registered information, when you log onto the Chaf App or succeed your Account in changing your device;
● To post messages or convey the status of “read” of posted messages;
● To confirm the history of messages viewed with a certain device on a different device;
● To set or disclose profiles for building and managing connections between users, and to search for other users using the registered information, or enable such search;
● To process invoices when a user purchases a product or uses a paid service;
● To examine your status of use of our Services in order to reply to your inquiry to our customer support;
● To deliver any prizes you may have won in a promotional event to your designated address; and/or
● To notify you of important changes to our Services such as the revision of terms, planned discontinuation of services, or change of features.
4.b.Development and improvement of services and contents
We will use Personal Data for the development and improvement of our Services for providing better services, products and contents to users toward the future.
For example, in the following cases, we will use Personal Data for the development and improvement of services and contents:
● To improve our Services by creating statistics and models related to the use of our Services;
● To develop new services and contents by understanding the trend from the purchase history of stickers;
● To improve the screen design by understanding the frequency that each tab in the app is being used; or
● To conduct surveys related to our services that we are currently providing, or may provide in the future.
4.c.Security and prevention of unauthorized use
We will use Personal Data and promote security measures and measures against unauthorized use to maintain an environment where our Services can be used at all times, and users can use our Services with a sense of security on a daily basis.
For example, in the following cases, we will use Personal Data for the security and prevention of unauthorized use:
● To verify facts or contact you in the event of any unauthorized use or the possibility of any unauthorized use.
4.d.Provision of contents optimized for you
We will utilize Personal Data for providing recommended contents, including ads, to each user.
For example, in the following cases, we will use Personal Data for providing optimized contents to users:
● To display recommendations of other stickers with a strong relevance with the purchased sticker;
● When there is another user who has added as a friend an official account that is the same as the official account that you have added as a friend, to introduce another official account that such user has added as a friend; or
● To measure the effectiveness of the distributed ad.
Furthermore, in certain countries or regions (*3), we will use Personal Data for distributing recommended contents, such as optimized ads, to users. Such use includes the following examples:
● To distribute information of strong relevance to your current location regarding facilities, attractions, coupons, etc. to be provided through an official account;
● To introduce information of events being conducted and valuable coupons that can be used, near your current location or places where you often visit;
● To display ads related to our business partner’s website that you accessed;
● To estimate attributes such as the gender, age group, and interests of users from the official accounts that have been added as a friend, purchased stickers, Services that are often used, contents that were recently posted on timeChafs, and history of service use such as search words that were recently used, and distribute our ads or third-party ads that may of interest to users having similar attributes; or
● To distribute our ads or third-party ads with Personal Data such as the birthday, phone number and email address registered by users (including cases of distributing ads of our Services on services operated by third parties) as the key.
We are offering a detailed explanation to users residing in countries or regions where this feature is available.
In principle, we obtain your consent when we process your Personal Data. If, however, permitted under Applicable Laws, we may process your Personal Data with any of the following legal basis:
(1) processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract
(2) processing is necessary for compliance with a legal obligation to which we are subject (e.g., when following the information disclosure orders based upon laws and regulations announced by government agencies)
(3) processing is necessary in order to protect vital interests of yours or of another individual
(4) processing is necessary to investigate, prevent and take measures against illegal or suspected illegal acts
(5) processing is necessary for the legitimate interests pursued by us or by a third party, except where such interests are overridden by your privacy related rights, interests, and freedom (including improvement of operations or systems, prevention of fraud, maintenance of security, marketing, and research performed by us); or
(6) processing is necessary for any purpose related to public benefits or creation of archives of historical documents, or any purpose related to surveys or statistics supported by proper security measures.
For example, when we process your Personal Data for the provision and maintenance of services, development and improvement of services, and security and prevention of unauthorized use, such processing may be pursuant to the legal basis of legitimate interests indicated in (5) above.
5.Provision of Personal Data
We will not provide, disclose or share Personal Data to or with third parties unless we have obtained your consent or such provision, disclosure or sharing of Personal Data is permitted under Applicable Laws.
We may transfer Personal Data to a third country without any data protection laws which are equivalent to those of the country or region where you live when we have obtained your consent or such transfer of Personal Data is permitted under Applicable Laws.
