Privacy policy | Taiyaku

1. Basic Policy and Operator Information

CORNU LAB (“we”, “us” or “our”) establishes this Privacy Policy (this “Policy”) on the handling of the personal information of users (“you”) of the translation service “Taiyaku” that we provide (including the website and the browser extensions; the “Service”).

We comply with the Act on the Protection of Personal Information of Japan (the “APPI”) and other related laws, regulations and guidelines, and handle personal information properly. Terms used in this Policy such as “personal information”, “personal data” and “retained personal data” have the meanings defined in the APPI.

Operator information

Name: CORNU LAB
Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan
Representative: Disclosed without delay upon request.

2. Information We Collect

In providing the Service, we obtain the following information by proper means.

(1) Account information

Email address and display name
Password (we do not store the password itself; we store only a hash value converted into a form that cannot be reversed)
If you sign in with a Google, Apple, Yahoo! JAPAN or LINE account, the user identifier, email address and email verification status, name (used as your display name) and profile image URL provided by that service
Two-factor authentication settings
Account settings, such as display language and translation display preferences
Where you came from when you signed up (the domain name of the referring website on your first visit, advertising or campaign parameters such as utm_source, the first page you viewed, and whether you signed up on the website or in an extension)

(2) Content sent for translation

The following content that you instruct us to translate or otherwise process, and the results of that processing (translations, transcriptions, knowledge cards, etc.):

Text you enter or paste
The body text of web pages
Text extracted from PDFs
Video subtitles
Audio (when you use the audio translation feature)
Terms registered in glossaries
The URL (excluding query strings and fragments) and title of the web page, video or PDF you translate (the title may also be sent to AI providers as context for the translation)

If this content contains personal information, we obtain that personal information as a result.

(3) Usage information

Usage amounts such as the number of characters translated, PDF pages, audio time and knowledge card lookups; translation history (date and time, type, languages, processing status, etc.); and your current plan

(4) Payment information

Payments for paid plans are processed by Stripe, Inc. (“Stripe”). Card information such as credit card numbers is obtained and managed by Stripe, and we do not hold it. We receive from Stripe the information necessary to manage your subscription, such as your customer identifier, plan, subscription period and payment status.

(5) Device and log information

IP address, browser type and version (User-Agent), operating system, date and time of access, request content, error information, and information on sign-in sessions (sign-in date and time, date and time of last use, device type, etc.)

(6) Cookies and similar technologies

Cookies that keep you signed in (set with the HttpOnly attribute, so that scripts on web pages cannot read them)
A cookie that saves your display language setting
Your browser’s local storage, used to save the display theme and, when you are not signed in, your translation display preferences
Your browser’s local storage, used to keep where you came from on your first visit (see (1)) for 30 days until it is sent to us when you sign up (it is never sent to other websites or third parties)
Extension storage, used by the browser extensions to keep you signed in and to save settings

The website of the Service does not use cookies for delivering advertising or for tracking your activity across other websites. You can disable cookies in your browser settings, but if you do, some features, such as signing in, may not be available.

(7) Inquiry information

Your name, email address, the content of your inquiry and other information you provide when contacting us

3. Purposes of Use

We use the personal information we obtain for the following purposes:

to provide the Service (translation, knowledge cards, translation of subtitles, audio and PDFs, display of translation history, etc.);
for registration, identity verification, sign-in authentication (including two-factor authentication) and keeping you signed in;
for billing, payment and subscription management for paid plans;
to measure usage and manage the usage limits of each plan;
to contact you as needed to manage your account, such as for email verification and password resets;
to send important notices about the Service, such as changes to the Terms of Service, outages, maintenance and security;
to respond to inquiries;
to prevent, investigate and respond to unauthorized access, misuse and conduct that violates the Terms of Service, and to ensure security;
to measure the effect of advertising and promotion of the Service (using statistically processed information, such as the number of sign-ups by source);
to investigate failures, to maintain and improve the quality of the Service, and to consider new features (statistically processed usage information is used for quality improvement and the consideration of new features);
to comply with laws and regulations; and
for purposes incidental to the purposes above.

