Privacy Policy

1. Information we collect

(1) Users of Kiriwake for Business

• Account information (name, email address, organization name, role)
• Session information to keep you signed in, and the activity log (type of operation, who, when)

(2) Business data registered by customer organizations

• Employee information (name, email address, department, start date, manager, contact language, etc.)
• Uploaded document files and the fields extracted from or entered for them
• Attendance records (clock-in, clock-out and break times, correction requests and history), leave requests, granted and remaining days
• Expense claims (date, payee, amount, registration number, etc.) and receipt files
• Workflows, tasks, approvals, year-end adjustment declarations and similar business information

We handle this business data on the instructions of the customer organization in order to provide the Service (entrusted handling of personal information). Documents showing a My Number (individual number) and documents containing health information are out of scope for the Service.

(3) Inquiries and demo requests

• Information entered in forms, such as company name, name, email address, phone number (optional), company size and your request

(4) Users of the personal tool (legacy service)

• Income and expense data entered by the user (date, amount, counterparty, etc.) and session information that identifies the user

(5) Usage environment

• Access logs such as browser type, access time and IP address

2. Files selected in the Data Converter

Files you select in the Data Converter are read, converted and exported in your browser and are not sent to our servers. File contents and results are not stored by us and are not written to browser storage. Only the conversion setup (column names, conditions, formulas, etc.) can be saved.

3. Purposes of use

• Providing the Service, verifying identity and keeping you signed in
• Document processing, attendance, leave and expense management, workflow management and multilingual messages on the instructions of the customer organization
• Responding to inquiries and demo requests and providing onboarding information
• Preventing misuse and ensuring security
• Improving the Service and considering new features (in a form that does not identify individuals)

We never use business data registered by customer organizations for our own advertising or for other purposes.

4. AI processing

AI processing of documents and automatic reading of expense receipts run only when an administrator of the customer organization has turned on AI processing. Only the document or receipt file (and, for documents, the document type) is sent to the API of an external AI service provider; registered information such as employees' names is not sent. The AI provider handles the data as our subcontractor. Data Converter files are never sent to AI.

If the AI provider is located outside Japan, we provide the name of the country, information on that country's personal-information protection system and the measures taken by the provider at onboarding or on request.

5. Provision to third parties

We do not provide personal information to third parties without the consent of the person or the customer organization, except:

• where required by law
• where necessary to protect life, body or property and consent is difficult to obtain

6. Subcontracting

To the extent necessary to provide the Service, we may entrust the handling of personal information to cloud service providers (servers and data storage), AI service providers and others, and we supervise them appropriately.

7. Security measures

To prevent leakage, loss or damage of personal information, we take measures such as:

• Protecting communication with HTTPS (HSTS in production)
• Role-based permissions and separation of data by organization (all checked on the server)
• Field-level encryption of personal data such as employee names, contact details, addresses, dates of birth, year-end declarations and payslips (encryption keys managed separately from the database)
• Storing document and receipt files in non-public storage with server-side encryption requested, and viewing them only after a permission check
• Automatic sign-out after a period without activity
• Recording the main operations in an activity log

8. Retention

Document files are handled according to the retention period set by the customer organization. Attendance and leave records and expense claims with receipts are not deleted automatically, because labor and tax laws require them to be kept. Other information is kept for as long as needed for its purpose or as agreed with the customer organization, and is deleted appropriately when no longer needed.

9. Cookies

The Service uses cookies to keep you signed in and for security (CSRF protection). The public pages of the website use Google Analytics to understand usage; it collects data with cookies but no information that identifies individuals. Google Analytics is not loaded in the signed-in business screens. The public pages also use Cloudflare Web Analytics, which does not use cookies, to understand page views and loading speed; it is not loaded in the signed-in business screens either.

10. Requests for disclosure, correction, deletion, etc.

If a person requests disclosure, correction, suspension of use or deletion of retained personal data, we respond in accordance with the law after confirming their identity. For employee information registered by a customer organization, please make requests through that organization. Deletion of records that must be kept by law is handled together with the customer organization, taking retention periods into account.

11. Changes to this policy

We may change this policy in response to changes in laws or in the Service. Changes apply from the time they are posted on this page.