In principle, we will not provide Personal Data to third parties unless we have obtained your consent or such provision of Personal Data is permitted under Applicable Laws.
However, in the following cases, we may provide Personal Data to third parties.
The recipients of Personal Data that we provide include third parties such as our subcontractors, subsidiaries, and affiliates located in countries or regions other than where you are residing.
In providing Personal Data, we may transfer Personal Data to a third country without any data protection laws which are equivalent to those of the country or region where you live (as of January 23, 2019, the European Commission has determined that Japan has secured sufficient protection standards regarding Personal Data). In the foregoing case, we will adopt standard contractual clauses or other means pertaining to data protection approved in your country or region, and transfer Personal Data to a third country according to the requirements of Applicable Laws.
5.a.Public disclosure by users themselves
The profile information that you registered will be processed as public information. Messages that you posted, posts made on time Chafs and bulletin boards, and actions such as “Like” and comments to posts of other users will be made available to third parties according to your disclosure setting and address.
The foregoing information may be copied, stored or spread by the recipient, and accessed by an unintended third-party recipient, due to the nature of digital data. When setting your profile or posting on our Services, please pay attention to the contents and scope of disclosure of such post.
We may subcontract certain services required for providing our Services (e.g.: building and operation of infrastructure, settlement, shipping, customer support, etc.) to a third party. In connection with this, we may entrust all or a part of the Personal Data to the subcontractor.
The subcontractor will access the Personal Data only to the minimum extent required for performing the subcontracted services on our behalf, and will not use the Personal Data beyond the scope of the subcontracted services.
We will comply with Applicable Laws and sufficiently investigate the qualification as a subcontractor, prescribe matters related to confidentiality and data protection in the contract with the subcontractor, and thereby establish a system for properly managing Personal Data.
5.c.Provision of services and ad distribution through collaboration with other companies
In cases where you use the services of our business partner, we may provide, to that business partner, information to be used by the business partner for identifying you (in certain countries or regions (*5), in addition to the Internal Identifier, including an ad identifier, device information such as the language setting, and attribute information).
● When you add an official account as a friend, talk to an official account, and enter a group talk room in which an official account is participating, minimum information required for sending messages to you, such as the Internal Identifier assigned to your Account and the language setting, will be sent. In certain services or features for some businesses, we may ask that you provide additional Personal Data such as your email address or phone number. In the foregoing case, we will additionally ask for your permission regarding the provision of additional Personal Data to such businesses before you use such services or features.
● When our business partner is equipped with an additional service such as the Chaf App login function, your Internal Identifier, profile information, email address or phone number may be shared with the business partner once you use such additional service. In the foregoing case, we will ask for your permission regarding the provision of Personal Data.
● In certain countries or regions (*5), we may provide and disclose your Internal Identifier, a part of your device information (ad identifier, language setting, etc.), and your attributes to our business partner engaged in the distribution of ads, effectiveness measurement and analysis to distribute ads with stronger relevance to you. Information such as your name, address, and phone number, which can be used for communicating with you or confirming your identity, will not be provided without your separate declaration of intent.
The processing of Personal Data by our business partner shall be pursuant to the terms or policies prescribed by each business partner.
5.d.Compliance and cooperation with public agencies
If we receive a request pursuant to legal proceedings such as a warrant, or if there is imminent danger to someone’s life or property such as a suicide threat or a bomb threat, we may disclose Personal Data to third parties including law enforcement agencies such as the police, or the court, pursuant to Applicable Laws.
6.Safety control of Personal Data
We will take strict technical and organizational security measures in managing the collected Personal Data.
Unless you request the deletion of your Account, in principle, we will retain most of your information. Once we receive your request to delete your Account, we will delete your information according to Applicable Laws and internal rules after retaining such information for a given period of time.
We are taking strict technical and organizational security measures in managing the collected Personal Data for respecting and protecting your privacy and confidentiality of your Personal Data, and preventing unauthorized access to your Personal Data. These measures include safety control measures based on industry standards for preventing unauthorized access to Personal Data, and disclosure, unauthorized use, falsification or destruction of Personal Data.