4. Handling of Translation Data

We handle the data used for translation, which is at the core of the Service, as follows.

(1) When content is sent

Content to be translated is sent to our servers only when you perform an action to run a translation. The browser extensions send page content or subtitles only when you instruct them to translate, when you view a website for which you have turned on automatic translation, or when you play a video with subtitles while subtitle translation is turned on. We do not collect the content of the pages you are viewing or your browsing history without an action or setting on your part.

(2) No use for AI model training

We do not use content sent for translation or its translation results to train AI models. With the AI providers to which we outsource translation processing (see “5. Provision to Third Parties and Outsourcing”), we also use contractual terms or settings under which the data we send is not used to train AI models. However, the handling of data by AI providers is subject to each provider’s terms of use and privacy policy (each provider may retain data for a certain period, for example to monitor for misuse).

(3) Translation cache

To respond faster when the same text is translated repeatedly, we use a translation cache. The translation cache does not store the source text itself; it stores an irreversible hash value calculated from the source text and related data, and the corresponding translation. As a rule, the translation cache is kept separately for each user (an internal user identifier that we assign is used to separate it) and is not provided to other users. However, for a translation of a single sentence without surrounding context or glossary terms, we may store the translation in a shared cache that contains no information identifying you and use it to respond to other users who translate the same sentence.

(4) Knowledge cards

The knowledge card feature queries the public Wikipedia API from our servers with terms, such as proper nouns, extracted from the text being translated. Only the terms are queried; we do not send the full text or any information that identifies you. Images shown in knowledge cards are loaded by your browser directly from the servers of Wikimedia Foundation, Inc. (see “9. Analytics and External Transmission”).

(5) A request to you

When translating content that contains other people’s personal information or confidential information, please consider carefully whether doing so is necessary.

(6) Information handled by the browser extensions

The tokens that keep you signed in are stored in the extension storage on your device and are used only for communication with our servers.
Settings such as target languages and display style are also saved on our servers as account settings while you are signed in. Other settings, such as the list of websites to translate automatically, are not sent to us; if your browser’s sync feature is on, they may be synced to your other devices through the service of your browser’s provider.
We use information obtained through the extensions only to provide and improve the features of the Service. We do not sell it to third parties, and we do not use or provide it for advertising or for determining creditworthiness.

We do not provide personal data to third parties without your prior consent, except in the following cases:

where required by laws and regulations;
where it is necessary to protect the life, body or property of a person and it is difficult to obtain your consent;
where it is especially necessary to improve public health or to promote the sound development of children and it is difficult to obtain your consent;
where it is necessary to cooperate with a national government agency, a local government, or a person entrusted by either of them, in performing affairs prescribed by laws and regulations, and obtaining your consent is likely to interfere with the performance of those affairs; or
other cases permitted under the APPI or other laws and regulations.

Recipients of personal data in the following cases are not considered third parties:

where we outsource all or part of the handling of personal data to the extent necessary to achieve the purposes of use
where personal data is provided as a result of the succession of business in a merger or for other reasons

Service providers

We outsource the handling of personal data to the following providers to the extent necessary to achieve the purposes of use. When outsourcing, we select providers that handle personal data appropriately and exercise necessary and appropriate supervision over them through contracts and other means.

AI providers (OpenAI, L.L.C. and others)We send content to be translated (including context such as page titles) for processing such as translation, extraction of terms and writing of explanations for knowledge cards, and audio transcription. We currently use the AI models of OpenAI, L.L.C. If we change our settings, we may use the AI models of Anthropic, PBC or Google LLC.
Payment processor (Stripe, Inc.)We outsource payment processing and billing management for paid plans. When you subscribe, we provide Stripe with your email address, display name and the user identifier we assign to you.
Email delivery provider (Cloudflare, Inc.: Cloudflare Email Service)We outsource the sending of emails, such as email verification, password resets and notices.
Network provider (Cloudflare, Inc.)We outsource the relay and delivery of traffic to and from the website and servers of the Service, DNS, analytics of the website (Cloudflare Web Analytics) and related services.
Backup storage (Google LLC: Google Drive)We store database backups there, encrypted.
Receipt of inquiry emails (Cloudflare, Inc.: Email Routing / Google LLC: Gmail)Used to forward, receive and store inquiry emails.

