Personal Data Protection Policy

1.1 This Policy is established by TimeTechnologies Co., Ltd. (located at Roppongi T-Cube, 3-1-1 Roppongi, Minato-ku, Tokyo, Japan).

1.2 This Policy applies together with the Privacy Policy separately established by the Company (the “Common Policy”). If there is any inconsistency between them, this Privacy Policy prevails.

1.3 In this Policy, "Personal Data" means information relating to an identified or identifiable natural person, including directly identifying information such as names and email addresses, as well as information that may identify a specific individual when combined with other information, such as IP addresses, Cookies, Device IDs, and other technical identifiers.

3.1 The Company uses collected information for the following purposes:

• (a) Providing, operating, and maintaining the Service
• (b) Setting up, authenticating, and managing Users' accounts
• (c) Instagram integration, brand analysis, planning of posting strategies, and automatic content generation
• (d) Providing paid plans, payment processing, billing management, and handling refunds
• (e) Sending notices of important changes, updates, and notifications regarding the Service
• (f) Providing customer support and improving the quality of responses
• (g) Improving the features of the Service and developing new features
• (h) Ensuring security, and detecting, preventing, and investigating unauthorized use and unauthorized access
• (i) Handling failures, log analysis, internal auditing, and troubleshooting
• (j) Analyzing usage patterns
• (k) Notifications for marketing purposes
• (l) Fulfilling accounting, tax filing, and other legal obligations
• (m) Responding to and defending against legal claims

3.2 For certain features of the Service, information entered by Users may be sent to third-party AI services contracted by the Company for the purpose of content generation and analysis.

4.1 The Company processes Personal Data based on the following legal bases.

4.2 The legal bases described above reflect the Company's general framework for lawful processing. In jurisdictions where a particular legal basis described in this section (such as legitimate interest) is not recognized or available under applicable local law, the Company processes the relevant Personal Data on the basis of the User's consent or other legal basis permitted under the laws of that jurisdiction. Where additional consent is required, the Company will obtain such consent before commencing the relevant processing.

5.1 The Company may disclose or entrust Personal Data to the following recipients only to the extent necessary for the purposes described in this Policy.

5.2 The Company implements necessary contractual, technical, and organizational safeguards with these service providers in accordance with applicable laws and regulations.

6.1 The Company is based in Japan. In connection with the provision of the Service, Personal Data may be stored, processed, and transferred in Japan, the United States, Canada, Malaysia, and other countries where the Company or its service providers operate.

6.2 The Company implements the following contractual, technical, and organizational safeguards for such transfers in accordance with applicable laws and regulations:

• (a) Entering into data processing agreements with service providers that include obligations relating to data protection, confidentiality, and security no less protective than those described in this Policy;
• (b) Confirming that the destination country or the recipient maintains an adequate standard of personal data protection, or, where such standard has not been confirmed, implementing appropriate contractual safeguards; and
• (c) Where required by applicable law, obtaining the User's consent prior to transferring Personal Data to a country that does not provide an adequate level of protection, after informing the User of the possible risks of such transfer, or establishing appropriate safeguards which supplement the User's consent in accordance with the applicable law.

7.1 The Company retains Personal Data only for the period necessary for each processing purpose. In determining the appropriate retention period, the Company considers the nature and sensitivity of the data, the processing purpose, legal retention obligations, the need for dispute resolution, and other relevant circumstances. The target retention periods are as follows:

• (a) Account information and service usage data: Deleted from active databases immediately after account cancellation and deleted from backups within [30] days thereafter.
• (b) Waiting List registration information: If the registrant creates an account for the Service, this information is retained in accordance with the retention periods applicable to account information. If the registrant does not create an account, this information is deleted within [6] months after the general release of the Service. If the registrant withdraws consent, this information is deleted promptly.
• (c) Access logs and technical logs: Deleted within [6] months from collection.
• (d) Payment history, transaction IDs, and contract information: Retained in accordance with legal retention obligations (up to [7] years under Japanese tax and accounting laws and regulations).

