1Our commitment
We handle personal information in accordance with Japan's Act on the Protection of Personal Information ("APPI"), the Telecommunications Business Act, other applicable laws, and the guidelines of the Personal Information Protection Commission of Japan ("PPC").
This policy applies to personal information handled through our website (miraikoru.com), our AI voice agent service (the "Service"), and related business activities.
2Our two roles
We handle personal information in two different capacities. Which one applies determines who is responsible and where to send requests.
| Role | Information covered | Who is responsible |
|---|---|---|
| We decide how data is used (business handling personal information / controller) | Website visitors, people who contact us, and staff contacts at our customers | Mirai Koru |
| We process data for a customer (entrusted party / processor) | Call data of people ("Callers") who phone a business using the Service (a "Customer") | The Customer (we act on its instructions) |
For Caller data, the Customer decides the purposes and retention period. If you called a business and have a request about your call, please contact that business first. We will help the business respond.
3Definitions
- Personal information: information about a living individual that can identify that individual, as defined in Article 2(1) of the APPI.
- Special care-required personal information: sensitive information such as medical history that requires special care to prevent discrimination or prejudice (APPI Article 2(3)).
- Call data: a Caller's phone number, voice, recordings, transcripts, summaries, booking details and anything said during a call processed through the Service.
- Customer: a company or sole proprietor that has a Service agreement with us.
- Sub-processor: an external company to which we entrust part of our operations.
4Information we collect
| Category | Examples | Source |
|---|---|---|
| Enquiry information | Name, company, email, phone number, industry, message | You (contact form, email) |
| Contract and account information | Customer name, staff names, departments and contact details, login IDs, billing details | The Customer |
| Call data | Caller phone number, voice and recordings, transcripts, summaries, booking details, information shared during the call | Callers (on behalf of the Customer) |
| Usage and technical data | IP address, browser type, access times, pages viewed, dashboard activity logs | Collected automatically |
| Payment information | Payment method, billing and payment history | The Customer, our payment processor |
Credit card numbers are collected and stored directly by our payment processor and never stored on our servers.
5How we collect information
We collect personal information lawfully and fairly, never by deception or other improper means. Call data is collected on the basis that the Customer has properly informed Callers that they are speaking with an AI agent and that the call is recorded (see our Terms of Service).
6Why we use information
We use personal information only for the purposes below. For any other purpose, we will obtain consent first.
Information we handle for ourselves
- To answer enquiries and provide demos, quotes and proposals
- To enter into and perform contracts, provide the Service and manage accounts
- To bill customers and confirm payments
- To provide support, resolve incidents and send important notices (such as changes and maintenance)
- To improve the Service, develop features and analyse usage (using statistics that do not identify individuals)
- To prevent fraud and keep the Service secure
- To tell you about our services and events (you can opt out at any time)
- To comply with legal obligations and handle disputes
Call data we process for Customers
- To answer calls, ask questions, take and change bookings, and send follow-ups as configured by the Customer
- To create recordings, transcripts and summaries and provide them to the Customer
- To operate the Service reliably, including incident response, quality checks and fraud prevention
7Sensitive information
When the Service is used by clinics and similar businesses, Callers may share health information. We handle such special care-required information only as instructed by the Customer and as needed to provide the Service, under especially strict controls.
The Customer is responsible for obtaining any consent the law requires to collect such information and for its other legal obligations. Our AI agents do not provide medical diagnosis or advice.
8AI processing and model training
The Service uses speech recognition, language understanding and speech synthesis to handle calls automatically. The agent responds within the content and rules set by the Customer. It never makes decisions that have legal or similarly significant effects on a Caller by itself, and Callers can ask to be transferred to staff at any time (depending on the Customer's settings).
- Training: We do not use call data to train general-purpose AI models. Only with a Customer's prior written consent may we use it to improve that Customer's own agent.
- AI sub-processors: Our contracts with AI technology providers prohibit them from using call data to train their own models.
- Statistics: We may use statistics processed so that no individual can be identified (for example, call volume by hour) to improve the Service.
9Sharing with third parties
We do not provide personal information to third parties without prior consent, except:
- where required by law;
- where necessary to protect a person's life, body or property and consent is difficult to obtain;
- where especially necessary for public health or the healthy development of children and consent is difficult to obtain;
- where necessary to cooperate with a government body performing duties prescribed by law, and seeking consent could interfere with those duties; or
- in other cases permitted by the APPI.
The following are not treated as provision to a third party:
- entrusting the handling of personal information to sub-processors as needed for the stated purposes (see Sub-processors); and
- transfers as part of a merger or other business succession.
10Sub-processors
To provide the Service, we may entrust the following work to external companies.
| Work entrusted | Main information involved |
|---|---|
| Cloud hosting (data storage and processing) | All information described in this policy |
| Telephony and carrier services | Phone numbers, voice |
| Speech recognition, language understanding and speech synthesis | Voice, transcripts |
| SMS, LINE and email delivery | Phone numbers, email addresses, message content |
| Payment processing | Payment information |
| Customer support and business tools | Enquiry, contract and account information |
We select sub-processors with adequate data protection, bind them by contract to confidentiality, purpose limitation, restrictions on onward subcontracting and incident reporting, and supervise them appropriately. Customers can request our current sub-processor list.