Queries to external services

To create knowledge cards, we query the public Wikipedia API, operated by Wikimedia Foundation, Inc., with terms such as proper nouns. This is a search of publicly available information and does not involve providing your personal information.

Sign-in with external accounts

When you sign in with a Google, Apple, Yahoo! JAPAN or LINE account, we receive your user identifier, email address and other information from the provider of that service with your consent. The handling of information by each service is subject to that provider’s privacy policy.

6. Provision to Third Parties in Foreign Countries (Cross-Border Transfers)

The service providers listed in “5. Provision to Third Parties and Outsourcing” include providers located in foreign countries (“foreign service providers”). We provide the following information in accordance with Article 28 of the APPI.

(1) Destination countries

United States of America (OpenAI, L.L.C., Stripe, Inc., Cloudflare, Inc., Google LLC, and Anthropic, PBC if we use it under our settings)
Other countries where foreign service providers process or store data (Cloudflare, Inc. processes network traffic in data centers around the world)

(2) Systems for the protection of personal information in the destination countries

The United States has no comprehensive federal law equivalent to the APPI, but personal information is protected by sector-specific federal laws and by state laws such as the California Consumer Privacy Act. Details of each country’s system are available in the “Survey of Systems for the Protection of Personal Information in Foreign Countries” on the website of the Personal Information Protection Commission of Japan (in Japanese).

(3) Measures taken by foreign service providers

We outsource the handling of personal data to foreign service providers after confirming, through contracts, data processing agreements, terms of use and other means, that they have established systems that meet the standards prescribed in Article 16 of the Enforcement Rules of the APPI. Foreign service providers take measures such as limiting the purposes of use, security control measures, supervision of employees, supervision of subcontractors and responding to leaks and other incidents.

We periodically check, by appropriate and reasonable methods, how foreign service providers implement these measures and whether the destination country has any system that may affect their implementation, and we take the actions necessary to ensure that the measures continue to be implemented. Information on these actions will be provided without delay upon request to the contact point in “13. Contact Point”.

7. Retention Periods

We retain personal information to the extent necessary for the purposes of use and endeavor to delete information without delay once it is no longer needed. The retention periods for the main types of information are as follows.

Translation history for text and PDFsDepending on the plan you were on at the time of translation, the input content and translation results are deleted automatically after 7 days on the Free plan, 30 days on the Basic plan and 1 year on the Pro plan. You can also delete them yourself within the retention period.
Web page, subtitle and audio translationsThe content and results of processing are deleted automatically 24 hours after processing.
Translation cacheOnly hash values and translations are stored, and they are deleted automatically after a set period (currently 30 days).
Knowledge card cacheTerms and their explanations are deleted automatically 90 days after they were last updated.
Account informationRetained for as long as the account exists.
Sign-in session recordsDeleted 30 days after the session ends, for example when you sign out.
Security recordsThe date and time, IP address and browser type (User-Agent) of operations such as sign-ins and password changes are retained for 1 year to prevent and investigate misuse, and then deleted.
Server access logsRetained for a limited period for security and the investigation of failures, and deleted automatically, oldest first.
BackupsDatabase backups taken in case of failures are retained for 14 days and then deleted. Deleted information may therefore remain in backups for that period.
When you delete your accountImmediately after you complete the deletion procedure, we make the account unable to sign in and cancel any paid plan subscription. We also erase your email address, password hash, display name, two-factor authentication settings, linked external accounts and account settings, and delete your translation history (input content and translation results), glossaries, per-user knowledge cards and translation cache. Other information associated with the account (such as usage records and sign-in session records) is completely deleted 30 days after the deletion procedure. However, information that we are required by law to retain, such as transaction records, is retained for the period prescribed by law.