7.2 Notwithstanding the above, the Company may retain Personal Data beyond the periods above if required by legal obligation, security needs, dispute resolution, or contractual necessity.

8.1 The Company uses Cookies and other similar technologies (beacons, tags, scripts, etc.) for operating the Service, maintaining login status, ensuring security, analyzing usage patterns, and improving features.

8.2 The Cookies used by the Company are classified as follows:

• (a) Strictly necessary Cookies: Cookies necessary for providing the basic features of the Service.
• (b) Functional Cookies: Cookies used for maintaining login status, remembering language settings, and other convenience improvements.
• (c) Analytics Cookies: Cookies used for detailed analysis of usage patterns.

These Cookies are processed on the applicable legal basis described in Article 4 of this Policy (legitimate interest for strictly necessary Cookies and functional Cookies, and consent for analytics Cookies, or such other legal basis as applicable in the User's jurisdiction).

8.3 The Company provides Users with the ability to manage Cookie settings through a CMP (Consent Management Platform) or other appropriate means. Users may change or manage Cookie settings in their browser or the CMP. However, if strictly necessary Cookies are disabled, some features of the Service may not function properly.

9.1 Under applicable data protection laws and regulations, Users may have the following rights with respect to Personal Data held by the Company:

• (a) Right of access: The right to request confirmation of Personal Data being processed by the Company and to obtain a copy.
• (b) Right to rectification: The right to request correction or completion of inaccurate or incomplete Personal Data.
• (c) Right to erasure: The right to request deletion of Personal Data if certain conditions are met.
• (d) Right to restriction of processing: The right to request restriction of the processing of Personal Data if certain conditions are met.
• (e) Right to object: The right to object at any time, on grounds relating to a User's particular situation, to processing based on legitimate interest as its legal basis.
• (f) Right to data portability: The right to receive Personal Data in a structured, commonly used, and machine-readable format, and to transfer it to another controller, to the extent permitted by applicable laws and regulations.
• (g) Right to withdraw consent: The right to withdraw consent at any time for processing based on consent as its legal basis. However, such withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• (h) Right to lodge a complaint with a supervisory authority: The right to lodge a complaint with the competent supervisory authority if a User objects to the Company's processing of Personal Data.

9.2 Depending on the User's jurisdiction, additional rights may be available under applicable local law, including the right to request information about the categories of Personal Data collected and the categories of third parties to whom it has been disclosed, the right to direct the Company not to sell or share Personal Data, and the right not to receive discriminatory treatment for exercising data protection rights. As of the effective date of this Policy, the Company does not sell Personal Data and does not share Personal Data for advertising purposes. The specific rights available to each User are determined by the applicable law of the User's jurisdiction.

9.3 To exercise any of these rights, please contact the inquiry desk described in Article 16. The Company will respond within the period required by the applicable law of the User's jurisdiction, after verifying the User's identity and completing any other necessary verifications, in accordance with applicable laws and regulations.

10.1 The Company does not knowingly collect Personal Data of individuals who are minors under applicable law without the consent of a parent or other legal guardian where required by such applicable law.

10.2 If the Company becomes aware that Personal Data of an individual who is a minor under applicable law has been provided without the consent of a parent or other legal guardian, the Company will promptly delete such information and take any other necessary measures. If you believe this may be the case, please contact the inquiry desk in Article 16.

11.1 The Company implements appropriate administrative, technical, and physical security measures to prevent unauthorized access to, use of, alteration of, disclosure of, or destruction of Personal Data. However, data transmission over the internet and electronic storage methods cannot, by their nature, guarantee complete security. The Company implements reasonable measures, but does not guarantee absolute security.

11.2 In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data (a "Data Breach"), the Company will comply with applicable breach notification obligations under the laws and regulations of the relevant jurisdiction, including notification to the competent supervisory authority and to affected Users where required. The Company maintains internal procedures for detecting, assessing, and responding to Data Breaches.