CauseDecode Privacy Policy

Last Updated: October 7, 2026 Effective Date: October 8, 2026 Version: 1.0
IN MY BOOK, inc. (the "Company") establishes this Privacy Policy (the "Policy") as follows regarding the handling of user information and personal information in "CauseDecode" (the "Service") provided by the Company.
This Policy applies together with the Terms of Use, Data Policy, and other related rules established by the Company for the Service.
This English version is provided for reference purposes only. If there is any inconsistency or discrepancy between the Japanese version and this English version, the Japanese version shall prevail.
Japanese version: https://xdecode.jp/products/causedecode/privacy-policy/

1. This Policy applies to user information and personal information acquired or handled by the Company in connection with browsing, registration, login, analysis, contracts, payments, inquiries, support, and other use of or activities related to the Service.
2. Where the Service uses an external service, the privacy policy, terms of use, and other conditions of the provider of that external service may apply to the provider's handling of information.
3. In addition to this Policy, the Company's separate Data Policy may apply to the handling of market data, macroeconomic data, financial data, statistical data, analytical data, Analysis Results, and other data used in the Service.

The Company may collect or handle the following information in providing the Service.

1. Account and authentication information
   Email address, display name, profile image URL, identifiers provided through Google or other external authentication services, authentication status, login date and time, session information, device- or browser-related identifiers, and other information necessary for account management and authentication.
2. Contract, eligibility, and payment information
   Pricing plan, contract status, eligibility to use the Service, billing currency, contract period, cancellation or reactivation status, payment status, customer IDs, contract IDs, transaction IDs, and other information issued by payment service providers that is necessary for contract and payment management.
   As a general rule, credit card numbers and other detailed payment method information are handled by payment service providers rather than by the Company.
3. Service usage and analysis information
   Selected Data Series, analysis periods, analysis conditions, analysis execution history, Analysis Results, analysis history, saved status, information relating to reanalysis, usage counts, usage plan, language setting, functions used, navigation from Public Research, and other information relating to use of the Service.
4. Technical and operational information
   Access date and time, IP address, User-Agent, cookies, session information, device information, browser information, language settings, request identifiers, error information, incident information, security information, access logs, logs relating to user actions or product events, and other information necessary for the secure provision, maintenance, and operation of the Service.
5. Marketing consent information
   The status, scope, and version of consent to the xdecode newsletter (including product news and research updates), when and how consent was given, withdrawals of consent, and other information necessary to manage such consent.
6. Inquiry and support information
   Name or display name, email address, inquiry details, support history, communications with the Company, attachments or related information, and other information necessary to respond to inquiries.
7. Information relating to external services
   Information provided by, or necessary for integration with, external services used by the Service, including Google authentication, payment service providers, cloud services, and other external services.

The Company uses the information it collects for the following purposes:

1. To provide the Service, manage authentication and login, manage Accounts, and identify Users.
2. To verify eligibility, pricing plans, usage counts, and other conditions of use and to provide appropriate functions and access levels.
3. To accept and conduct Analyses; generate, store, and display Analysis Results; and provide analysis history, saving functionality, reanalysis, and other functions of the Service.
4. To manage contracts, calculate fees, process billing and payments, handle plan changes, cancellations and reactivations, confirm contract status, and perform other processing necessary to provide paid services.
5. To integrate with external data sources, authentication services, payment service providers, cloud services, and other external services.
6. To respond to inquiries, provide support, handle incidents, verify identity, provide important notices, and conduct administrative communications.
7. To maintain and operate the Service, investigate incidents, improve quality and functionality, understand usage, conduct statistical analysis, and develop new functions.
8. To ensure security and to detect, prevent, investigate, and respond to unauthorized access, misuse, account sharing, circumvention of usage limits or access controls, violations of applicable rules, attacks, and other improper conduct.
9. To verify compliance with, and respond to violations of, the Terms of Use, Data Policy, this Policy, and other rules established by the Company.
10. To respond to requests from courts, administrative authorities, police, and other public authorities, or to protect the Company's rights or legitimate interests.
11. To record and manage Users' explicit consent to the xdecode newsletter and, where recipient-address eligibility and other sending requirements have been verified, to deliver product news, research updates, and other service-related information by email in accordance with applicable law and unsubscribe or suppression status.
12. To aggregate or otherwise process information regarding use of the Service so that individuals or specific Users cannot be identified, and to use such information for Service improvement, research, business decisions, and Service operations.
13. For other purposes incidental or related to the purposes set forth above.