For example, we are taking the following measures.
● Provision of encryption feature of messages
● Strict access control based on a need-to-know basis
● 24/7 security monitoring
● External authentication for objectively evaluating our security measures
● R&D of new security technologies
Furthermore, we will never provide any means for fraudulently accessing Personal Data to a third party.
However, because no method of electronic transmission or method of data storage is perfect or impenetrable, we cannot guarantee that your Personal Data will be absolutely safe from intrusion during transmission or while stored in our systems.
To help protect your privacy and confidentiality of your Personal Data, we also need your help. Please do not share your password with others, or use the same passwords you use for other services.
6.b.Storage location of Personal Data
To provide our Services in a reliable and responsible manner, Chaf processes and stores key Personal Data on secure servers located in Japan where Chaf is located. There may be cases where the data protection level in Japan falls short of the data protection level required under laws in your country or region. In such a case, we will take measures so that Personal Data is lawfully transferred to our server in Japan pursuant to Applicable Laws. As of January 23, 2019, the European Commission has determined that Japan has secured sufficient protection standards regarding Personal Data.
6.c.Storage period of Personal Data
Chaf collects and retains Personal Data to provide our Services according to your request, fulfill any of the applicable purposes of use described in this Policy, or to comply with Applicable Laws.
Unless you request the deletion of your Account, in principle, we will retain most of your Personal Data. Once your Account is deleted, we will process your Personal Data properly according to Applicable Laws and our internal rules after retaining such Personal Data for a given period of time for the following purposes:
● to reply to inquiries;
● to resolve disputes or collect fees;
● to detect and deter fraudulent use of, or abuse of, our Services; or
● to comply with Applicable Laws.
Otherwise, we prescribe the storage period of Personal Data according to the following standards.
● We will not in any way use highly private information such as texts, images, videos and audio data sent in a talk room between users for any purpose other than the distribution of messages (including retransmission in the event of a communication failure or synchronization of messages from multiple devices) unless we have obtained your consent or such use is permitted under Applicable Laws. While we will retain the foregoing information for a minimum period, such information will subsequently be automatically deleted from our server.
● The delivery address information that we obtained for shipping the product collected in a promotional event will be deleted after a given period of time, for resolving disputes, after the shipment of the product is complete. Information that we collected for a specific purpose as described above will be promptly deleted after the lapse of a reasonable period once the purpose of such information is fulfilled.
● If you have expressly declared your intent to store your Personal Data, we may respect your intent and store your Personal Data for a long period. For example, we are providing a feature, such as the Keep feature of our Chaf App, to users for expressly storing/deleting information.
● If a storage period is prescribed under Applicable Laws or the like, we will store Personal Data according to such storage period.
We may continue to retain Personal Data in a format in which individuals cannot be identified after the lapse of the storage period prescribed pursuant to Applicable Laws and our internal rules.
7.Your choices regarding Personal Data
You have rights regarding your Personal Data processed by us, such as the right to access your Personal Data and the right to correct your Personal Data, to the extent permitted under Applicable Laws.
We are exerting efforts to provide, in our Services, features which enable you to personally edit your profile, and set and manage the collection, use and sharing of your Personal Data.
To the extent permitted under Applicable Laws, regarding your Personal Data that we process, you have the right to access, the right to rectification, the right to erasure, the right to restriction of processing, the right to withdrawal of your consent, the right to data portability, the right to confirm if we process any Personal Data of yours, and the right to request a review of any automated decisions that may be made as a result of the processing.
In addition, to the extent permitted under Applicable Laws, you also have the right to object to the processing of your Personal Data that we process in certain cases.
We are exerting efforts to provide, in our Services, features which enable you to personally manage your Personal Data on the Chaf App, edit your profile, set the collection, use and sharing of your Personal Data, and set and manage your Personal Data including the scope of disclosure of posts, opt-out of ads, and deletion of your Account. Please periodically confirm that no old information or inaccurate information is remaining, and properly update your Personal Data.
