Privacy Policy
Legal review required (draft) This document is an automatically generated draft. Do not publish it until legal review is complete.
MeSight Inc. (the "Company") establishes this Privacy Policy (this "Policy") regarding the handling of personal information of users (the "Users") of "DaySprinter" (the "Service"), which the Company provides.
1. Company information
- Company name: MeSight Inc.
- Address: MIEUX Shibuya Building 8F, 5-3 Maruyamacho, Shibuya-ku, Tokyo, Japan
- Representative: Ryo Jiromaru
2. Information collected and how it is collected
The Company collects the following information in providing the Service.
| Information collected | Details | How it is collected |
|---|---|---|
| Email address | The user's email address. Where Sign in with Apple is used, the address provided by Apple (which may be a private relay address depending on the user's settings) | Entered or obtained when the user voluntarily registers an Account |
| Usage logs | API access logs, and records of the number of requests per IP address in the authentication function | Collected automatically when the Service is used |
| Device information | The device token and platform type used to deliver push notifications, and the advertising identifier and similar information used to display advertisements | Collected automatically when the Service is used |
| Measurement data | Task names, recorded times, segment laps, target times, and the like | Collected when the user measures or enters them in the Service |
| Purchase information | Signed transaction information issued by the App Store | Collected when the user purchases a Paid Plan |
The Company does not collect or retain credit card numbers or any other payment information. Billing for Paid Plans is processed by in-app purchase via the App Store, and information relating to payment is handled solely by Apple.
Registering an Account is optional. Without a registered Account, the measurement, history, and analysis features of the Service run on the device, and measurement data is not stored on the Company's servers.
3. Purposes of use
The Company uses the personal information it collects for the following purposes.
| Information collected | Purpose of use |
|---|---|
| Email address | Account authentication (sending the sign-in link), account identification, transferring data when the user changes devices, and responding to enquiries (including identity verification) |
| Usage logs | Investigating faults, and detecting and preventing improper use |
| Device information | Delivering push notifications and Live Activities, and displaying advertisements (see section 7) |
| Measurement data | Providing the measurement, history, and analysis features of the Service |
| Purchase information | Determining the validity of a Paid Plan and sharing purchase status across devices |
The Company does not use email addresses to send marketing or promotional email. The Company also does not use usage logs for behavioural analysis or advertising purposes.
4. Provision to third parties
Except in the following cases, the Company does not provide personal information to third parties without the user's prior consent.
- Where required by law.
- Where necessary to protect a person's life, body, or property and it is difficult to obtain that person's consent.
- Where particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the person's consent.
- Where it is necessary to cooperate with a national agency, a local authority, or a party entrusted by them in performing duties prescribed by law, and obtaining consent could impede the performance of those duties.
In addition, device information is transmitted to an advertising provider in connection with the display of advertisements in the Service. See section 7 for details.
5. Outsourcing
The Company outsources all or part of the handling of personal information to third parties, to the extent necessary to achieve the purposes of use. The service providers are as follows.
| Service provider | Outsourced work |
|---|---|
| Turso (Turso Cloud) | Operation of the database |
| Google Cloud (Google LLC) | Running the API server; storage of access logs and secrets |
| Resend | Sending authentication email |
The Company selects service providers appropriately and exercises the necessary and appropriate supervision to ensure the secure management of personal information.
6. Provision to third parties overseas and storage in foreign countries
In providing the Service, the Company handles personal data in foreign countries through the service providers set out in the preceding section. The countries and regions concerned are as follows.
| Service provider | Country of establishment | Country or region where personal data is handled |
|---|---|---|
| Turso (Turso Cloud) | United States | United States (Oregon) |
| Google Cloud (Google LLC) | United States | Japan (Tokyo) |
| Resend | United States | United States |
For information on the personal information protection regime of the United States, please refer to the information on foreign regimes published by the Personal Information Protection Commission of Japan. The Company has entered into agreements with the above service providers concerning the handling of personal data and takes the measures necessary to ensure the continued implementation of equivalent safeguards under the Act on the Protection of Personal Information.
Measurement data is stored first on the user's device. It is synchronised to the database above only where the user registers an Account and signs in.
7. Cookies, advertising, and analytics tools
7.1 Analytics tools
The Company does not use analytics tools in the Service. Should the Company introduce such tools in the future, it will add to this Policy the tools used, the information collected and its purpose, and the method of opting out, and will give notice in advance.
7.2 Advertising
The Company displays advertisements in the free plan of the Service using Google AdMob, an advertising service provided by Google LLC. No advertisements are displayed in a Paid Plan.
- In delivering advertisements, Google may collect the advertising identifier and other device information. For the handling of that information, please see Google's Privacy Policy.
- The Company displays personalised advertising only with the user's consent. Consent is obtained using Google's User Messaging Platform (UMP), together with the permission required under the App Tracking Transparency framework on iOS.
- Consent and permission may be changed at any time from the iOS settings screen (Settings > Privacy & Security > Tracking) and from the designated flow within the Service. Users who do not consent may still use the Service, but non-personalised advertisements will be displayed.
