Information Security Policy

Our Representative Director serves as the officer responsible for information security. We define a management structure and responsibilities suited to the scale of our business and the information we handle. We communicate information-handling precautions and responsibilities to those involved in our work and endeavor to improve their information security knowledge and awareness.

To maintain the confidentiality, integrity and availability of information, we implement safeguards suited to its nature and risks. We limit the collection, use and sharing of information to what is necessary for our work, review whether retention remains necessary, and appropriately delete or dispose of information that is no longer needed.

Access privileges and credential management:
We limit access to customer systems and the services we use to personnel and privileges necessary for the work. We use multi-factor authentication and similar measures according to service capabilities and the risks associated with the information handled. When work or contracts end or roles change, we remove access privileges that are no longer needed or request their removal.

Source code and confidential information management:
We manage source code and business documents with appropriate access controls. We keep passwords, API keys, access tokens and other secrets out of source code and public materials and store and manage them appropriately.

Protection of devices, communications and storage:
We combine measures such as encryption of communications, protection of stored data, device and software updates, and protection against malicious software as appropriate to the information and operating environment.

Misuse prevention for the inquiry form and popai:
For the inquiry form and popai, we accept submissions after our servers verify the result of a bot check that requires no on-screen action, and we limit simultaneous submissions and the number of submissions within short periods. Records used for these limits contain values derived using a keyed hash and similar data instead of original IP addresses, email addresses or message text, and expire automatically after short periods set in advance. We manage the keys used for these hashes and for signing identification cookies as secrets. For the inquiry form, if bot checks or submission limits cannot be confirmed, including when an external service is unavailable, we stop the submission and ask the user to try again. We do not display an unsent inquiry as completed. Automatic replies do not include a copy of what was entered, so that entered text or links are not sent to a third party whose email address is entered by mistake or through misuse.

We limit information used for AI features to what is necessary for the purposes of use and avoid unnecessary entry or external transmission of personal or confidential information. We keep popai analysis logs private and apply predefined rules to mask contact details, URLs and similar content before storing text. If we detect high-risk content, such as credentials, non-public customer or business information, or information requiring sensitive handling, we exclude the text of that question and answer from storage.

These processes do not guarantee detection and removal of all personal or confidential information or complete anonymization. Access to analysis logs, including access by administrators, is limited to personnel who need it for their work. We do not publish question and answer text as it is or automatically add it to public FAQs or public data used to generate answers.

We retain analysis logs for as long as necessary to improve answer quality and analyze question trends, and periodically review whether retention remains necessary. We endeavor to delete records that are no longer needed and text found to contain remaining personal or confidential information without undue delay. Our Privacy Policy sets out details of the purposes of use, external transmission, retention and other handling of personal information.

When using external services or outsourcing work, we review providers’ safeguards, contractual terms, and information processing and storage conditions according to the information and work involved, and select and manage providers appropriately. When outsourcing the handling of personal data, we exercise necessary and appropriate supervision over the providers concerned. Where information is processed or stored outside Japan, we also ascertain relevant local systems and requirements and take necessary protective measures in accordance with applicable laws.

We comply with Japan’s Act on the Protection of Personal Information and other applicable information security laws and guidelines. We also handle information in accordance with contractual security requirements, including non-disclosure agreements with customers and business partners.

If an incident such as information leakage, unauthorized access, loss or damage occurs, or we become aware of a suspected incident, we promptly establish the facts and scope of impact and work to contain damage, investigate the cause, restore operations and prevent recurrence. In accordance with laws and contracts, we report to the customers concerned, make required reports to authorities, notify affected individuals and take other necessary action.

We continually review this policy and our safeguards and make necessary improvements in light of changes in our business, services, operating environment, laws and threats. Please use the inquiry form on this website for questions or consultations about our safeguards.

Established: March 2, 2026
Revised: October 16, 2026
Popaz Co., Ltd.
Hiroaki Ishii, Representative Director