1. The Company uses Google authentication services to the extent necessary for login, authentication, Account identification, and other provision of the Service.
2. Information obtained by the Company through Google includes email address, display name, profile image URL, Account identifier, and other information necessary for authentication and Account display. The Company does not obtain a User's Google Account password.
3. The Company uses information obtained through Google within the scope necessary for the purposes set forth in this Policy, including provision of the Service, authentication, Account management, security, support, and sending the xdecode newsletter to Users who have explicitly consented to receive it.
4. Information obtained through Google may be stored or referenced, to the extent necessary, in the Company's shared authentication infrastructure and systems used to provide the Service.
5. The Company does not use information obtained through Google for sale to data brokers, creditworthiness assessments, lending decisions, or other purposes unrelated to the Service.
6. The Company does not provide information obtained through Google to third parties except where permitted by law, where the User has consented, where such information is handled by contractors as necessary to provide the Service, where necessary for security or investigation of misuse, or otherwise as provided in this Policy.

1. The Company may use cookies and similar technologies for the provision of the Service, maintenance of login status, session management, retention of language and other settings, security, prevention of misuse, understanding usage patterns, and optimizing display.
2. Users may disable or delete cookies through their browser settings. However, if cookies required for authentication, session management, or other functions of the Service are disabled, some or all functions of the Service may become unavailable.
3. The Company may use server logs, product event logs, monitoring functions provided by cloud services, and other operational information for Service operation, incident investigation, security, and understanding of usage.
4. The Company designs and manages its systems so that authentication tokens, internal authentication information, API keys, detailed payment information, and other secret information are not recorded in ordinary operational logs or product event logs.

1. We may send product news, research updates, and other service-related information by email as the xdecode newsletter. We will send advertising or promotional emails only after disclosing their purpose and scope, obtaining the User's explicit consent, verifying the recipient address, honoring unsubscribe requests, and satisfying other requirements under applicable law.
2. Access to product features under the CauseDecode Free plan requires valid consent to receive the xdecode newsletter, as disclosed on the registration screen or elsewhere. This condition does not restrict an existing paid subscription, paid-equivalent benefits, the authentication account itself, access to Settings, or subscription and billing management.
3. Users may request to unsubscribe from the newsletter or withdraw consent through the methods described in an email, our contact channel, or another method we provide. We will not send advertising or promotional emails contrary to an unsubscribe request. When valid consent in CauseDecode is explicitly withdrawn and expires, Free plan product features become unavailable. Email suppression, delivery failure, or changes in an external email provider's status do not by themselves establish that the User withdrew consent.
4. We may still send essential service notices concerning contracts, billing, security, incidents, changes to terms, and other operational matters regardless of newsletter consent.

1. The Company does not provide personal data to third parties without the User's prior consent except in any of the following cases:
   
   1. Where required or permitted by law.
   2. Where necessary to protect the life, body, or property of a person and it is difficult to obtain the consent of the person concerned.
   3. Where particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the consent of the person concerned.
   4. Where cooperation is necessary for a national government agency, local government, or a person entrusted by such body to perform duties prescribed by law, and obtaining the consent of the person concerned is likely to impede the performance of such duties.
   5. In other cases permitted by the Act on the Protection of Personal Information or other applicable laws and regulations.
2. The Company may outsource the handling of personal data to external service providers to the extent necessary to achieve the purposes of use, including provision and maintenance of the Service, payment processing, authentication, cloud hosting, and support. Under applicable law, provision of personal data in connection with such outsourcing may not constitute provision to a third party.
3. Where personal data is provided in connection with a merger, company split, business transfer, or other business succession, such provision may not constitute provision to a third party under applicable law.
4. When outsourcing the handling of personal data, the Company exercises necessary and appropriate supervision over the service provider in accordance with applicable law.

1. To the extent necessary to provide the Service, the Company may use external services or service providers for cloud hosting, databases, authentication, payments, email delivery, monitoring, inquiry management, development, maintenance, operations, and other functions.
2. The Service may use external services including Google authentication, payment processing services, cloud services, and other services that the Company considers necessary to provide the Service.
3. Providers of external services may be located outside Japan, or information may be processed on servers or other systems located outside Japan.
4. Where the provision of personal data to a party located outside Japan is subject to requirements relating to cross-border transfers under applicable law, including in cases involving outsourcing to an overseas service provider, the Company takes measures required by the Act on the Protection of Personal Information and other applicable laws, including providing required information, obtaining consent where required, and confirming measures taken by the recipient to protect personal information.

