Privacy Policy

Multilingual versions are translations to aid understanding. The Japanese original prevails for legally accurate content.

RATIO Lab. LLC (the “Company”) handles information concerning users of “Kawaii REC” (the “Service”) provided by the Company as follows.

1. Information we collect

The Company may collect the following information in providing the Service.

• Account information: Google account identifier, email address, display name, profile image URL and email verification status.
• Authentication and usage environment information: session identifiers, cookies, IP address, user agent, access date and time, last login date and time, and error and security logs.
• Creation data: project names, BPM and time signatures, track and editing settings, YouTube video IDs and URLs, and other project metadata.
• Audio data: audio that users import or record and choose to save to the cloud.
• Contract and payment information: purchased plan, product type, purchase amount, contract and payment status, tip amount, payment date and time, Stripe customer, subscription and payment identifiers, KOMOJU payment session and transaction identifiers, special-code issuance and redemption status, identifiers of purchasers and redeeming accounts, and organization name, contact person, billing name, email address and receipt address for business licenses, as well as payment results. The Company may store a verification hash instead of the special code itself. Card numbers, security codes, bank account information and other payment-method details are handled by payment providers such as Stripe or KOMOJU; the Company generally does not collect or retain them directly.
• Invitation program information: personal invitation code, identifiers of referring and referred accounts, date and time of registration through an invitation link, achievement status through “Try paid features” or paid-plan use, and granting, receipt and expiration of rewards.
• AI consultation information: consultation text entered into “Vocal Coach Mashiro,” conversation history, session start time and the number of times guidance links are displayed. Consultation text is sent to Google's generative AI service to generate answers. The Company does not store consultation text in its database; it records daily usage counts.
• Inquiry information: name, email address, inquiry contents and other information voluntarily provided by users.

2. On-device and cloud storage

When using the Service without logging in or choosing browser storage, projects and audio are generally stored in the user's browser storage (IndexedDB, localStorage, etc.) and are not uploaded to the Company's servers unless a cloud-save operation is performed. Data may be lost through deletion of browser data, changing devices, private browsing or similar circumstances.

When users save to the cloud after signing in with Google, project metadata is stored in Cloudflare D1 and audio data in Cloudflare R2. Cloud storage is limited to 1 GB for the free version and 8 GB for the paid version.

3. Purposes of use

The Company uses collected information for the following purposes.

• Identity authentication and management of accounts, sessions and cloud projects.
• Providing recording, editing, storage, synchronization, exporting, AI consultations and other Service features.
• Determining eligibility for free and paid features; contracts, payments, billing, cancellation and fraud prevention.
• Calculating invitation-program results, granting rewards and preventing self-referrals, multiple-account abuse and other fraud.
• Responding to inquiries, identity verification and requests for disclosure and similar actions.
• Investigating problems, improving quality, ensuring security and responding to violations of the Terms of Service.
• Retaining legally required records and exercising or defending rights.

The Company does not use audio or AI consultation text for advertising delivery or training its own AI models beyond the scope necessary to provide features to users and respond to malfunctions or fraud.

3-2. MCP integration

When a fully paying user connects Remote MCP, MCP-compatible AI services can access cloud project names, track information, audio, analysis results and processing settings within the permissions granted by the user. The Company records audit information, including connected accounts, invoked functions, target projects and execution results, for security, fraud prevention and troubleshooting. Processed audio is saved as a separate cloud audio file without overwriting the original. Conversations entered into the AI service and that service's storage and training settings are subject to the connected provider's terms and privacy policy. Users review permissions on the consent screen when connecting and authorize the integration.

4. External services and outsourced processing

To the extent necessary to operate the Service, the Company may use the following providers' services and entrust information processing to them. Each provider may process information in facilities in its service region or abroad.

• Cloudflare, Inc.: web delivery, API execution, databases, audio storage, security and access logs (Privacy Policy). www.cloudflare.com
• Google LLC: authentication through Google OAuth, generation of AI consultation responses through the Gemini API, and the YouTube embedded player (Privacy Policy). policies.google.com
• Stripe, Inc. and affiliates: payments, subscriptions, customer portal and payment-fraud prevention (Privacy Policy). stripe.com
• KOMOJU Co., Ltd.: payments for special codes for one-year and one-time-purchase plans, payment confirmation, refunds and handling payment fraud. To the extent necessary for payment, email addresses, user and purchase identifiers, product types, amounts, transaction information, IP addresses, user agents and similar information may be sent to KOMOJU and the selected payment institution (Privacy Policy). ja.komoju.com
• Amazon Web Services, Inc. (Amazon SES): important notices about payments, security and similar matters, and emails about creative support, new features and other topics to which users have individually consented. Processing may include email addresses, subjects, bodies, delivery results and delivery events such as bounces, complaints, opens and link interactions necessary for delivery (Privacy Notice). aws.amazon.com
• X Ads (X Corp.): We use the X Pixel to measure page visits on the public website, comic, guide and app. X may process cookies and other identifiers, IP addresses, device/browser information and ad click identifiers. We do not send audio, work titles or email addresses as additional pixel parameters. Fixed campaign/language labels are passed through internal links and stored in the app session for up to 24 hours. With existing anonymous identifiers, we aggregate app arrivals, new registrations, recording starts and completions internally. (Privacy Policy) x.com
• SmartNews Ads (SmartNews, Inc.): measuring advertising effectiveness for page views (PageView) and new account registrations (SignUp) on the official site and app. Through the Pixel, SmartNews Ads may process identifiers such as cookies, IP addresses, device and browser information, advertising identifiers and similar data (Privacy Policy). www.smartnews.com