7.3 Cookies
The Company does not use cookies in the Service.
8. Security control measures
The Company takes necessary and appropriate measures to prevent leakage, loss, or damage of personal information and otherwise to manage personal information securely.
9. Retention period and handling on account deletion
The Company retains personal information only for the period necessary to achieve the purposes of use and, after that period, deletes it except where retention is required by law.
Account deletion is handled as follows.
- Where a user deletes their Account by the method designated within the Service, the data stored on the Company's servers is deleted immediately. The data deleted includes account information, measurement data, purchase status, and device tokens. The Company does not retain deleted data for any period (so-called logical deletion).
- For users who use Sign in with Apple, the link with Apple is also revoked upon deletion.
- The database used by the Company includes automatic backups for the purpose of recovery from failures. The retention period for these backups is at most 24 hours, so deleted data is erased from the backups within approximately 24 hours at the latest. The Company does not restore or use personal data from those backups.
10. Requests for disclosure, correction, and deletion
Users may request the Company to disclose, correct, add to, delete, or suspend the use of their personal information in accordance with the Act on the Protection of Personal Information. To make a request, please contact the address in "13. Contact". The Company will verify the identity of the requester and respond without delay in accordance with the law.
11. For users in the European Economic Area (EEA), the United Kingdom, and Switzerland
Where the Service is used from the European Economic Area, the United Kingdom, or Switzerland, the EU General Data Protection Regulation (GDPR) and equivalent national laws apply. In that case, the Company, as data controller, handles personal data as follows.
11.1 Legal bases for processing
The Company processes personal data on the following legal bases.
| Personal data processed | Purpose of use | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Email address | Account authentication and identification; transferring data when changing devices | Performance of a contract (b) |
| Email address | Responding to enquiries (including identity verification) | Performance of a contract (b) or legitimate interests (f) |
| Usage logs | Investigating faults | Legitimate interests (f) |
| Usage logs | Detecting and preventing improper use | Legitimate interests (f) |
| Device information (device token) | Delivering push notifications and Live Activities | Performance of a contract (b) |
| Device information (advertising identifier and similar) | Displaying advertisements | Consent (a) |
| Measurement data | Providing the measurement, history, and analysis features | Performance of a contract (b) |
| Purchase information | Determining the validity of a Paid Plan; sharing purchase status | Performance of a contract (b) |
Where processing is based on legitimate interests, the Company carries it out having weighed those interests against the rights and freedoms of users. Where processing is based on consent, users may withdraw their consent at any time. Withdrawal takes effect for the future only and does not affect the lawfulness of processing carried out before it.
11.2 Rights of data subjects
Users may exercise the following rights against the Company. To exercise them, please contact the address in "13. Contact".
- The right of access (to request disclosure of their personal data).
- The right to rectification (to request correction of inaccurate personal data).
- The right to erasure (the so-called "right to be forgotten").
- The right to request restriction of processing.
- The right to data portability (to request provision in a structured, machine-readable format).
- The right to object (to object to processing based on legitimate interests).
- The right to withdraw consent.
- The right to lodge a complaint with a supervisory authority.
11.3 Retention period and international transfers
The retention period and the handling of data on account deletion are as set out in "9. Retention period and handling on account deletion".
The Company is established in Japan and handles personal data in Japan and the United States (see "6. Provision to third parties overseas and storage in foreign countries"). Transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to those countries are carried out on the basis of standard contractual clauses or other appropriate safeguards.
12. For users in California
Where the Service is used from the State of California, the California Consumer Privacy Act (CCPA, including as amended by the California Privacy Rights Act (CPRA)) may apply. In that case, users have the following rights. To exercise them, please contact the address in "13. Contact".
- The right to know the categories of personal information the Company collects, their sources, the purposes of use, and the categories of recipients.
- The right to request disclosure of their personal information.
- The right to request deletion of their personal information.
- The right to request correction of their personal information.
- The right not to receive discriminatory treatment for exercising these rights.
- The right to opt out of the "sale" or "sharing" of personal information.
The Company does not sell personal information for monetary consideration. However, where an advertising identifier or similar information is provided to an advertising provider in connection with the display of advertisements in the free plan of the Service, this may constitute "sharing" as defined in the CCPA (that is, provision for the purposes of cross-context behavioural advertising). Users may disable personalised advertising by the methods described in "7.2 Advertising".
13. Contact
For enquiries about this Policy and the handling of personal information, please contact the following.
- Contact point: login@me-sight.com
- Email address: login@me-sight.com
- Personal information protection manager: Ryo Jiromaru
14. Changes to this Policy
The Company may change this Policy in response to amendments to laws and regulations or changes to the content of the Service. Where a material change is made, the Company will give notice by posting within the Service or by another appropriate method. The amended Policy takes effect when it is posted on this page.
Authoritative text
The authoritative text of this Policy is the Japanese version. Even where a translation has been prepared for reference, in the event of any discrepancy between a translation and the Japanese version, the Japanese version prevails.
- Established: to be confirmed after legal review
- Last revised: to be confirmed after legal review