1. Analysis Results, analysis history, saved status, usage counts, and other information linked to a Registered User are, as a general rule, handled within the scope of that User's use of the Service and are not made available to other general Users.
2. User-specific Analysis Results on the Service are managed separately from Public Research. A User's Analysis Results are not, in their original form or automatically, published as Public Research.
3. The Company and its service providers may handle User-specific information to the extent necessary to achieve the purposes set forth in this Policy, including provision of the Service, incident investigation, security response, inquiry handling, and compliance with applicable law.

The Company takes necessary and appropriate security measures to prevent leakage, loss, damage, unauthorized access, misuse, and other risks relating to personal data. Such measures include:

1. Managing and minimizing access privileges.
2. Appropriately managing authentication information, API keys, secrets, and other confidential information.
3. Encrypting communications and appropriately managing stored information.
4. Enforcing access controls for authenticated Users and separating User-specific data.
5. Monitoring logs and incidents and detecting misuse.
6. Exercising necessary and appropriate supervision over personnel and service providers handling personal data.
7. Investigating security incidents, preventing the expansion of damage, preventing recurrence, and providing notices or reports where required.

1. The Company retains collected information for the period necessary to provide the Service and achieve the purposes of use, for the duration of a contract or Account where appropriate, for any period required by law, and for periods necessary for dispute handling, prevention of misuse, security, accounting and tax processing, and other legitimate purposes.
2. The Company may determine or change retention periods for Analysis Results, analysis history, contract records, payment-related records, logs, audit records, and other information depending on the operational, technical, legal, or other needs of the Service.
3. Backups, logs, and other information retained for system operations are handled in accordance with ordinary operational cycles or retention policies established by the Company.
4. This Article does not guarantee permanent retention or perpetual availability of Analysis Results or other information.

1. With respect to retained personal data held by the Company, Users may, in accordance with the Act on the Protection of Personal Information and other applicable laws, request notification of purposes of use; disclosure; correction, addition, or deletion; suspension of use; erasure; suspension of provision to third parties; or disclosure of records concerning provision to third parties.
2. The preceding paragraph does not mean that the Company provides a function allowing Users, at their discretion, to delete or modify all Analysis Results, analysis history, or other information within the Service.
3. A User making a request under the preceding paragraphs shall submit the request through the contact point specified in Article 16 or by another method designated by the Company and shall provide information necessary for identity verification.
4. After confirming that the requester is the individual concerned or a duly authorized representative, the Company will respond in accordance with applicable law.
5. Where permitted by law, the Company may decline all or part of a request.
6. Where the Company establishes a fee for a request for notification of purposes of use, disclosure, or another request for which a fee may lawfully be charged, the Company will provide information on the amount or method of calculation in the manner prescribed by the Company.

Where a minor uses the Service, the minor shall obtain the consent of a person with parental authority or other legal representative to the extent required by applicable law.

If the Company becomes aware of leakage, loss, damage, or another security issue involving personal data, or the risk thereof, the Company will, depending on the nature of the incident, investigate the facts and cause, identify the scope of impact, prevent the expansion of damage, take measures to prevent recurrence, notify affected individuals, report to the Personal Information Protection Commission of Japan, and take other measures required by applicable law.

1. The Company may amend this Policy due to amendments to laws or regulations, changes to the Service, changes to external services, security measures, business needs, or other reasons.
2. When amending this Policy, the Company will notify or announce the amended contents and effective date by posting them on the Service or the Company's website, by email, or by another method the Company considers appropriate.
3. For material changes, the Company will make reasonable efforts to enable Users to review the substance of the changes.

For inquiries, complaints, consultations, requests for disclosure or other statutory rights, and other communications concerning the handling of personal information under this Policy, please contact:
Business Operator Handling Personal Information: IN MY BOOK, inc. Address: 1-36-2 Shinjuku, Shinjuku-ku, Tokyo, Japan Representative: Yuki Ozawa, Representative Director Contact: https://xdecode.jp/en/contact/

Terms of Use: https://xdecode.jp/en/products/causedecode/terms/
Data Policy: https://xdecode.jp/en/products/causedecode/data-policy/
Commercial Transactions: https://xdecode.jp/en/commercial-transactions/