11International transfers and storage
We store data in data centres in Japan wherever possible. However, because of how some cloud and AI services work, personal information may be processed or stored on servers in other countries (mainly the United States).
In such cases, we confirm that the sub-processor maintains a system meeting the standards set by the APPI and put the necessary contractual measures in place. Under APPI Articles 28 and 32, we will provide the following on request:
- the name of the country;
- an overview of that country's personal information protection system; and
- the measures the sub-processor takes to protect personal information.
12Joint use
We do not currently use personal information jointly with other companies. If we do in future, we will first publish who the joint users are, the purposes and the person responsible, as required by law.
14How we protect information
We take the following measures to prevent leakage, loss or damage of personal information.
| Basic policy | We maintain a basic policy, including this document, to ensure personal information is handled properly. |
|---|---|
| Handling rules | We have rules setting out how information is handled, and who is responsible, at each stage: collection, use, storage, provision and deletion. |
| Organisational measures | We appoint a person responsible for personal information, review handling regularly, and maintain reporting procedures for incidents. |
| Personnel measures | Staff sign confidentiality agreements and receive regular data protection training. |
| Physical measures | We control areas where personal information is handled and prevent theft or loss of devices and documents. |
| Technical measures | Encryption in transit and at rest, role-based access, multi-factor authentication, logging and monitoring, and vulnerability management. |
| Understanding foreign environments | Where information is handled abroad, we take security measures informed by that country's data protection system. |
15How long we keep information
We keep personal information only as long as needed for its purposes, then delete it securely so it cannot be restored.
| Type of information | Retention period |
|---|---|
| Enquiry information | 3 years after the enquiry is resolved |
| Contract and billing information | 7 years after the contract ends (statutory period) |
| Call recordings, transcripts and summaries | The period set by the Customer (90 days by default). The Customer can delete them at any time. |
| Usage and technical data | 1 year from collection |
| Backups | Overwritten on a rolling basis within 35 days |
After a contract ends, Customer data, including call data, is deleted within the period set out in our Terms of Service.
16If an incident occurs
If personal information is, or may have been, leaked, lost or damaged, we will immediately act to contain it, investigate the cause and prevent recurrence.
- Where required by the APPI, we will report to the PPC and notify the individuals affected.
- For incidents involving a Customer's call data, we will notify the Customer, in principle within 72 hours of becoming aware, and cooperate in its response.
17Your rights and how to make a request
You may ask us to do the following for personal data we hold about you:
- tell you the purposes of use;
- disclose the data (including records of provision to third parties);
- correct, add to or delete the data;
- stop using or erase the data; or
- stop providing the data to third parties.
How to make a request
- Email hello@miraikoru.com with the subject "Personal information request".
- We will ask for proof of identity (such as a copy of a driver's licence). Requests by an agent require a power of attorney and the agent's ID.
- Once we confirm your identity, we will respond in writing or by email, in principle within 2 weeks.
We do not charge a fee. If we cannot meet a request under the law, we will explain why.
Caller call data is controlled by the Customer. Please send requests about a call to the business you called. If you contact us directly, we will pass your request to that business and help it respond.
18If you live outside Japan
If you are in the European Economic Area or the United Kingdom, we handle your personal data under the GDPR and UK GDPR as follows:
- Legal bases: performance of a contract (providing the Service), legitimate interests (improving and securing the Service), legal obligations, and consent (for example, marketing).
- Your rights: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.
- Transfers: personal data is transferred to Japan, which has an EU adequacy decision. For transfers to other countries we use appropriate safeguards such as standard contractual clauses.
- Complaints: you may lodge a complaint with the data protection authority in your country.
For California residents: we do not sell personal information or share it for cross-context behavioural advertising.
19Children
The Service is for businesses, and our website is not directed at anyone under 16. We do not knowingly collect personal information from children under 16 through our website. If a minor calls a Customer, the call data is handled according to the Customer's instructions.
20Changes to this policy
We may update this policy to reflect changes in law or in our business. For material changes, we will announce the change and its effective date on this website or by notice to Customers at least 30 days before it takes effect. The updated policy applies from the effective date shown on this page.
21Company details and contact
| Company | Mirai Koru |
|---|---|
| Address | Kinkai 3rd Building, 1-14-5 Shinkawa, Chuo-ku, Tokyo 104-0033, Japan |
| Representative | Ren |
| Privacy contact | hello@miraikoru.com Weekdays, 9:00 to 18:00 JST (excluding Japanese public holidays and New Year) |
We are not currently a member of an Accredited Personal Information Protection Organization. If you are not satisfied with our response, you may also contact the Personal Information Protection Commission of Japan.
This English version is a translation provided for convenience. If it differs from the Japanese version, the Japanese version prevails.