8. Security Control Measures

We take the following measures to prevent the leakage, loss or damage of personal data and otherwise to manage personal data securely.

(1) Establishment of a basic policy

We have established and published this Policy to ensure the proper handling of personal data.

(2) Organizational security measures

We appoint a person responsible for the handling of personal data and check how personal data is handled, and we have established a system for reporting to the Personal Information Protection Commission and notifying the individuals concerned under the APPI if a leak or other incident occurs.

(3) Human security measures

We impose confidentiality obligations on employees who handle personal data and train them in the proper handling of personal data.

(4) Physical security measures

The servers that store personal data are located in a locked place managed by us, and we take measures to prevent the theft or loss of devices used to handle personal data.

(5) Technical security measures

Passwords are hashed with argon2id before they are stored.
Tokens used to keep you signed in and to reset passwords are hashed before they are stored, and they expire.
Communications with the Service are encrypted with TLS.
We offer two-factor authentication with an authenticator app.
Access to personal data is limited to the minimum number of people necessary and is controlled.
We use mechanisms that detect and limit unauthorized sign-in attempts and excessive access.

(6) Understanding the external environment

We outsource the handling of personal data to providers located in the United States of America, and we take security control measures based on an understanding of that country’s system for the protection of personal information (see “6. Provision to Third Parties in Foreign Countries (Cross-Border Transfers)”). The servers that store personal data are located in Japan.

9. Analytics and External Transmission

(1) Analytics

To understand the use of the Service’s website statistically and improve the Service, we use Cloudflare Web Analytics, an analytics tool provided by Cloudflare, Inc. It does not use cookies and neither identifies individuals nor tracks activity across other websites.

(2) External transmission (published under Article 27-12 of the Telecommunications Business Act of Japan)

The recipients, the information sent and the purposes for which the Service’s website and browser extension have your device send information to other companies are published on External Transmission of User Information. The handling of information by each recipient is subject to that recipient’s privacy policy.

10. Requests for Disclosure, Correction, Suspension of Use and Other Actions

Under the APPI, you may request us to notify you of the purposes of use of your retained personal data, to disclose it (including disclosure of records of provision to third parties), to correct, add to or delete its content, to suspend its use or erase it, and to stop providing it to third parties (together, “Disclosure and Other Requests”).

(1) How to make a request

Please send the details of your request to the email address in “13. Contact Point”.
We will verify your identity by confirming that the request was sent from your registered email address or by other methods we specify. If the request is made by an agent, we may ask for documents that confirm the agent’s authority.
We will respond without delay in accordance with the law and inform you of the outcome. If we cannot comply with a request under the law, we will tell you so and explain why.

(2) Fees

Requests for notification of the purposes of use and requests for disclosure are free of charge.

(3) Actions you can take yourself

You can change your display name and password, set up two-factor authentication, unlink external accounts, review signed-in devices and delete your account yourself in Account settings.

Contact: [email protected]

11. Use by Minors

If you are a minor, please use the Service with the consent of your legal representative, such as a person with parental authority. The consent of your legal representative is also required to apply for a paid plan.

12. Changes to This Policy

We may revise this Policy in response to amendments to laws and regulations, changes to the content of the Service and other circumstances. When we change the purposes of use, we will do so within a scope reasonably considered to be related to the purposes of use before the change, and we will publish the changed purposes of use or notify you of them. If we change the purposes of use beyond that scope, we will obtain your consent in advance.

We will announce important revisions by appropriate methods, such as posting on the Service or notifying your registered email address. The revised Policy takes effect when it is posted on this page.

13. Contact Point

Please direct inquiries and complaints about this Policy and the handling of personal information, and Disclosure and Other Requests, to the following contact point.

Business name: CORNU LAB
Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan
Representative: Disclosed without delay upon request.
Person responsible for the handling of personal information: Disclosed without delay upon request.
Email address: [email protected]

As a rule, we accept inquiries by email.