Specifically, we provide the following features:
● Confirmation and change of public profile information, and setting of the Chaf ID
● Setting and change of phone number and email address, deletion of email address, and de-link of your Google or Appleaccount
● Whether to allow other users to contact you by using your Chaf ID
● Whether to allow other users, who already have your phone number, to reach you via the Chaf App
● Whether to add contacts automatically using the address book in your device
● Whether to allow third parties to view your Personal Data retained by your friend
We also provide the following features in certain countries or regions:
● Whether to allow the use of information for improving our services (*1)
● Deletion of location information (*2)
● Whether to receive strongly relevant ads (*3)
If you wish to exercise your right against us to disclose your Personal Data that cannot be confirmed in our Services, correct or delete your Personal Data that is contrary to facts, notify you of the purpose of use of your Personal Data, or other rights permitted under Applicable Laws, you may contact us using the Contact Form.
After verification of your identity, we will respond to your request within a reasonable period of time, and in accordance with relevant laws. If you would like to send us a written request, please refer our mailing address indicated later.
If, however, permitted under Applicable Laws, we may not be able to respond to your request when any of the following applies:
● disclosure is likely to harm the life, body, property, or other rights or interests of yours or another individual;
● disclosure is likely to seriously impede the proper execution of our business;
● disclosure violates other laws and regulations;
● when you failed to verify your identity upon your disclosure request; or
● we are otherwise permitted under Applicable Laws to refuse your request.
If you no longer wish to use our Services or if you withdraw your consent to Chaf’s processing of your Personal Data which is necessary for us to provide our Services, you may choose to delete your entire Account. However, the withdrawal of your consent will not in any way affect the lawfulness of our processing of your Personal Data based on your consent that was given before the foregoing withdrawal.
Unless prohibited under Applicable Laws, if you exercise any of your rights hereunder, we may charge a fee, in accordance with the procedures defined separately.
8.Use of third-party modules and Cookies
We may install modules of a third-party software development kit (SDK) in our Services for the following purposes:
● to analyze the status of use of our Services; and
● to distribute ads on our behalf and measure the effectiveness thereof.
A cookie is a small text file that is stored on your computer when visiting a website. This text file stores information that can be read by the website operator when visiting the website again at a later date.
● to store your login state, authenticate visitors, maintain sessions and take security measures;
● to store language settings and latest date and time of access, and improve user-friendChafss;
● to provide better services by comprehending the number of accesses and the mode of use;
● to distribute ads that are more interesting to you (*3); and
● to measure the effectiveness of ads.
You can control whether or not to accept cookies based on browser settings or by using other tools. If, however, you deactivate cookies or limit the ability to set cookies, you may not be able to obtain the full benefit of the website or access all of its functions, which may limit your overall user experience.
8.c.Information related to use of Google Analytics
8.d.Information related to use of True Depth API provided by Apple
Chaf may use Apple‘s TrueDepth camera to collect additional information from your device‘s camera in order to improve quality of camera and video call that we provide, or improve function such as effects. However, this information is processed in real time for delivering and improving these features only. This information is not saved on our servers or shared with any third parties.
9.Other important information
We may modify this Policy. The latest version of the Policy will always be posted on this site, and we encourage you to review the contents of the latest version of the Policy carefully.
When we make any material changes to this Policy, we will notify you through reasonable means.
9.a.Privacy of children
The Services are intended for a general audience. If a minor is to use our Services and provides Personal Data, the minor must do so with the consent of his/her guardian. You represent and warrant that you have the right capacity and legal capacity required for using our Services. If you are a minor, you represent and warrant that you are using our Services with the consent of your guardian. We have voluntarily imposed age restrictions on certain Services in cases where we are unable to confirm that you are of a certain age.
We understand the special necessity to protect the Personal Data collected from minors in the U.S. or Europe (under the age of 13 in the U.S., and under the age of 16 in Europe) using our Services, and we do not knowingly collect any Personal Data from minors.
9.b.Changes to this Policy
If you do not agree to any of the changes and you no longer wish to use our Services, you may choose to close your Account. Continuing to use our Services after a notice of changes has been notified to you or published on our Services constitutes your acceptance of the changes and consent to the modified version of this Policy. We will seek your consent when required under Applicable Laws.
Formulated on August 15, 2012
Revised on January 28, 2021