Optional emails about creative support, JOURNAL, new features, campaigns and similar topics are sent only when users explicitly opt in through the app's account settings. Users may unsubscribe at any time through settings or the unsubscribe link in each email. Optional emails are OFF by default for existing users. Important notices necessary to provide the Service, such as payments, security, changes to terms and retention deadlines, may be sent regardless of optional-email settings.

External services are subject to each provider's terms and privacy policy. The Company does not provide personal data to third parties without the individual's consent except where required by law, necessary to protect life, physical safety or property, or otherwise permitted by law.

5. Information concerning business programs

For consultations or applications to the Creator Partner Program, we collect business or organization name, business type, contact name, email address, website and social media, expected number of users, desired contract, delivery method and consultation details. These are used for implementation consultations, quotations, contracts, issuing or suspending affiliate licenses, billing, instructional courses, support, fraud prevention and audits. Application information will not be sold or provided to third parties for marketing purposes without the individual's consent.

6. Use of cookies and similar technologies

The Service uses essential cookies to prevent misuse of Google OAuth, maintain login status and renew sessions. Authentication cookies have attributes such as HttpOnly and Secure. Access tokens are valid for 15 minutes, session-renewal cookies for up to 30 days, and OAuth-process cookies for up to 10 minutes. On logout, authentication cookies are deleted and server-side sessions are invalidated.

We use the SmartNews Ads Pixel to measure advertising effectiveness for page views and new account registrations on the official site and app. The Pixel may process identifiers such as cookies, IP addresses, device and browser information, advertising identifiers and similar data. See SmartNews Ads guidance and privacy policy for details on advertising, measurement and opting out. Providers of external content such as YouTube may use cookies or similar technologies when that content is used.

7. Retention and deletion

The Company retains information for the period necessary to achieve its purposes, for the duration of the contractual relationship, or as required for legal, accounting, fraud-prevention or dispute-resolution purposes. Deleting a cloud project makes it unavailable from the normal project list. System backups, security records, payment and transaction records and similar data may be retained for the necessary period after deletion.

Users can erase browser-stored data by deleting the browser's site data. Logged-in users can delete their account and cloud information through “Delete account” in the account menu at the top right of the app, entering their email address for identity verification. Deletion invalidates all sessions and stops active Stripe subscriptions. On-device data is not automatically erased.

Cloud audio, projects, profiles, usage history, plan rights and similar data cannot be restored after account deletion. Minimum information necessary under law or to protect rights, including payment and transaction records, fraud-prevention records and security logs, may be retained for the necessary period after names, email addresses and similar information are detached. If you cannot perform this operation in the app, contact the office in section 11.

For free accounts with no login for 12 months after the last login, cloud audio, projects, account information and other data within the Service are automatically deleted. Deleted data cannot be restored. This does not apply while a paid plan is active. Existing free accounts receive a grace period treating the date this policy was introduced as their last login date. Minimum information necessary under law or to protect rights, including payment and transaction records, fraud-prevention records and security logs, may be retained for the necessary period after Service data is deleted.

8. Security measures

The Company takes necessary and appropriate security measures to prevent unauthorized access to, leakage, loss or damage of personal data, including access controls, encrypted communications, protection of authentication cookies, separation of confidential information, per-user cloud-data ownership checks, payment-webhook signature verification and upload limits. Details of security measures will be provided upon the individual's request to the extent this does not compromise security.

9. Disclosure, correction, suspension of use, deletion and other requests

Under Japan's Act on the Protection of Personal Information, users may request notification of purposes of use, disclosure, correction, addition or deletion, suspension of use or erasure, or suspension of third-party provision of their retained personal data held by the Company. When making a request, provide the contact in section 11 with the information concerned, the action requested and the information needed to verify identity. Where the law permits the Company not to comply, it will explain the reason.

10. Use by minors

When minors purchase a paid plan or provide personal information, they must obtain consent from a parent, guardian or other legal representative as required by their age and applicable law.

11. Contact

For inquiries about handling personal information, requests for disclosure and similar actions, or deletion of accounts and cloud data, please contact:

RATIO Lab. LLC (Ratio Lab). Representative member and CEO: Yoshishi Sakamoto. 3rd floor, 2-7-20 Ninomiya, Tsukuba, Ibaraki 305-0051, Japan. Email: [email protected] [email protected]

12. Changes to this policy

The Company may revise this policy in response to changes in laws, the Service or external services. Important changes will be announced in an understandable manner through the Service or official website by their effective date.

Established: July 7, 2026 / Last revised: August 26, 2026